Subject: Re: [tcpm] Juniper's IPR on draft-ietf-tcpm-tcp-auth-opt-03

From: Eric Rescorla <[email-masked]>
Date: Wed, 25 Feb 2009 21:05:07 -0800

Ron,

Thanks for providing the patent application. I'll try to
review it ASAP and determine the extent to which it affects
AO.

-Ekr

---

From: Mark Allman <[email-masked]>
Date: Wed, 25 Feb 2009 23:49:30 -0500

> I am attaching a copy of the original patent application so that the WG
> can decide for itself the degree to which it covers TCP-AO. Having
> reviewed the patent application, I think that there is at least partial
> applicability to TCP-AO, 

It would be useful to hear where you believe the patent covers the AO
draft.

allman

---

From: Ron Bonica <[email-masked]>
Date: Wed, 25 Feb 2009 14:48:02 -0500

Folks,

Now that the dust has settled a bit, I would like to propose some next
steps regarding TCP-AO. First, I would like to apologize for the late
IPR disclosure. While there are no excuses, there were two extenuating
circumstances.

First, Juniper Networks Legal department had a problem in IPR
disclosures. As a result, many disclosures were batched up and released
in bulk during the first few weeks of 2009. The disclosures had many,
many problems, which have been addressed, for the most part, in other WGs.

Second, the disclosure against draft-bonica was particularly complex.
The patent application in question was filed against
draft-bonica-tcp-auth. That draft was rejected almost immediately upon
presentation the the WG several years ago. So, at at that point, since
draft-bonica wasn't likely to be adopted, there wasn't much point in
filing a disclosure.

Months later, the WG chartered a design team to address the problem,
starting from a fresh sheet of paper. At that point, it didn't seem
likely that there would be any overlap between the new and old
solutions. However, as time went by, the design team did replicate some
implementation details.

I am attaching a copy of the original patent application so that the WG
can decide for itself the degree to which it covers TCP-AO. Having
reviewed the patent application, I think that there is at least partial
applicability to TCP-AO, but I would be very happy to be talked out of
that position.

Again, my apologies...

                        Ron

---

From: Joe Touch <[email-masked]>
Date: Thu, 26 Feb 2009 10:54:57 -0800

Ron,

The patent application cites a disclosure dated Nov 1, 2005, but there
were three versions of your I-D published prior to that date.

It would be useful to explain the specific components not already
disclosed by those three I-Ds that are covered by this IPR, so we can
proceed to determine whether they are applicable to TCP-AO.

Joe

Ron Bonica wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> tcpm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tcpm

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 14:51:24 -0500

Mark,

This is where it gets complex. IANAL, but I think that the important
part of a patent application is the Claims Section. Claim 1, when stated
in general, is similar to TCP-AO. Claim 1 is conditioned by about a
dozen "methods". Some of those methods look similar to TCP-AO. Some of
them look very different.

The question is, how much do the methods of the patent application and
TCP-AO have to diverge before we can say that the is no IPR? To be
honest, I don't know the answer to that question.

                                  Ron

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 16:18:43 -0500

Joe,

The following documents attempt to describe identical technology:

- version 00 of the draft (Sept 16)
- version 02 of the draft (Oct 6)
- the patent application (Nov. 1)

Versions 01 and 02 of the draft correct a few mistakes and ambiguities,
but don't change the sense of the draft significantly.

Are you assuming that what is disclosed in version 00 of the draft is
not covered by IPR because version 00 of the draft was dated before the
patent application?

                                    Ron

---

From: Joe Touch <[email-masked]>
Date: Thu, 26 Feb 2009 13:26:33 -0800

Hi, Ron,

> not covered by IPR because version 00 of the draft was dated before the

That's a question for the ISOC's lawyers. I was, though, guessing that
versions 00, 01, and 02 all predate the provisional patent date -- not
the patent application date. Just curious, though. Like I said, this is
a job for someone who gets paid to do it...

Joe

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 16:41:32 -0500

Joe,

Wouldn't this become a non-issue if we could agree on licensing terms?
Pursuing that path is probably easier than figuring out the degree to
which the patent encumbers TCP-AO?

                               Ron

---

From: Joe Touch <[email-masked]>
Date: Thu, 26 Feb 2009 13:48:04 -0800

> which the patent encumbers TCP-AO?

The WG probably need to agree on licensing terms to proceed given the
assumption that the patent applies.

The ISOC needs to determine whether this is a valid claim.

These two happen in parallel, I presume.

Joe

---

From: David Borman <[email-masked]>
Date: Thu, 26 Feb 2009 16:01:36 -0600

In the United States, the inventor has to file for a patent within 1  
year of first disclosure.  From http://www.uspto.gov/web/offices/pac/doc/general/index.html#novelty
> If the invention has been described in a printed publication  
> anywhere in the world, or if it was known or used by others in this  
> country before the date that the applicant made his/her invention, a  
> patent cannot be obtained. If the invention has been described in a  
> printed publication anywhere, or has been in public use or on sale  
> in this country more than one year before the date on which an  
> application for patent is filed in this country, a patent cannot be  
> obtained. In this connection it is immaterial when the invention was  
> made, or whether the printed publication or public use was by the  
> inventor himself/herself or by someone else. If the inventor  
> describes the invention in a printed publication or uses the  
> invention publicly, or places it on sale, he/she must apply for a  
> patent before one year has gone by, otherwise any right to a patent  
> will be lost. The inventor must file on the date of public use or  
> disclosure, however, in order to preserve patent rights in many  
> foreign countries.
>

Of course, the lawyers have the final say, I'm just repeating what the  
USPTO has on their website. :-)

			-David Borman

On Feb 26, 2009, at 3:26 PM, Joe Touch wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi, Ron,
>
> Ron Bonica wrote:
>> Joe,
>>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (MingW32)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkmnCQkACgkQE5f5cImnZrvu+QCfU16jcFsZQPjNbXxYIIpebSJd
> jgkAn0sLuuGWE+GQ2OBd5N1aQ0VFyClI
> =h+kZ
> -----END PGP SIGNATURE-----

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 17:18:09 -0500

Joe,

I agree. I'll open the conversation by explaining the licensing terms
that Juniper proposed.

In order to determine what licensing terms were customary in the IETF,
Juniper explored the IETF IPR disclosure page. One formula appeared to
be used pretty commonly. An example of that formula can be found at the
following URL as well as many others:

    http://www.ietf.org/ietf/IPR/cisco-ipr-rfc-4507.txt

So, we copied that language, verbatim, replacing the word "Cisco" with
the word "Juniper" where appropriate. Our lawyers explained to me the
rationale behind the language. It is basically defensive, and promises
not to sue anybody who doesn't sue us.

                                             Ron

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Feb 2009 15:29:12 -0800

At Thu, 26 Feb 2009 16:41:32 -0500,
> which the patent encumbers TCP-AO?

I would certainly be a lot less motivated to study this patent if
Juniper were to grant a perpetual, irrevocable, unconditional
RANDZ license.

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Feb 2009 15:38:23 -0800

At Thu, 26 Feb 2009 17:18:09 -0500,
> not to sue anybody who doesn't sue us.

Sure, I'm quite familiar with these terms. And as I indicated, 
while they're better than "We don't promise anything", IMO
they're not very good. Quoting myself: 

    Sure. I object to an agreement to not assert patents against Juniper's
    a condition of patent licensing. That's not at all a generic
    non-assert. Moreover, the condition is not only on the implementor but
    on the end-user. This means that if I'm using a piece of Cisco gear
    that implements the covered technology [and I use the technology] and
    I assert a patent claim against Juniper, then Juniper could sue me for
    patent infringement even if the equipment manufacturer (Cisco in this
    case) had not asserted any patents against Cisco.
    
    I can see how Juniper would think this was good, and I suppose there
    is some GPL-style general equilibrium argument to be made that this
    improves social welfare. However, it's very far from a completely
    free to use license.

Now, obviously, you're free to think that these are good terms, but I
consider them sufficiently unattractive that it's worth spending
a fair amount of time to try to find alternatives that aren't so 
encumbered.

-Ekr

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 26 Feb 2009 17:53:22 -0800

> a fair amount of time to try to find alternatives that aren't so 

Perhaps more to the point, as TCP-AO has been justified to TCPM there
is no reason for there to be any new IP.

The ULP to ULP service is supposed to be unchanged from TCP-MD5, just
with better crypto mechanisms.

Those crypto-mechanisms are supposed to be established and proven, not
something created just for this specific purpose.

So we have *existing* digest methods being applied to an existing
need for authentication.

Where is there any need for anything that would be worthy of patenting?

-- 
Caitlin Bestler
[email-masked] - http://www.asomi.com/CaitlinBestlerResume.html

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Feb 2009 18:46:24 -0800

At Thu, 26 Feb 2009 17:53:22 -0800,
> with better crypto mechanisms.

I don't recall that being one of the claimed design constraints, and
it's certainly not true of AO, which involves mechanisms for selectively
using more than one key on the same connection (this has been true
since day one).

-Ekr

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 26 Feb 2009 18:46:28 -0800

> using more than one key on the same connection (this has been true

The ability to change the key without breaking the connection was 
clearly given as an objective. But techniques for doing a hitless
transition between two keys are very well known prior art.

Is there any justification for any technique that is novel enough
to justify any form of patent encumberance? I believe Juniper's
offer is fairly standard, but it is still an encumberance. No
matter how slight,why have any unless there was problem that had
to be solved where prior art was inadequate.

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 21:43:23 -0500

Ekr,

Is there anything in the disclosure language that suggests that the
license is revocable or otherwise not perpetual, so long as the one
licensing condition is met? If so, the licensing language says something
that we didn't mean to say. We can fix that.

The one condition of the license (i.e., we won't sue you if you don't
sue us) is copied verbatim from many other IETF IPR disclosures. We ask
only for the same protection that is granted routinely to other vendors.

Is there some reason why this protection should not be granted? If so,
there are lots of problematic IPR disclosures on the IETF web page.

                                            Ron

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 22:02:45 -0500

Eric Rescorla wrote:

> Quoting myself: 

I've checked with my legal department and they assure me that the
licensing terms do not expose end-users to risk. If this remains an
issue, I can ask them to add language that makes that explicit.

>     improves social welfare. However, it's very far from a completely

This kind of equilibrium is exactly what Juniper is hoping to achieve.
Juniper' like the vast majority of its competitors, makes money from
sales, not litigation. We want to spend our dollars on engineers, not
lawyers.

To some degree, I believe that that equilibrium has already been
reached. I hold this belief because this licensing condition is so common.

Searching the IPR disclosure web page, I see one company (aside from
Cisco and Juniper) using exactly the same language. One other company
uses nearly identical language to say the same thing. Most other
disclosures have some condition of "reciprocity".

                                       Ron

---

From: Mark Allman <[email-masked]>
Date: Thu, 26 Feb 2009 22:48:31 -0500

> honest, I don't know the answer to that question.

Right.  And, in fact, if Juniper is unwilling to precisely say what
exactly they think they own IPR on within the spec then it seems the
question you posed is essentially unanswerable without litigation.  That
is, we can all read the spec and the patent and get some idea of what we
*think* might be going on here.  But, ultimately if we don't know what
Juniper really believes in a very concrete fashion then we have no idea
when an implementation might run afoul of the patent.

Alas ...

allman

---

From: Mark Allman <[email-masked]>
Date: Thu, 26 Feb 2009 22:52:23 -0500

>     improves social welfare. However, it's very far from a completely

+1

FWIW.

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Feb 2009 23:22:28 -0500

Hi Mark,

If you like I can go back to Juniper Legal and get a competent opinion.
Until then, I don't think that I know enough about how patent law works
to answer intelligently. And even if I were to venture a guess, I have
no idea if it would be binding.

However, I do like Joe's recommendation that we explore two avenues in
parallel. In one thread, I will go back to Juniper legal to see if they
think that the patent application covers TCP-AO and I encourage others
to form their own opinion. On the other thread, we should figure out
what to do in the worst case, if it does cover TCP-AO.

                                Ron

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Feb 2009 23:03:03 -0800

At Thu, 26 Feb 2009 18:46:28 -0800,
> to be solved where prior art was inadequate.

I wasn't trying to express a position on the validity of the patent 
application. I'd need to study that. I was merely saying that 
AO is (for better or worse) more than just TCP-MD5 with ebtter
algorithms.

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Feb 2009 23:11:01 -0800

Merging two messages:

[# 1]
> that we didn't mean to say. We can fix that.

Well, that's a pretty big condition, IMO.

> there are lots of problematic IPR disclosures on the IETF web page.

[# 2]
> disclosures have some condition of "reciprocity".

I'm not sure what to say to this other than "huh?"

IETF isn't granting any protection to anyone. Rather, IETF determines
whether to incorporate specific technologies into their standards.
One consideration when making those decisions is whether those
technologies are encumbered and if so, the conditions under which the
license is granted. The license Juniper proposes is substantially less
free than it could be, and I, for one, would prefer that if the TCPM
WG has the option it select a technology which isn't subject to
licensing terms of this type. 

Again, I can certainly understand why Juniper would like to have
a mutually assured destruction patent situation with other companies,
but why exactly is it in the IETF's interest to assist them in 
that endeavor?

-Ekr