Subject: Re: Withdrawal of Approval and Second Last Call: draft-housley-tls-authz-extns

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Apr 2007 14:05:32 -0400

Hi, Dean.

First, with your permission I'd like to forward your comments to the
ietf list.  This is not a promise or invitation to forward future
comments, but you have made comments on an issue that the community
rather than the IESG decides and for your comments to be considered
they need to be made available to the community.

I can answer some of your questions.

The IETf learned of Brown's patent application on 2006-11-29.  At the
IESG telechat held the next day, the IESG decided to withdraw approval
and the general direction of its mesage to the community.  A
significant delay was introduced while the IESG reviewed its note with
the IETF's lawyer.

Please note that Russ recused himself from the decisions regarding
this draft.  Also note that the 2006-11-30 meeting was well before
Russ knew he would be appointed IETF chair.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Mon, 02 Apr 2007 16:44:31 -0400

Dean cannot post to the ietf list so I have forwarded his comments here.

Subject: RE: Withdrawal of Approval and Second Last Call: draft-housley-tls-authz-extns
From: Dean Anderson <[email-masked]>
To: Mark Brown <[email-masked]>
Cc: "'Simon Josefsson'" <[email-masked]>, "'Sam Hartman'" <[email-masked]>, Frank Ellermann <[email-masked]>, Dave Cridland <[email-masked]>, Peter Sylvester <[email-masked]>, Ted Hardie <[email-masked]>, "Steven M. Bellovin" <[email-masked]>, Paul Hoffman <[email-masked]>, John C Klensin <[email-masked]>, Jeffrey Hutzelman <[email-masked]>, Spencer Dawkins <[email-masked]>, Scott W Brim <[email-masked]>, Eliot Lear <[email-masked]>, Brian E Carpenter <[email-masked]>, <[email-masked]>, <[email-masked]>
Date: Sun, 1 Apr 2007 22:44:58 -0400 (EDT)

Ok, I've now read most of the patent documents and claims, and I've 
looked over the draft-housley-tls-authz-extns-07.txt.

Short answer: The RFC and the patent application are very close, if not
identical.  It is not the case that the patent is merely overbroad, and
therefore covers the housley draft; they are the same.  On the draft: 
rewrite so as not to infringe the patent application if granted.

The timeline of events is very important:

-- The first patent applicationis filed in January, 2005, with Mark D. 
Brown and David J. Wilke as the applicants.

-- The application was apparently amended September, 2005 with
application number 11/234404. This application is not listed in the IPR
disclosure, but can be found on the "Continuity Data" tab of the USPTO
web site (see below). This is somewhat strange, I think, especially as 
its the most similar to the housley draft.

-- The first draft of draft-housley-tls-authz-extns was submitted in
February, 2006.  Mark Brown and Russ Housley are the authors.

-- February 2007, IESG approval is withdrawn after Russ Housley becomes
Chair of IETF and IPR information comes out regarding the draft.

Having reviewed the documents, the 'housley' draft and the patent
application contain essentially identical message exchange diagrams.
For example, Figure 6 of the drawings associated with patent application
11/234404 is nearly identical with Figure 2 of
draft-housley-tls-authz-extns-07.txt.

It seems impossible to me that, as Brown describes below, that the
patent claims could merely 'be read more broadly.' This patent is
essentially identical with the IETF draft.  The primary difference is
the housley draft doesn't contain the concrete examples of the patent
application, and is more abstractly written.

I'm not sure what it means to file a patent and subsequently author an
essentially identical draft 'in good faith', since it is unclear what
bad faith would be.  I am still uncertain about when Brown and Housley
each knew about RFC3979, and when did they each know about the existance
of the patent application.  I haven't seen any such dates and evidence
on this by either Housley or by Brown.  I'm a still uncertain as to how
the existance of the patent application became known to the IETF.  I
would like to see definite answers to these questions, rather than
assurances of good faith.

BTW, creating a permanent royalty free license grant to the public is
quite easy.  Other variations are quite hard, until you get down to
licensing individual entities. However, you cannot simulataneously both
grant royalty free use of this patent, and continue to make money using
this patent as a monopoly on the technology; these are mutually
exclusive.

On the subject of how to proceed with the draft:  Having reviewed
documents, my view is that the technology in the patent application is
not novel, but would be obvious to anyone trying perform the services
described, and that therefore the patent application should be denied.
Furthermore, except for possibly overbroad claims, the TLS protocol
extension can be changed so that it doesn't use the patented methods.  
My recommendation, informed by the actual documents, is that the draft
should be rejected and rewritten using non-patented alternatives.

FYI: The patent files can be downloaded from the "How to Search" page at
http://www.uspto.gov/main/profiles/acadres.htm 
Then click "Track Patent Status" 
Then select "Application Number" and enter the application
number 60/646749 or 11/234404 and click on Search.

To get the patent documents, click the tab "Image File Wrapper" and 
download the images as a PDF.  There are other tabs which are 
interesting.

		--Dean

On Thu, 29 Mar 2007, Mark Brown wrote:

> Simon,
> 
> I filed for patent (Jan and Sep 2005) and later promoted TLS authz (Feb
> 2006) in good faith.  It is possible that the patent claims can be read more
> broadly than I expected, but that's a fairly detailed and unresolved legal
> question.  I am working diligently to -- let me speak carefully -- explore
> if and how I can make a royalty free license grant to ensure that promoting
> TLS authz continues to be an act in good faith, while still protecting a way
> for my company to make money on its IPR.
> 
> I have experienced some surprises when mixing law and Internet standards.
> To try to avoid surprises, I have hired IPR attorneys at two different firms
> to review my draft which proposes a royalty-free license grant.  I expect
> any resulting license will be conditioned upon IETF acceptance of TLS authz
> as a standard.  I hope to have concluded these services next week.
> 
> I think IPR questions are complicated in part because for some questions
> only a lawsuit can answer the question -- but we should all want to stay
> clear of these kinds of lawsuits!  So answers seem to me to be in short
> supply.  I want to craft the proposed license to make this situation a
> little clearer than that, but doing so often involves taking risks of giving
> away a huge loophole.  So I'm working to get good legal advice.
> 
> In short, I am working to create a royalty-free license grant -- hopefully I
> can disclose it next week.  With some luck, it will clarify the situation.
> 
> Best regards,
> 
> mark
> 
> > -----Original Message-----
> > From: Simon Josefsson [mailto:[email-masked]]
> > Sent: Thursday, March 29, 2007 10:12 AM
> > To: Sam Hartman
> > Cc: [email-masked]; [email-masked]; [email-masked]
> > Subject: Re: Withdrawal of Approval and Second Last Call: draft-housley-
> > tls-authz-extns
> > 
> > Sam Hartman <[email-masked]> writes:
> > 
> > >>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:
> > >
> > >     Simon> I don't care strongly about the standards track status.
> > >     Simon> However, speaking as implementer of the protocol: If the
> > >     Simon> document ends up as informational or experimental, I
> > >     Simon> request that we make an exception and allow the protocol to
> > >     Simon> use the already allocated IANA protocol constants.  That
> > >     Simon> will avoid interoperability problems.  I know the numbers
> > >     Simon> are allocated from the pool of numbers reserved for
> > >     Simon> standards track documents.  There is no indication that we
> > >     Simon> are running out of numbers in that registry.  Thus, given
> > >     Simon> the recall, I think the IETF should be flexible and not
> > >     Simon> re-assign the IANA allocated numbers at this point just
> > >     Simon> because of procedural reasons.
> > >
> > > Would you support publication on the standards track given the IPR
> > > situation as someone who has implemented?
> > 
> > If the patent concern is valid and covers TLS libraries or other
> > applications, no.
> > 
> > However, as far as I am aware of the public information that is
> > available, the situation appears to be that we don't know whether
> > these patents apply and to what extent.  I don't know whether the
> > patents were filed in good or bad faith.  More information from the
> > patent holders may help here.
> > 
> > If it is possible to implement the protocol without violating the
> > patents, I would support publication.  I've seen some claims that this
> > may be possible.  I have no interest in reading these patents myself,
> > but my position would be influenced if someone knowledgeable reads the
> > patents.
> > 
> > Given the amount of patents out there, it would be unreasonable for us
> > to move everything to informational just because someone finds
> > something that may be relevant to a piece of work.
> > 
> > The community needs to evaluate patent claims, and preferably reach
> > conservative agreement (rough consensus is not good enough) on whether
> > we should care about a particular patent or not.  Input to that
> > community evaluation process may be documentation of legal actions
> > taken by a patent owner.  Sometimes that may happen only after a
> > document has been published.
> > 
> > I would support down-grading standards track documents that later turn
> > out to be patent-infected to informational.  Doing so would avoid
> > sending a message that the IETF supports patented technology, when the
> > IETF community didn't know about the patents at publication time.  For
> > credibility of the process, I believe it is important that these
> > decisions are only made based on publicly available information.
> > 
> > /Simon
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Sam Hartman <[email-masked]>
Date: Tue, 03 Apr 2007 11:38:03 -0400

>>>>> "Dean" == Dean Anderson <[email-masked]> writes:

    Dean> On Mon, 2 Apr 2007, Sam Hartman wrote:
    >> The IETf learned of Brown's patent application on 2006-11-29.

    Dean> Can you elaborate?  From whom or what source did the IETF
    Dean> learn of the application?

The IETF learned through an IPR disclosure filed by Brown.
You can see that disclosure on our IPR disclosure page.

    >> At the IESG telechat held the next day, the IESG decided to
    >> withdraw approval and the general direction of its mesage to
    >> the community.  A significant delay was introduced while the
    >> IESG reviewed its note with the IETF's lawyer.
    >> 
    >> 
    >> Please note that Russ recused himself from the decisions
    >> regarding this draft.  Also note that the 2006-11-30 meeting
    >> was well before Russ knew he would be appointed IETF chair.

    Dean> What was Housley's position on the earlier elliptic curve
    Dean> crypto patent discussion that was suppressed on DNSEXT, and
    Dean> was subsequently a topic of the PR action against me?

    Dean> I don't have a record of Housley recusing himself from those
    Dean> related issues.

    Dean> -- Av8 Internet Prepared to pay a premium for better
    Dean> service?  www.av8.net faster, more reliable, better service
    Dean> 617 344 9000

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 20 Apr 2007 10:52:19 +0200

On 19 apr 2007, at 22.21, Dean Anderson wrote:

>
> On Thu, 19 Apr 2007, Simon Josefsson wrote:
>
>> Finally, here is another problem to consider: Your patent isn't valid
>> in the entire world.
>
> This isn't exactly true. RedphoneSecurity has a WIPO patent filing.  
> That
> gives them priority in every WIPO country, which is basically the
> civilized world.  (184 member countries).
> http://www.wipo.int/members/en/
>
> The patent is valid for priority in Sweden.  Swedish residents will  
> have
> to obtain a patent license.

That assume the PCT search report indicate that it is possible to  
patent this idea in Sweden.  We haven't seen the PCT report, so it is  
not possible to tell.  Still, until the patent has been issued, as  
far as I know, it is not valid.

But this tangent seems off-topic, so I'll refrain from further  
generic patent-discussions.

/Simon

---

From: Thierry Moreau <[email-masked]>
Date: Fri, 27 Apr 2007 10:49:41 -0400

Dear all, dear Mr. Brown:

Mark Brown wrote:

> In my mind, a scenario that
> violates the GUL would be where person X contributes (checks into source
> control), and a GUL licensee accepts the contribution, and that licensee
> functionally tests and approves the PAS Functions (thereby confirming that
> the contribution performs the PAS Functions described in the GUL), and then
> that licensee releases the PAS Functions as a stable / blessed build.  That
> seems to me to be a "three strikes and you're out" GUL violation.

At one point one should ask what is the invention at stake. How does the 
PAS functions relate to the claims in the patent application?

OK, the ietf does not make evaluation of IP claims *validity*, but the 
first question from a source code maintainer (your GUL licensee above) 
is are we infringing something? Thus, look at the claims. Indeed, it 
needs training to read issued patent and patent applications, but that's 
the name of the game.

I don't see a logical relation between PAS functions and the patent 
application claims (it doesn't mean there isn't one). The ietf IPR 
disclosure 833 seems to be trying to force contractual obligations 
(assisting the enforcement of protected PAS functions) based on an 
assumed infringement threat which would induce some real/moral person to 
become a party to the contract (GUL).

I'm always astonished to see ietf discussions about IPR so remote from 
simple IPR management basics.

I looked at the specifics of the patent application, and "specification 
as filed" in the provisional application. Assuming the 5 independent 
claims are valid, I expect the patentholder would have great difficulty 
in establishing infringement against a source code maintainer 
organization for software maintenance and distribution activities.

The fact that a source code maintainer organization wishes to protect 
its user base from IPR uncertainties is perhaps not event a sufficient 
motivation for agreeing to the GUL contract.

For the record, I was involved in an IPR discussion in an ietf wg about 
a draft (now expired), in the position of the inventor/entrepreneur/ietf 
contributor. From the wg feedback, I heard three messages:
1) we need interoperability,
2) don't monetize the DNS (the draft was in the DNS area),
3) an ideologic position against patents.

In this process, I refined my opinion about ietf wg procedures, but 
that's a different issue.

Also, the dynamics of a wg being based on voluntary participation, 
little seems possible to overcome a wg reluctance to follow the 
provisions of section 8 in RFC3979. The IPR disclosure 833 gets broader 
attention because it is handled as an ietf-wide issue.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]