DCT

2:25-cv-00156

Headwater Research LLC v. Cellco Partnership

Log In
Key Events
Complaint

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 2:25-cv-00156, E.D. Tex., 02/06/2025
  • Venue Allegations: Plaintiff alleges venue is proper in the Eastern District of Texas because Verizon conducts extensive business in the district, has a regular and established place of business, and commits acts of infringement there. The complaint includes a screenshot of Verizon’s coverage map showing service availability in Marshall, Texas, to support this allegation.
  • Core Dispute: Plaintiff alleges that Defendant’s cellular networks, servers, services, and associated eSIM-enabled devices infringe five U.S. patents related to automated device provisioning, service policy adaptation, and security for device-assisted services.
  • Technical Context: The technology concerns on-device and network-based systems for managing mobile device access to cellular services, a field of increasing importance with the proliferation of complex data plans and embedded SIM (eSIM) technology.
  • Key Procedural History: The complaint details a significant pre-suit history between the parties, beginning in 2009. This history includes a non-disclosure agreement (NDA), technical presentations from Headwater to Verizon, a 2010 software license and evaluation agreement for which Verizon allegedly paid over $4 million, and multiple "Detailed Patent Briefs" disclosing the technology of the then-pending patents. The complaint also references a 2013 whistleblower lawsuit filed by a former Verizon employee which allegedly detailed Verizon's "misappropriation of intellectual property" from Headwater's predecessor and licensee, ItsOn, and alleged that Verizon's teams had "reverse-engineered the functionality shown by ItsOn."

Case Timeline

Date Event
2009-01-28 Earliest Priority Date for ’464 and ’155 Patents
2009-03-02 Earliest Priority Date for ’935, ’777, and ’930 Patents
2009-06-30 Headwater and Verizon enter into an NDA
2009-07-01 Headwater provides detailed presentations to Verizon
2009-08-31 Headwater presents a trial plan to Verizon executives
2010-01-01 Verizon and ItsOn enter into a Software License and Evaluation Agreement (approximate date)
2011-05-01 Headwater and ItsOn develop Verizon-specific prototype platform and hold field trials (approximate date)
2011-06-01 Headwater provides an Updated Detailed Patent Brief to Verizon personnel (approximate date)
2013-09-30 Whistleblower complaint filed against Verizon alleging misappropriation of ItsOn's IP
2014-01-28 ’935 Patent Issued
2014-09-09 ’777 Patent Issued
2018-05-15 ’930 Patent Issued
2024-04-23 ’464 Patent Issued
2024-05-14 ’155 Patent Issued
2025-02-06 Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 8,639,935 - "Automated device provisioning and activation"

  • Patent Identification: U.S. Patent No. 8,639,935, "Automated device provisioning and activation," issued January 28, 2014. (Compl. ¶37).

The Invention Explained

  • Problem Addressed: The patent's background describes increasingly complex network architectures, including those involving Mobile Virtual Network Operators (MVNOs), which create challenges for seamlessly provisioning and activating mobile device services. (Compl. ¶¶9-11; ’935 Patent, col. 1:15-22, Figs. 1-8).
  • The Patented Solution: The invention describes a system where a "service processor" agent on an end-user device establishes a secure control link with a "service controller" in the network. The network server sends an encrypted message containing a "message payload" (e.g., service policies or software) and an identifier to a "particular device agent" on the device, thereby automating the provisioning and activation process in a secure manner. (’935 Patent, Abstract; Fig. 16). This architecture separates the service control plane from the service traffic plane to manage the device. (’935 Patent, col. 37:11-20).
  • Technical Importance: This approach provided a method for carriers to offer and manage more flexible and dynamic service plans directly on devices, moving beyond the rigid, network-centric provisioning models of the past. (Compl. ¶¶14, 17).

Key Claims at a Glance

  • The complaint asserts infringement of at least independent claim 1. (Compl. ¶60).
  • The essential elements of independent claim 1, a method claim directed to a network system, include:
    • for causing one or more processors to establish a plurality of links to a plurality of communications networks... wherein at least a portion of the plurality of links comprises a particular link of the plurality of links that is distinct from a service control link
    • wherein establishing the service control link between the network system and the end-user device is initiated by the one or more processors executing a link initialization sequence
    • receive a server message from a particular server of a plurality of servers communicatively coupled to the network system
    • the server message comprising a message payload for delivery to a particular device agent of one or more device agents on the end-user device
    • generate an encrypted message comprising the at least a portion of the message payload and an identifier configured to assist in delivering the at least a portion of the message payload to the particular device agent
    • send the encrypted message to the end-user device over the service control link
  • The complaint does not explicitly reserve the right to assert dependent claims for the ’935 Patent.

U.S. Patent No. 8,832,777 - "Adapting network policies based on device service processor configuration"

  • Patent Identification: U.S. Patent No. 8,832,777, "Adapting network policies based on device service processor configuration," issued September 9, 2014. (Compl. ¶38).

The Invention Explained

  • Problem Addressed: As network operators rely more on on-device software (a "service processor") to manage policies, a technical problem arises: the network needs a reliable way to verify that this on-device software is present, authentic, and properly configured before entrusting it with policy enforcement. (’777 Patent, col. 1:49-67).
  • The Patented Solution: The invention discloses a network system that, after receiving a device's credential, also obtains "service processor authentication information." It then uses this information to "facilitate execution of an end-user device service processor authentication procedure." Only after this specific authentication of the on-device software agent is complete are the network policies adapted, ensuring the on-device agent is trusted by the network. (’777 Patent, Abstract; col. 2:5-13).
  • Technical Importance: This technology allows a network to securely leverage the capabilities of on-device software for sophisticated service management, creating a trusted link between the carrier's policies and the software enforcing them on the device. (Compl. ¶14).

Key Claims at a Glance

  • The complaint asserts infringement of at least independent claim 1. (Compl. ¶72).
  • The essential elements of independent claim 1, a system claim, include:
    • A network system, comprising: a communication interface...
    • one or more network elements configured to:
    • receive a device credential from the end-user device;
    • obtain a service policy based at least in part on the device credential...;
    • obtain service processor authentication information associated with a service processor on the end-user device; and
    • using the service processor authentication information, facilitate execution of an end-user device service processor authentication procedure.
  • The complaint does not explicitly reserve the right to assert dependent claims for the ’777 Patent.

U.S. Patent No. 9,973,930 - "End user device that secures an association of application to service policy with an application certificate check"

  • Patent Identification: U.S. Patent No. 9,973,930, "End user device that secures an association of application to service policy with an application certificate check," issued May 15, 2018. (Compl. ¶39).
  • Technology Synopsis: The patent describes a method for an end-user device to securely link specific software applications to network service policies. The invention addresses the problem of ensuring that a particular service plan (e.g., a sponsored data plan for a specific app) is correctly and securely applied to the intended application by performing an "application credential check" on the device to verify the application's authenticity before enforcing the associated policy. (’930 Patent, Abstract).
  • Asserted Claims: Independent claim 1. (Compl. ¶87).
  • Accused Features: The complaint accuses Verizon's systems of infringement, which allegedly includes mobile devices and network servers that associate service policies with specific applications running on the devices. (Compl. ¶¶1, 84, 87).

U.S. Patent No. 11,966,464 - "Security techniques for device assisted services"

  • Patent Identification: U.S. Patent No. 11,966,464, "Security techniques for device assisted services," issued April 23, 2024. (Compl. ¶40).
  • Technology Synopsis: This invention addresses security for device-assisted services by creating a "secure execution environment" or a protected partition on a device's processor. This secure partition is designed to execute service management agents that monitor and control the device's use of a network service. By isolating these agents from the main application environment, the technology aims to protect the integrity of service measurement and policy enforcement from malware or tampering. (’464 Patent, Abstract; col. 2:41-44).
  • Asserted Claims: Independent claim 11. (Compl. ¶100).
  • Accused Features: The infringement allegations target Verizon's cellular networks, servers, and particularly its eSIM-enabled devices, which allegedly use secure hardware and software environments to provision, manage, and enforce service policies. (Compl. ¶¶1, 97, 100).

U.S. Patent No. 11,985,155 - "Communications device with secure data path processing agents"

  • Patent Identification: U.S. Patent No. 11,985,155, "Communications device with secure data path processing agents," issued May 14, 2024. (Compl. ¶41).
  • Technology Synopsis: This patent describes a system for creating secure, verifiable records of data usage on a device. The invention uses a "secure execution environment" on a processor to monitor service usage and generate a plurality of "device data records" (DDRs). Each record is associated with a unique sequence order identifier, creating a contiguous and tamper-evident log of consumption that can be securely reported to the network for billing and verification. (’155 Patent, Abstract).
  • Asserted Claims: Independent claim 1. (Compl. ¶113).
  • Accused Features: The complaint targets Verizon's networks, servers, and eSIM-enabled devices, which are alleged to monitor and report data usage through a system of secure records. (Compl. ¶¶1, 110, 113).

III. The Accused Instrumentality

Product Identification

  • The accused instrumentalities are Verizon's cellular networks, servers, and services, including systems and components for eSIM provisioning and management (such as SM-DP+, SM-DP, RSP, SM-SR), as well as the eSIM-enabled devices (phones, tablets, wearables, etc.) that operate on the network. (Compl. ¶1).

Functionality and Market Context

  • The complaint alleges these instrumentalities form an ecosystem for activating and managing cellular service on modern devices. The eSIM provisioning systems allegedly enable the remote download and installation of subscriber profiles, which contain the service policies that govern device behavior. The networks and servers then interact with these on-device components to enforce policies and account for data usage. (Compl. ¶1). A screenshot in the complaint shows Verizon's advertising of its 4G LTE and 5G network coverage in Marshall, Texas, illustrating the geographic scope of the accused services. (Compl. p. 14). Verizon is a leading U.S. wireless carrier with approximately 115 million retail connections as of June 2022, indicating the large commercial scale of the accused services. (Compl. ¶52).

IV. Analysis of Infringement Allegations

The complaint references but does not attach exhibits containing claim charts for the asserted patents (Compl. ¶¶60, 72, 84, 97, 110). The infringement theory is summarized below in prose.

’935 Patent Infringement Allegations

  • The complaint alleges that Verizon's systems for provisioning eSIMs infringe at least claim 1 of the ’935 Patent. (Compl. ¶60). The narrative suggests that when a user activates an eSIM-enabled device, Verizon's network systems (the "network system" performing the method) establish a service control link to the device. A Verizon server (the "particular server," e.g., an SM-DP+ server) sends a "server message" containing an encrypted "message payload" (the eSIM profile with service policies) to a "particular device agent" (the secure element or operating system on the device responsible for managing the eSIM) to provision and activate the service. (Compl. ¶¶1, 60).

’777 Patent Infringement Allegations

  • The complaint alleges that Verizon's network systems infringe at least claim 1 of the ’777 Patent. (Compl. ¶72). The theory appears to be that Verizon's network (the "network system") receives a credential from a user's device (e.g., an IMSI from an eSIM profile). Based on this credential, the network obtains a service policy and also obtains "service processor authentication information" related to the on-device agent (e.g., the eSIM's capabilities). The network then allegedly facilitates an "authentication procedure" with this on-device agent to verify its configuration before fully adapting network policies for the device. (Compl. ¶¶1, 72).

Identified Points of Contention

  • Scope Questions: For the ’935 Patent, a central question may be whether a standard, encrypted eSIM profile download constitutes the claimed method of generating an encrypted message with a specific "identifier" for a "particular device agent," or if the claim requires a more specialized messaging and agent architecture. For the ’777 Patent, a key question is whether standard network attachment and authentication procedures implicitly perform the claimed "service processor authentication procedure," or if the claim requires a distinct, additional step of authenticating the on-device software itself, separate from authenticating the subscriber.
  • Technical Questions: The infringement analysis for the ’777 Patent may turn on the factual evidence presented for the "service processor authentication procedure." What specific technical steps in Verizon's system constitute authenticating the on-device agent itself, as opposed to merely authenticating the device's or subscriber's credentials for network access? The complaint's allegations suggest a deep technical history that may provide evidence on this point.

V. Key Claim Terms for Construction

  • The Term: "service processor authentication procedure" (’777 Patent, Claim 1)

  • Context and Importance: This term is the central novel element of claim 1 of the ’777 Patent. The infringement case for this patent will likely depend on whether Verizon's accused systems perform a procedure that meets this definition. Practitioners may focus on this term because the claim structure separates it from the step of simply "receiv[ing] a device credential," suggesting it is a distinct and additional action.

  • Intrinsic Evidence for Interpretation:

    • Evidence for a Broader Interpretation: The specification describes the need to "verify that the device assisted service agents have not been compromised." (’777 Patent, col. 8:41-45). This might support a construction where any security check that validates the integrity of the on-device software environment, even if part of a standard network handshake, could meet the definition.
    • Evidence for a Narrower Interpretation: The abstract states the system "obtain[s] service processor authentication information" and then, "using the service processor authentication information, facilitate[s] execution of an...authentication procedure." This language suggests a specific, two-part process where information about the agent is first obtained and then used in a subsequent procedure, potentially supporting a narrower construction that requires more than a standard network authentication check.

  • The Term: "particular device agent" (’935 Patent, Claim 1)

  • Context and Importance: The claim requires that an encrypted message payload be delivered to this "particular device agent." The definition will determine what kind of on-device component qualifies, which is critical for mapping the claim to the accused eSIM architecture.

  • Intrinsic Evidence for Interpretation:

    • Evidence for a Broader Interpretation: The specification describes the "service processor" (agent) in broad functional terms and indicates it can be implemented in various locations, including a device's main processor, non-volatile memory, or within a modem. (’935 Patent, col. 27:3-29; Fig. 9). This could support a broad definition covering various types of firmware or software, including the software managing an eSIM.
    • Evidence for a Narrower Interpretation: Many figures in the patent depict the "Service Processor 115" as a distinct logical block separate from other device components like the main processor or modem hardware. (’935 Patent, Fig. 16). This could support an argument that the "agent" must be a discrete, identifiable software component as depicted, not just any firmware that receives network data.

VI. Other Allegations

  • Indirect Infringement: The complaint alleges that by selling eSIM-enabled devices and providing instructions and services for their activation and use, Verizon knowingly encourages and instructs its customers to perform acts that directly infringe the asserted patents. (Compl. ¶¶62, 64, 74, 76, 89, 102, 115).
  • Willful Infringement: Willfulness is a central theme of the complaint. The allegations are based on extensive alleged pre-suit knowledge of the patents and the underlying technology dating back to 2009. The complaint cites an NDA, technical meetings, a multi-million dollar license and evaluation agreement, virtual patent marking notices on software provided to Verizon, and a whistleblower complaint alleging that Verizon "reverse-engineered" the technology after these interactions. (Compl. ¶¶16-35, 61, 73, 85, 98, 111).

VII. Analyst’s Conclusion: Key Questions for the Case

  • A core issue will be one of technical operation and proof: Can Headwater demonstrate that Verizon's network performs the specific "service processor authentication procedure" recited in the ’777 patent? This will likely require evidence distinguishing Verizon's actions from standard device and subscriber authentication protocols common in cellular networks.
  • A second central issue will be one of claim scope: Can the claim terms from the ’935 patent, such as "particular device agent" and the specific steps of "generating" and "sending" an encrypted message, be construed to read on the standardized, protocol-driven process of provisioning an eSIM profile, or do the claims require a proprietary, non-standard architecture?
  • A key question for damages will be intent and history: Do the extensive factual allegations regarding the business relationship, technology disclosures, licensing, and alleged reverse-engineering, if proven, establish that any infringement was willful, potentially exposing Verizon to enhanced damages?