DCT

2:25-cv-00164

Headwater Research LLC v. T-Mobile USA Inc

Key Events

Complaint

I. Executive Summary and Procedural Information

Parties & Counsel:
- Plaintiff: Headwater Research LLC (Texas)
- Defendant: T-Mobile USA, Inc. and Sprint LLC (Delaware)
- Plaintiff’s Counsel: Russ August & Kabat
Case Identification: 2:25-cv-00164, E.D. Tex., 02/10/2025
Venue Allegations: Plaintiff alleges venue is proper in the Eastern District of Texas because Defendant T-Mobile conducts substantial business in the district, maintains a regular and established place of business, advertises and provides wireless network coverage, operates cellular base stations, and sells the accused mobile devices within the district.
Core Dispute: Plaintiff alleges that Defendant’s cellular networks, servers, eSIM provisioning systems, and eSIM-enabled devices infringe five U.S. patents related to automated device provisioning, adaptive network policy control, and security for device-assisted services.
Technical Context: The technology at issue relates to managing, securing, and billing for mobile device services in an environment of rapidly increasing demand for mobile data.
Key Procedural History: The complaint alleges a prior business relationship, beginning in 2010, between Plaintiff’s predecessor-in-interest, ItsOn Inc., and Defendant Sprint (now part of T-Mobile). During this relationship, which was governed by a non-disclosure agreement, ItsOn allegedly disclosed its patented and patent-pending technologies to Sprint for the purpose of implementation on Sprint's network. The complaint alleges that Sprint subsequently implemented these technologies, providing a basis for Plaintiff's allegations of pre-suit knowledge and willful infringement.

Case Timeline

Date	Event
2009-01-28	Earliest Priority Date for all Asserted Patents
2010-04-01	ItsOn and Sprint enter into an NDA
2013-01-01	ItsOn and Sprint allegedly begin implementing Headwater's technologies
2014-01-28	U.S. Patent No. 8,639,935 Issues
2014-09-09	U.S. Patent No. 8,832,777 Issues
2015-10-09	Samsung USA allegedly announces Samsung Korea would take over negotiations with ItsOn
2015-10-27	Sprint purports to terminate the Sprint/ItsOn MSA
2018-05-15	U.S. Patent No. 9,973,930 Issues
2020-04-01	T-Mobile and Sprint complete their merger
2024-04-23	U.S. Patent No. 11,966,464 Issues
2024-05-14	U.S. Patent No. 11,985,155 Issues
2025-02-10	Complaint Filing Date

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 8,639,935 - Automated device provisioning and activation

(Issued January 28, 2014; Compl. ¶46)

The Invention Explained

Problem Addressed: The patent's background describes the need for a more flexible communication and management system to move beyond rigid, "one size fits all" mobile service plans. The problem is the lack of an efficient, automated system to provision and activate devices with varied and dynamic service policies tailored to user needs and device capabilities (’935 Patent, col. 5:48-6:11). The complaint highlights the explosive growth in mobile data traffic as the underlying market driver for such solutions, including a chart from Ericsson illustrating this trend (Compl. p. 6).
The Patented Solution: The invention is a system for automating the provisioning and activation of a device on a wireless network. It employs a "service processor" on the device that communicates with a "service controller" on the network via a secure "service control link." The system sends a server message containing a "message payload" (e.g., a service plan or configuration profile) and a specific "identifier" to a "particular device agent" on the device, enabling secure and targeted activation of services (’935 Patent, Abstract; col. 27:3-23). FIG. 1 of the patent illustrates the overall architecture, with a mobile station (100) containing a service processor (115) connecting to a central provider core network (110) that includes the service controller (122).
Technical Importance: This technology enables carriers to offer more granular, flexible, and on-demand services, facilitating new business models beyond traditional, long-term contracts (’935 Patent, col. 6:12-25).

Key Claims at a Glance

The complaint asserts independent claim 1 (Compl. ¶51).
The essential elements of independent claim 1, a method claim directed to a non-transitory machine-readable storage medium, include:
- Storing program code for causing a processor to establish links to communications services.
- A particular link supporting communications for a particular device over a wireless network.
- Receiving a server message from a particular server.
- The server message comprising a message payload and an identifier configured to assist in delivering the payload to a particular device agent.
- The identifier distinguishing the particular device agent from all other device agents.
- Sending an encrypted message to the end-user device over a service control link.

U.S. Patent No. 8,832,777 - Adapting network policies based on device service processor configuration

(Issued September 9, 2014; Compl. ¶58)

The Invention Explained

Problem Addressed: The patent addresses the need for secure and adaptable policy control for devices that utilize "device assisted services." The core problem is ensuring that the network can trust the software on a device (the "service processor") before applying specific service policies, such as those for a premium data plan or sponsored application usage (’777 Patent, col. 2:24-40).
The Patented Solution: The invention is a network system that authenticates the service processor on an end-user device before applying network policies. The system receives a standard "device credential" (like a SIM identity), but also obtains separate "service processor authentication information." It then uses this specific information to "facilitate execution of an end-user device service processor authentication procedure," thereby verifying the integrity and configuration of the device-side software before enforcing the corresponding service policy (’777 Patent, Abstract). The system architecture is depicted in figures such as FIG. 9, showing the interaction between the device's service processor and network elements.
Technical Importance: This method provides a security framework that allows carriers to confidently offer differentiated services, knowing that the device-side component responsible for policy enforcement is present and has not been compromised (’777 Patent, col. 2:32-40).

Key Claims at a Glance

The complaint asserts independent claim 1 (Compl. ¶63).
The essential elements of independent claim 1, a network system claim, include:
- A communication interface for communicating with an end-user device.
- One or more network elements configured to:
  - receive a device credential from the device;
  - obtain a service policy based on the credential;
  - obtain service processor authentication information associated with a service processor on the device; and
  - use the service processor authentication information to facilitate execution of an authentication procedure for the service processor.

U.S. Patent No. 9,973,930 - End user device that secures an association of application to service policy with an application certificate check

(Issued May 15, 2018; Compl. ¶70)

Technology Synopsis: The patent describes a method for securely linking a specific software application on a device to a corresponding network service policy. It addresses the problem of ensuring that only authorized applications receive the benefits of special policies (e.g., sponsored data) by having the device perform a certificate check on the application and securely associating that application's credential information with the enforcement of the service policy (’930 Patent, Abstract).
Asserted Claims: Independent claim 1 is asserted (Compl. ¶¶75, 78).
Accused Features: T-Mobile's systems are accused of infringement for providing application-specific service policies where the device allegedly performs a check to securely associate the application with the designated policy (Compl. ¶¶1, 75).

U.S. Patent No. 11,966,464 - Security techniques for device assisted services

(Issued April 23, 2024; Compl. ¶83)

Technology Synopsis: This patent discloses security techniques for device-assisted services that leverage a "secure execution environment" or "partition" on a device's processor. The invention involves implementing and executing a service profile within this secure partition to control and monitor the device's use of a network service, thereby protecting the service policy settings and usage measurement functions from tampering by other software on the device (’464 Patent, Abstract).
Asserted Claims: Independent claim 11 is asserted (Compl. ¶¶88, 91).
Accused Features: T-Mobile's eSIM-enabled devices are accused of infringing by allegedly using secure hardware partitions to manage and enforce network service policies associated with eSIM profiles and other services (Compl. ¶¶1, 88).

U.S. Patent No. 11,985,155 - Communications device with secure data path processing agents

(Issued May 14, 2024; Compl. ¶96)

Technology Synopsis: The patent describes a system for creating secure, tamper-evident logs of device data usage called "device data records" (DDRs). A processor operating in a "secure execution environment" monitors service usage and generates these records, each marked with a unique sequence identifier. This process creates a verifiable chain of usage data that can be securely reported to the network, addressing the problem of fraudulent or inaccurate usage reporting from a potentially compromised device (’155 Patent, Abstract).
Asserted Claims: Independent claim 1 is asserted (Compl. ¶¶101, 104).
Accused Features: T-Mobile's eSIM-enabled devices and associated network systems are accused of infringing by generating, processing, and using secure usage records to manage and bill for services provided via eSIMs and other cellular technologies (Compl. ¶¶1, 101).

III. The Accused Instrumentality

Product Identification

The Accused Instrumentalities are T-Mobile's cellular networks, servers, services, and eSIM-enabled devices (Compl. ¶1). This includes specific backend systems for eSIM provisioning and management (e.g., SM-DP+, SM-DP, RSP, SM-SR) and policy control (e.g., HLR/HSS, PCRF/PCF), as well as the end-user devices that operate on the network (Compl. ¶1).

Functionality and Market Context

The complaint alleges that these components operate as a system to provision, activate, manage, and secure services for mobile devices. The eSIM provisioning systems are responsible for creating, downloading, and activating eSIM profiles on devices, which enables them to connect to T-Mobile's network and use its services (Compl. ¶1). The complaint asserts the commercial significance of this system by citing T-Mobile's approximately 110 million subscribers and its extensive 5G network, illustrated with a coverage map showing service availability in Marshall, Texas (Compl. ¶¶41, 42; p. 13). Plaintiff also points to T-Mobile's physical retail presence in the district as further evidence of its business operations related to the accused instrumentalities (Compl. ¶44; p. 14). The map on page 13 of the complaint shows T-Mobile's advertised 5G and 4G LTE coverage in the area surrounding Marshall, Texas, supporting venue allegations (Compl. ¶41; p. 13).

IV. Analysis of Infringement Allegations

The complaint references claim chart exhibits for each asserted patent (Exhibits 6-10), but these exhibits were not filed with the complaint. As such, the infringement allegations are summarized below in prose based on the complaint’s narrative.

’935 Patent Infringement Allegations

Narrative Theory: The complaint alleges that T-Mobile's system for provisioning and activating eSIMs on devices infringes claim 1 of the ’935 Patent (Compl. ¶51). The theory posits that T-Mobile's servers send messages containing eSIM profiles (the "message payload") to specific devices. These messages are alleged to contain an "identifier" that directs the profile to a particular software "agent" on the device for activation over a secure "service control link" (Compl. ¶¶1, 51).
Identified Points of Contention:
- Scope Question: A potential issue is whether the term "device agent," as used in the patent, can be construed to read on the software components within a mobile operating system that manage eSIM profiles. The dispute may turn on whether the accused software constitutes multiple distinct "agents" as required by the claim's language "distinguishing the particular device agent from all other device agents."
- Technical Question: A key factual question will be what specific data element in T-Mobile's eSIM provisioning process constitutes the claimed "identifier." Evidence will be required to show that such an element exists and performs the specific function of routing the payload to a particular agent among a plurality of agents on the device.

’777 Patent Infringement Allegations

Narrative Theory: The complaint alleges that T-Mobile's network infringes claim 1 of the ’777 Patent by performing a "service processor authentication procedure" (Compl. ¶63). The narrative suggests that when a device connects, the network receives a "device credential" (e.g., an eSIM identifier) and also obtains separate "service processor authentication information" to verify the integrity of the device's software before applying the user's service plan (Compl. ¶¶1, 63).
Identified Points of Contention:
- Technical Question: A central point of contention will likely be whether T-Mobile's network performs a distinct authentication of a "service processor" software module, separate from the standard authentication of the device or SIM credential. The complaint does not specify what technical process constitutes this procedure.
- Scope Question: The dispute may focus on the definition of "service processor authentication information." The claim requires this to be distinct from the "device credential." The litigation will likely explore whether any information exchanged during T-Mobile's standard network attachment process can be fairly characterized as meeting this limitation.

V. Key Claim Terms for Construction

The Term: "service processor" (’777 Patent, claim 1)

Context and Importance: This term is foundational to the asserted patents, which describe "device-assisted services" managed by this component. Its construction is critical because if it is defined narrowly as a specific, add-on software module for managing carrier policies, Defendant may argue its standard device operating systems lack such a component. A broader definition covering OS-level network management functions may support Plaintiff's infringement theory.
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The specification of the related ’935 Patent states the service processor can be implemented in various locations, including within non-volatile memory, a main processor, or a modem, suggesting functional breadth rather than a specific form (’935 Patent, col. 27:61-28:9).
- Evidence for a Narrower Interpretation: The ’935 Patent’s detailed diagrams consistently depict the "Service Processor" (115) as a distinct entity comprised of multiple specific "agents" (e.g., Policy Control, Service Monitor, Billing) separate from general applications, suggesting it is a dedicated, specialized software suite (’935 Patent, FIG. 16).

The Term: "secure execution environment" (’464 Patent, claim 11)

Context and Importance: This term, central to the ’464 Patent, relates to the security of the on-device processes. Practitioners may focus on this term because its definition will determine whether standard hardware security features in modern CPUs (which are common in accused devices) meet the claim limitation, or if a more specialized, carrier-controlled secure partition is required.
Intrinsic Evidence for Interpretation:
- Evidence for a Broader Interpretation: The specification describes the environment as a "protected execution partition on the main device that is supported by certain configurations in the host," which could plausibly describe hardware-level security features provided by the CPU manufacturer (’464 Patent, col. 6:11-15).
- Evidence for a Narrower Interpretation: The specification describes the protected partition as being used for "device assisted service agents" and to "strengthen the service control integrity for the system," with an operating system that "also performs a role in establishing the protected execution partition for secure operation." (’464 Patent, col. 6:15-23). This may suggest a software and hardware environment specifically configured and controlled for the patented service, narrower than a general-purpose trusted execution zone.

VI. Other Allegations

Indirect Infringement

The complaint alleges inducement to infringe for all five patents. The basis for this allegation is that T-Mobile provides the accused devices and network services to its customers along with instructions, education, and encouragement to use them in their normal, infringing manner (e.g., Compl. ¶¶55, 67, 80, 93, 106).

Willful Infringement

The complaint alleges willful infringement based on pre-suit knowledge of the patents. This knowledge is alleged to stem from a prior business and technical relationship between Plaintiff's predecessor, ItsOn, and Defendant Sprint, beginning in 2010. During this period, Plaintiff alleges that its patented technologies were disclosed to Sprint in meetings and that ItsOn software, which included a patent marking notice listing the asserted patents or their family members, was installed on millions of Sprint devices (e.g., Compl. ¶¶52, 64, 76, 89, 102; Notice of the Asserted Patents Section, p. 7-9).

VII. Analyst’s Conclusion: Key Questions for the Case

A core issue will be one of technical mapping: do the industry-standard protocols and hardware security features used in T-Mobile's modern eSIM-enabled devices and networks perform the specific functions of the claimed "service processor," "device agents," and "secure execution environments," or are the patented inventions architecturally distinct systems requiring dedicated software and control channels not present in the accused instrumentalities?
A central evidentiary question will be one of historical knowledge and intent: what specific technical disclosures and patent notices were provided by ItsOn to Sprint prior to 2016, and does that evidence establish that T-Mobile not only knew of the patents but also proceeded to build its eSIM infrastructure with objective recklessness as to whether it would infringe the specific claims now being asserted?