SRP Intellectual Property Slides

[Black_David@emc.com]

As promised, here is the complete text from the slides
on SRP Intellectual Property Rights that I used in the
meeting yesterday morning.  The information on Stanford,
Lucent, and the possibly applicable 2001 patent is towards
the end.  Please read all the way to the end (last slide
is titled "Next Steps") before responding to this message.

Thanks,
--David

SRP Intellectual Property Rights
David Black, IP Storage WG co-chair
December 2001
Salt Lake City, UT

Note Well

All statements related to the activities of the IETF
and addressed to the IETF are subject to all provisions
of Section 10 of RFC 2026, which grants to the IETF and
its participants certain licenses and rights in such statements.

Such statements include verbal statements in IETF meetings,
as well as written and electronic communications made at
any time or place, which are addressed to:
	- the IETF plenary session.
	- any IETF working group or portion thereof,
	- the IESG, or any member thereof on behalf of the IESG,
	- the IAB, or any member thereof on behalf of the IAB,
	- any IETF mailing list, including the IETF list itself,
		any working group or design team list, or any other
		list functioning under IETF auspices,
	- the RFC Editor or the Internet-Drafts function.

Statements made outside of an IETF meeting, mailing list or other
function, that are clearly not intended to be input to an IETF
activity, group, or function are not subject to these provisions.

Disclaimer

I am NOT a lawyer
This is NOT legal advice
If you need legal advice ...
	- You need to talk to a lawyer
If actions or decisions based on information in this
	presentation have legal consequences
	- Those consequences are YOUR responsibility
	- The IETF and yours truly disclaim all responsibility

IETF Policy: Intellectual Property and Contributions

RFC 2026, Section 10.3.1, Clause 6:
	6. The contributor represents that he has disclosed the
	existence of any proprietary or intellectual property rights
	in the contribution that are reasonably and personally known
	to the contributor.  The contributor does not represent that
	he personally knows of all potentially pertinent proprietary
	and intellectual property rights owned or claimed by the
	organization he represents (if any) or third parties.

This is an obligation to disclose.
How to disclose: www.ietf.org/ipr.html

IETF Policy: Intellectual Property Rights Claims (I)

RFC 2026, Section 10.3.2, Clause (A):
	(A)  Where any patents, patent applications, or other
	proprietary rights are known, or claimed, with respect to
	any specification on the standards track, and brought to the
	attention of the IESG, the IESG shall not advance the
	specification without including in the document a note
	indicating the existence of such rights, or claimed rights.
If rights are known or claimed, RFC will say that the IETF has
	been notified.
	- As of the date the RFC is published
	- Nothing specific about the claim(s)

IETF Policy: Intellectual Property Rights Claims (II)

RFC 2026, Section 10.3.2, Clause (B):
	(B)  The IESG disclaims any responsibility for identifying
	the existence of or for evaluating the applicability of any
	claimed copyrights, patents, patent applications, or other
	rights in the fulfilling of the its obligations under (A),
	and will take no position on the validity or scope of any
	such rights.
No IETF obligation to identify claims.
The IETF takes no positions on validity or scope.

IETF Policy: Intellectual Property Rights Claims (III)

RFC 2026, Section 10.3.2, Clause (C):
	(C)  Where the IESG knows of rights, or claimed rights
	under (A), the IETF Executive Director shall attempt to obtain
	from the claimant of such rights, a written assurance that
	upon approval by the IESG of the relevant Internet standards
	track specification(s), any party will be able to obtain the
	right to implement, use and distribute the technology or
	works when implementing, using or distributing technology
	based upon the specific specification(s) under openly specified,
	reasonable, non-discriminatory terms.
Attempt to obtain promise, response not required.
	- Promises are recorded at: www.ietf.org/ipr.html .

SRP and iSCSI Context

iSCSI currently REQUIRES SRP
	- SRP = Secure Remote Password, RFC 2945
	- Rumors of patent claims covering SRP
Goal: Avoid basing decisions on rumors
	- Make information available to reduce uncertainty
Non-goal: Determine SRP requirement now
	- Insufficient time for technical/legal analysis
		of new information by WG members

Stanford

Has filed for a patent on SRP
No cost licenses are available
	- http://otl.stanford.edu/pdf/97006.pdf
	- Explicitly references RFC 2945
	- Unidirectional license, not reciprocal

Lucent

Elizabeth Rodriguez, speaking as a Lucent employee:
	- Lucent is researching whether the EKE patents (US 5,241,599
		and US 5,440,635) or any other Lucent patents are
		essential to SRP implementation.  
	- If patent(s) is/are found that is/are determined to be
		necessary to SRP implementation, Lucent will license
		the Intellectual Property under normal Lucent licensing
		practices.
Intellectual Property Rights notice is expected to be sent to the
	IETF in the near future.

One More

A patent that may be relevant
	- US 6,226,383 (2001): Cryptographic methods for remote
		authentication
WG chairs take no position on relevance
	- The patent might be relevant, or it might not
If more information becomes available, it will be posted to
	the IPS list

Next Steps

Clarification questions: Ok to ask here
Technical questions/discussion: IPS mailing list
NOTE: cryptographic and legal expertise are needed to understand
	these patents
	- Request (1): Please obtain expertise before posting
	- Request (2): Please wait for summary of this talk to be
		posted to list (will happen in next day or so)
SRP requirements level: Feb. interim meeting