US 12488090

I'll search for the specific patent number across patent and litigation sources.

Now let me look for the claims and any 2026 litigation/appeal activity.

Let me try to retrieve the granted claims and check whether this specific patent number appears in any litigation.

US 12,488,090 (US12488090B2) — "Security techniques for device assisted services"

Scope note on sourcing: I searched for the exact number only. The authoritative bibliographic data comes from the Google Patents record for US12488090B2 (supplied in the patent text and corroborated by search results). The granted claim set was not included in the material I could retrieve; the claim overview below is drawn from the published application (US 20240248981 A1) and closely-related family members, and is flagged as such. No search hit tied number 12,488,090 to any court docket.

Bibliographic data (as recorded)

Priority chain

This is a continuation in the long Headwater chain on the same specification: provisional 61/206,354 (Jan. 28, 2009) and siblings 61/206,944, 61/207,393, 61/207,739, 61/252,151 (Oct. 15, 2009); CIP of 12/380,780 (Mar. 2, 2009); 12/694,445 (Jan. 27, 2010) → US 8,391,834; 13/737,748 → US 9,198,042; 14/948,065 → US 10,028,144; 16/034,362 → US 10,694,385; 16/907,887 → US 11,405,429; and other continuations including US 11,966,464 and US 11,985,155. The 18/604,106 application also has a later-filed continuation (US 2025/0390570 A1, per the record's "priority to 19/305,071"). All members share one specification, so the disclosure (FIGS. 1–11) is the same secure-execution-partition disclosure.

Abstract (verbatim)

"Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service."

Overview of the independent claim(s)

Independent claim 1 as published in US 2024/0248981 A1 (the pre-grant publication of this application — the same text that appears as the abstract):

1. A system, comprising: a processor of a communications device configured to: implement a service profile executed at least in part in a secure execution environment for assisting control of the communications device use of a service on a wireless network, wherein the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitor use of the service based on the service profile; and verify the use of the service based on the monitored use of the service; a memory of the communications device coupled to the processor and configured to provide the processor with instructions.

Plain language: the independent claim covers a phone/router-like communications device whose processor runs a service-policy "profile" (the settings tied to a data plan) inside a secure execution environment, meters the device's actual service usage against that profile, and then verifies that usage (e.g., cross-checks the measurement, integrity-checks the agents, or validates against policy). The "secure execution environment" element is the inventive hook — it maps to the protected DAS partition, secure modem partition, secure memory, secure bus, and secure control-link embodiments described at length in the specification (FIGS. 1–11).

I did not verify whether granted claim 1 of the '090 patent has the identical wording. Caution is warranted: the two immediately preceding family members issued with 12 claims each (US 10,694,385 and US 11,405,429, "Security techniques for device assisted services"), and prosecution continuations in this family frequently amend claim scope (e.g., adding secure-modem-subsystem or "separately secure from" limitations, and terminal disclaimers are noted on the family). Treat the above as the published independent claim, not a confirmed transcription of the granted claim.

Litigation / CAFC check for 2026

• I found no 2026 Federal Circuit docket naming US 12,488,090 specifically. The Google Patents record flags the family as having litigation (Darts-IP family 42398802), which is consistent with broad Headwater assertion activity without establishing that this particular patent is asserted.
• Headwater's 2026 CAFC activity that surfaced involves other patents: Headwater Research LLC v. [Verizon Communications Inc.](/litigations/by-defendant/Verizon%20Communications%20Inc.), Nos. 2026-1884 and 2026-1906 (appeal and cross-appeal from E.D. Tex. 2:23-cv-00352; appeal deactivated pending Rule 50(b)/59(e) motions; Verizon obtained equitable relief — implied waiver — against enforcement). Asserted patents there were members such as 8,588,110, 9,179,359, 9,647,918, 8,666,364 — not 12,488,090.
• In re [[Amazon.com Services](/litigations/by-defendant/Amazon.com%20Services) LLC](/litigations/by-plaintiff/Amazon.com%20Services%20LLC), No. 26-146 (Fed. Cir.) is a mandamus petition relating to IPR2026-00088/00106 on US 9,615,192 and US 10,321,320; the petition was denied (order filed Aug. 3, 2026).
• 2026 PTAB activity against Headwater (Amazon, Samsung, Target, etc.) likewise involves other family members, not the '090 patent.

Explicit uncertainties

1. Granted claim set of US 12,488,090 is not confirmed. I could not retrieve the issued claims; only the published application claim 1. Do not treat the claim overview as the granted scope without checking the patent's claim sheet.
2. Claim count and dependency structure are unknown to me for this specific grant.
3. Date discrepancy: the prompt states a current date of April 26, 2026, while the system date is Sept. 29, 2026; several retrieved docket items are dated May–August 2026. I have reported them as found, per instruction to prefer search results.
4. No evidence found that 12,488,090 is asserted in any pending district court or CAFC case as of the retrieved records; absence of a hit is not proof that it is unasserted, since PACER/PTAB coverage in the results is incomplete.

I'll search for litigation involving US patent 12488090 across patent litigation sources.

Let me search more specifically for this patent and its assignee.

Let me search additional litigation-specific sources for this exact patent number.

Litigation Search: U.S. Patent No. 12,488,090

Bottom line

I could not identify any litigation in which U.S. Patent No. 12,488,090 ("Security techniques for device assisted services") is specifically named or asserted. Based on the searches I was able to run, there is no publicly reported case identifying this exact patent number as a patent-in-suit, and no declaratory-judgment action targeting it.

Because the tool limit was reached before I could complete a comprehensive sweep, treat this as a preliminary result, not a definitive "no litigation exists" finding (see caveats below).

What I verified about the patent itself

• Patent: US 12,488,090 B2 — "Security techniques for device assisted services"
• Inventor: Gregory G. Raleigh
• Current/Original Assignee: Headwater Research LLC
• Application: 18/604,106, filed 2024-03-13
• Granted: 2025-12-02
• Priority date: 2009-01-28 (claiming benefit of US 12/380,780)
• Other version: US 2024/0248981 A1
• Google Patents status note: the listed patent family (family ID 42398802) is flagged as "Family has litigation." This is a family-level flag only — it does not establish that this particular patent (12,488,090) has been asserted in any case.

Important distinction — do not conflate

• The Alpha Modus v. Wakefern case (2:24-cv-01056, E.D. Tex., filed Dec. 17, 2024) references a "'890 Patent," but this is a different patent owned by Alpha Modus Corp., not Headwater's 12,488,090. This is not a match for your query.
• The Google LLC v. Headwater Research LLC declaratory judgment action (N.D. Cal., 4:25-cv-09558, filed Nov. 5, 2025) targets U.S. Patent Nos. 8,589,541 and 9,215,613 — not 12,488,090.

Related Headwater Research litigation (context — NOT this patent)

The owner, Headwater Research LLC, is a very active litigant asserting a large patent portfolio (over 100 patents) against Apple, Amazon, Google, Samsung, AT&T, T-Mobile, Verizon, Comcast, Charter, DISH, EchoStar, and others. Patents actually identified as asserted in the materials I retrieved include, among others:

• 8,589,541 and 9,215,613 (Verizon jury verdict of $175M, July 23, 2025; E.D. Tex. 2:23-cv-00352-JRG-RSP; final judgment April 23, 2026; now on appeal, Fed. Cir. 26-1884)
• 10,064,055 and 8,667,571 (Apple, W.D. Tex. 7:25-cv-00318)
• 9,615,192 and 10,321,320 (Amazon W.D. Tex. 7:25-cv-00286; Apple W.D. Tex. 7:25-cv-00371)
• 8,631,102 / 8,799,451 / 8,023,425; 8,635,335 / 10,237,757 / 10,791,471; 9,232,403 / 9,491,564 / 8,639,935 (various W.D. Tex. filings; Apple N.D. Cal. 3:25-cv-07591)
• 8,924,543 (AT&T, T-Mobile, Verizon — E.D. Tex.; subject of IPRs)
• 11,966,464 — "Security techniques for device assisted services" (asserted in Headwater v. T-Mobile, E.D. Tex. 2:25-cv-00164, complaint filed 2025) — a related family member to 12,488,090, but a different patent number.
• 11,985,155 — "Communications device with secure data path processing agents" (also asserted in Headwater v. T-Mobile, E.D. Tex. 2:25-cv-00164).

No case details to report

Because no case asserting 12,488,090 was identified, I cannot provide plaintiff(s), defendant(s), jurisdiction, case number, filing date, or outcome/status for any such case. Per your instruction, I have not substituted results for similar numbers (e.g., the Alpha Modus '890 patent or other Headwater patents).

Caveats and recommended verification

1. Search limitations: I was unable to fully query the Unified Patents litigation portal, Darts-IP family litigation link (family 42398802), PACER, or CourtListener before hitting the tool limit. A negative result here is not conclusive.
2. Timing: 12,488,090 issued only on 2025-12-02. It is plausible it has not yet been asserted, or that any suit naming it has not surfaced in indexed sources.
3. Recommended primary checks:
   • PACER / CourtListener / Docket Alarm docket search for "12,488,090"
   • USPTO Patent Center "Litigation" and assignment records for 12,488,090
   • Darts-IP link listed on the Google Patents page (family 42398802)
   • Headwater's recent complaints (e.g., v. T-Mobile, AT&T, Google, Amazon, Apple) to confirm the exact "patents-in-suit" lists, since complaints are sometimes amended to add continuation patents like 12,488,090.

Conclusion: On the evidence available, no litigation specifically involving U.S. Patent No. 12,488,090 is known. It should be independently verified against PACER/Darts-IP before being treated as confirmed.

I'll start by searching for any PTAB activity on this patent and its family.

Let me check the parent patent in this family and any 2025-2026 filings.

Let me check IPRs against the immediate sibling patents in this same "Security techniques" family and any 2026 filing against the '090 patent itself.

Heads-up on the source data

The USPTO ODP structured block in the prompt is the canonical list, and it returns zero AIA trial proceedings for US 12,488,090. My web searches did not surface any IPR, PGR, or CBM naming the '090 patent either — but they did surface a dense, ongoing PTAB campaign against sibling patents in the same 2009 "device assisted services" family (Headwater Research). I've kept those strictly separate below, because none of them are proceedings on this patent.

One timing fact drives the whole analysis: US 12,488,090 issued 2025-12-02. Under 35 U.S.C. § 321(c) the PGR window closed nine months later (~2026-09-02), and under § 311(c) an IPR petition could not even be filed until that same date. As of 2026-09-29 the IPR window on this patent has been open for roughly four weeks. The absence of PTAB activity is therefore a clock artifact, not a signal of patent strength.

---

Proceedings overview

There are zero AIA trial proceedings on file for US 12,488,090: 0 active, 0 with claims invalidated, 0 with claims sustained, 0 settled, and 0 institution denials. No petitioner has obtained an FWD, an institution decision, or even a preliminary response against this patent, so the defensive posture is neither "hardened" nor "gutted" — it is untested and un-estopped. For a defendant, that cuts both ways: you get no free invalidity road map and no § 315(e) estoppel to inherit, but you also face claims that no panel has ever construed and no FWD has ever blessed. The offsetting favorable fact is the clock: the '090 patent claims priority from US 12/380,780 (filed 2009-03-02) and carries an anticipated expiration of 2029-03-02 — roughly 2.4 years of remaining term, which caps the damages tail on any new assertion.

---

Proceedings on US 12,488,090

None. There are no proceedings to enumerate. I will not invent proceeding numbers, and I have none to report. If Headwater's demand letter cites this patent, assume it is being asserted precisely because it is clean — a fresh continuation (filed 2024-03-13, granted 2025-12-02) whose claims have never been tested, while its older siblings are buried under IPR petitions.

---

Adjacent proceedings (different patents — not on the '090 patent)

These are relevant context only. Marked [confirmed] where a primary PTAB document appeared in my search results, [unconfirmed] where I only saw it referenced second-hand.

IPR2025-00482 — Samsung Electronics Co., Ltd. v. Headwater Research LLC (on US 11,405,429) [confirmed]

• Type: Inter Partes Review
• Patent: US 11,405,429 B2 — "Security techniques for device assisted services" — the direct sibling of the '090 patent, sharing the identical abstract and specification
• Filed: 2025 (petition served on or about 2025-02-13, based on the docket; exact filing date not confirmed in the sources I reviewed)
• Status: Institution denied under 35 U.S.C. § 314(a) (discretionary denial)
• Judge panel: Decision issued by Kalyan K. Deshpande, Acting Deputy Chief Administrative Patent Judge
• Petition grounds: § 103 obviousness over Schmidt (US 2009/0077643), De Beer (US 2005/0101323), Bittmann (US 2004/0148237), and Smith, Virtual Machines: Versatile Platforms for Systems and Processes (2005) — i.e., a virtualization/secure-partition art cluster attacking the same "secure execution environment / secure modem subsystem" subject matter that the '090 patent claims
• Institution decision: Denied. The panel reasoned that the projected FWD due date was 2026-07-29; the district court's trial was set for 2026-02-09 (statistics suggesting trial would begin January 2026); therefore "it is unlikely that a final written decision in this proceeding will issue before district court trial occurs." The panel also found "insufficient evidence that the district court is likely to stay its proceeding even if the Board were to institute trial." Discretion exercised "based on a holistic assessment."
• Final Written Decision: none — no trial was instituted
• Settlement / termination: n/a
• Appeal: none available; denial of institution is non-appealable
• Counsel: Petitioner — Fish & Richardson (W. Karl Renner, Jeremy Monaldo, Karan Jhurani). Patent Owner — Russ, August & Kabat (Reza Mirzaie, Dale Chang, Amy Hayden, James Milkey, Neil Rubin, Philip Wang)
• Defensive value: Highest-value single data point in this family. It tells you (a) Samsung's best virtualization-art attack on the "Security techniques for device assisted services" specification exists and is drafted, but (b) the Board will not institute on this patent family while an E.D. Tex. trial is imminent — Fintiv-style § 314(a) denial is live here post-Stewart. If you want an IPR on the '090 patent to reach an FWD, you must file early enough that the FWD lands before your trial date, or you must actually move to stay and win the stay.
• Source document: https://ptacts.uspto.gov/ptacts/public-informations/petitions/[1557288](/patent/1557288)

IPR2026-00106 — [[Amazon.com Services](/litigations/by-defendant/Amazon.com%20Services) LLC](/litigations/by-plaintiff/Amazon.com%20Services%20LLC) and Amazon Web Services, Inc. v. Headwater Research LLC (on US 10,321,320) [confirmed as filed; outcome unknown]

• Type: Inter Partes Review
• Filed: 2026-02-20 (exhibit/docket date)
• Status: Unknown to me as of today. Amazon's own stay motion projected institution decisions "around May 2026" and FWDs "by May 2027," so an institution decision should already have issued by now — I could not confirm the result and will not guess it
• Petition grounds: attacks all claims of US 10,321,320 (and a companion petition on US 9,615,192), the only two patents asserted in Headwater Research LLC v. Amazon.com Services LLC, No. 7:25-cv-00286-ADA (W.D. Tex.)
• Related: Amazon moved to stay the W.D. Tex. case pending IPR, arguing "Headwater is also a non-practicing entity, seeks only monetary relief, and would bear no undue prejudice"
• Defensive value: Demonstrates the standard Headwater defense playbook — file IPR within ~5 months of the complaint, then move to stay. Note the forum shift: Amazon filed in W.D. Tex., not E.D. Tex., which changes the § 314(a) calculus materially.

IPR2024-00942 / IPR2024-00944 — Google LLC, [Cellco Partnership d/b/a Verizon Wireless](/litigations/by-plaintiff/Cellco%20Partnership%20d%2Fb%2Fa%20Verizon%20Wireless), Verizon Corporate Services Group Inc., T-Mobile USA, Inc., Sprint LLC, and AT&T Services, Inc. v. Headwater Research LLC (on US 8,589,541) [confirmed as filed]

• Type: Inter Partes Review
• Filed: 2024-06-07
• Patent: US 8,589,541 — "Device-Assisted Services for Protecting Network Capacity"
• Challenged claims: 1–23, 26, 41–60, 63–64, 155–157, and 160–171
• Petition grounds: § 103 obviousness, primary grounds over Rao (US 2006/0039354) alone and Rao in view of Fadell (US 2010/0017506), with a deep secondary stable: Freund, Wyld, Oestvall, Montemurro, Van Camp, and Peterson & Davie's Computer Networks: A Systems Approach
• Status / FWD / appeal: Not confirmed in the sources I reviewed
• Defensive value: Shows the industry-coalition petitioner model (all four national carriers plus Google in one caption) and the art set that has been used against this family since 2024. The Rao/Fadell/Oestvall cluster is the family's most-litigated prior art.

Other family-level activity [unconfirmed — referenced second-hand only]

• Samsung represented to the Board that it "has filed a total of 26 IPR petitions" against Headwater's patents across five litigations in ~2.5 years, of which 11 remained pending at the time of that filing (5 instituted, 6 awaiting institution/discretion decisions), spanning 10 different patents.
• An institution decision on the '811 patent found a "reasonable likelihood of success ... that the only remaining claim ..., namely dependent claim 4, is unPatentable," and Headwater elected not to file a Patent Owner's Response — a forfeiture Samsung's counsel characterized as effectively conceding validity (Samsung counsel email, 2025-04-29). I could not independently confirm the patent number or IPR number for this, so treat it as a lead, not a citation.
• Additional Headwater-family IPRs referenced in litigation exhibits include IPR2023-01336, IPR2023-01253, IPR2023-01360, IPR2024-00010, IPR2024-01041, IPR2024-00943. I did not confirm which patent each targets, and none targets the '090 patent.

---

Strategic summary

Claim status on the '090 patent. Every claim of US 12,488,090 is UNTESTED. Nothing is canceled, nothing has been sustained by a panel. I do not have the claim set in front of me with an FWD-style numbering, and I will not characterize claims I have not read. What I can say from the face of the document: the patent issued from an application filed 2024-03-13 as a continuation claiming priority from US 12/380,780 (2009-03-02), shares the abstract and specification of US 11,405,429 / 10,694,385 / 11,966,464, and expires 2029-03-02. Its claim 1, based on the sibling claim-construction record, is in the "secure execution environment / service profile / secure modem subsystem" lane — the same language Samsung has already attacked as indefinite ("secure modem subsystem," "secure" as a term of degree) in the '429 litigation.

Estoppel landscape. There is no § 315(e)(2) estoppel on this patent, because no IPR has been instituted against it. That is genuinely favorable to a defendant: you are not locked out of any art, and you are not a privy of any prior petitioner. But it also means you cannot inherit a petitioner's winning ground — you must build your own. Two estoppel-adjacent traps do exist: (1) if you are a privy of Samsung or the carrier/Google group, estoppel from the '429, '541, or '042 proceedings does not reach the '090 patent (different patent, so no statutory estoppel), but the district court may be unsympathetic to recycled art; and (2) the PTAB's § 325(d) discretion is firmly in play — Rao, Fadell, Oestvall, and Montemurro have been before the Office repeatedly on this family, and Patent Owner has already built § 325(d) Advanced Bionics arguments around exactly that.

Pattern signals. (a) The same petitioner is filing repeatedly, not serially: Samsung alone accounts for ~26 petitions against Headwater patents. This is a coordinated, well-funded campaign, not a one-off. (b) Headwater is aggressively litigating and aggressively defending: five overlapping suits (Samsung, Verizon, AT&T, T-Mobile, Amazon), a jury verdict in Headwater I (2:23-cv-00103) on 2025-01-17 that Samsung does not infringe, and relentless discretionary-denial briefing at the PTAB. Headwater is also re-issuing continuations from the 2009 priority chain to refresh its assertion portfolio — the '090 patent is the freshest example. (c) No defensive aggregator is visible: I found no Unified Patents or RPX-filed IPR in this family; the Unified Patents portal page for US 9,198,042 appears to be a patent-record listing, not evidence of a Unified challenge. The petitioners are operating defendants. (d) The double-patenting angle is real: defendants argued in district court that claims of US 9,198,042 are invalid for obviousness-type double patenting over US 10,694,385 — a same-family, same-inventive-entity patent — because no terminal disclaimer was filed during prosecution. The '090 patent is a later-issued member of that same chain, which makes a comparable ODP attack a plausible, low-cost line to explore.

---

Recommended next steps

If you are a defendant on the '090 patent:

1. Do not expect a PTAB shortcut, and do not wait for one. Because the patent granted 2025-12-02, the IPR window opened only ~2026-09-02. If you intend to file, file immediately and file to a schedule that produces an FWD before your district court trial date. IPR2025-00482 is the cautionary tale: Samsung's substantively serious virtualization-art petition on the identical specification was denied outright under § 314(a) because the FWD (due 2026-07-29) would land after trial (2026-02-09). Link to that denial: https://ptacts.uspto.gov/ptacts/public-informations/petitions/1557288
2. Move to stay early and for real. The § 314(a) panel in IPR2025-00482 expressly noted "insufficient evidence that the district court is likely to stay." A filed, briefed, and granted stay motion changes that finding. In W.D. Tex. (as Amazon did in 7:25-cv-00286-ADA), the calculus is more favorable than E.D. Tex.
3. Mine the sibling record for free. Samsung's IPR2025-00482 petition (Schmidt / De Beer / Bittmann / Smith) and the carrier-Google Rao/Fadell/Oestvall combination are fully drafted, expert-supported invalidity theories against the same specification. They are not estoppel-barred against the '090 patent and they are not bound by the '429 denial on the merits. Read them before you pay anyone to start from scratch.
4. Run the double-patenting check on day one. Confirm whether the '090 patent's prosecution file contains a terminal disclaimer and whether the examiner applied an ODP rejection over US 10,694,385, US 11,405,429, US 11,966,464, US 10,028,144, US 9,198,042, or US 8,391,834. The family has already been attacked on exactly this ground.
5. Price the tail. Anticipated expiration is 2029-03-02. Any reasonable-royalty theory is bounded by ~2.4 years of remaining term — a strong argument against a large lump-sum demand.
6. Watch for a companion assertion. Given that Headwater re-issues continuations from this chain as siblings are challenged, expect the '090 patent to appear in a new complaint rather than in the 2023–2025 cases. Track Google Patents' family litigation tab for US12488090 and the PTAB docket at https://ptacts.uspto.gov/ptacts/ for any petition filed between now and the 2026-2027 institution-decision window.

If you are evaluating the portfolio rather than a specific assertion: the honest read is that Headwater's 2009-family patents as a group are battered (26 Samsung petitions; at least one claim effectively abandoned without a POPR; a January 2025 non-infringement verdict), while the newest continuation — this patent — is deliberately fresh, un-IPR'd, and un-construed. Treat the '090 patent as a refresher claim set, not as a hardened asset. Its value to Headwater is precisely that no panel has touched it yet.

*Caveat on completeness: I could not confirm the dispositions of IPR2024-00942/943/944 or IPR2026-00106, nor the identity of every family patent referenced in the Samsung briefing. Where I have marked something [unconfirmed], verify against the PTAB docket (https://ptacts.uspto.gov/ptacts/) before relying on it in a brief or an opinion. The only claim I am making with high confidence is the one the structured ODP data supports: no AIA trial proceeding exists for US 12,488,090.*

I'll attempt to retrieve the recorded assignment chain for US 12,488,090 from public sources.

Good progress — I found the core merger/name-change records. Let me dig for the specific assignment entries covering this application and the original inventor→company assignment.

Assignment / Ownership-Chain Reconstruction — US 12,488,090 B2

Sourcing note (read first). I could not query USPTO Assignment Center directly in this session. The reel/frame entries below come from USPTO "Assignment Abstract of Title" printouts that Headwater itself filed as exhibits in the Headwater v. Samsung / Headwater v. Verizon litigations (mirrored on CourtListener and archive.org), plus the USPTO filing-receipt and §3.73(b) papers surfaced in PTAB exhibits. Critically, those abstracts are for sibling family members (e.g., US 9,615,192, app. 13/134,028, app. 14/667,516), not necessarily for 12,488,090 itself. The chain below is family-level and highly likely identical for the '090, but I have not confirmed the '090's own reel/frame entries and flag each such point as [unconfirmed for '090]. The Google Patents record supplied for US12488090B2 lists no post-issuance assignment legal event — only "Application filed by Headwater Research LLC (2024-03-13)," publication, and grant — which is consistent with the original assignee still holding title.

---

Inventors

Unusual pattern flagged (ownership, not headcount): This family does not show the classic "all inventors bolt the original assignee" pattern. Instead:

1. Prior-employer ownership exposure is live and litigated. Raleigh's Qualcomm invention-assignment agreement (Dec. 2006) contains a rebuttable one-year post-employment assignment presumption; the '354 provisional (the priority root of the '090 chain) was filed 2009-01-28 — within one year of his Qualcomm departure. Qualcomm pressed this as a standing/co-ownership defense in Headwater's suits (E.D. Tex. 2:23-cv-00379 et al.). Co-inventor Alireza Raissinia (departed Qualcomm 2009-11-30; named on the sibling '022 line, not on the '090) is a further co-ownership theory. This is a title-cloud risk on the entire chain, directly relevant to any buyer or licensee.
2. The inventor's own assignment to the company was executed in 2009 but not recorded until 2016 (see below) — a 7-year recordation gap.
3. Same-inventor continuations: the '090 is one of dozens of continuations naming Raleigh, so "inventor = assignee principal" continuously through 2024.

---

Original assignee

• Entity on the face of the issued patent: Headwater Research LLC (both current and original assignee of record per Google Patents; the application was filed 2024-03-13 by Headwater Research LLC).
• Historical original assignee for the family: Headwater Partners I, LLC (Delaware LLC; 350 Marine Parkway / 2995 Woodside Road / 555 Twin Dolphin Dr., Redwood Shores–Redwood City, CA) — the entity that received Raleigh's 2009 assignment. It ceased to exist as a separate entity on 2016-12-29 when it merged into Headwater Management LLC, whose name was changed to Headwater Research LLC (Delaware; principal place of business 1011 Pruitt Place, Tyler, Texas 75703).
• Business / products: Headwater is a patent-holding and licensing entity, not an operating company. Per Headwater's own complaints, the technology was commercialized by a separate company, ItsOn Inc. (founded 2008 by Raleigh), which "licensed Headwater's intellectual property and implemented Headwater's technology" in software shipped on Sprint/Samsung devices (Samsung-1001-type complaint ¶¶14, 17–27). Headwater itself is described as "the owner" of the asserted patents with rights to recover damages — i.e., a licensor/enforcer.
• Current status: Active. A separate Headwater complaint (2025) describes plaintiff Headwater as "a Texas limited liability company... with its headquarters at 110 North College Avenue, Suite 1116, Tyler, Texas 75702" (2:25-cv-00916), while the 2016 Delaware merger certificate gives the Delaware LLC address as 1011 Pruitt Place, Tyler, TX 75703. Discrepancy flagged — likely a Delaware LLC + Texas registration/suite-address mismatch, but not reconciled from the records retrieved.
• Operating history of the commercialization vehicle (ItsOn): substantial (carrier deployments 2013–2016 with Sprint/Samsung). Its later corporate fate (acquisition/wind-down) is not established by the records retrieved — stated as unknown rather than guessed.

---

Assignment timeline

(All entries marked [unconfirmed for '090] are reel/frame data captured from a sibling patent's USPTO Assignment Abstract of Title — US 9,615,192 / apps 13/134,028 and 14/667,516 — not from a direct '090 pull. Treat reel numbers as likely-but-not-confirmed for the '090.)

• 2009-03-24 (executed) / recorded 2016-07-15 — Reel 039170/0341 [unconfirmed for '090]

  • Conveyance: Assignment (new assignment; 1 property; 2 pages)
  • Assignor: Gregory G. Raleigh (individual)
  • Assignee: Headwater Partners I, LLC (350 Marine Parkway, Suite 300, Redwood City/Redwood Shores, CA 94065)
  • Correspondent: not captured in the retrieved abstract. (Related prosecution papers show Krista S. Jacobsen, Reg. No. 59,374, "Head Counsel, Headwater Partners I LLC," e-mail krista@jacobseniplaw.com — she signed the ADS/§3.73(b) statements, not confirmed as the recording correspondent. Single appearance only → no recurrence finding.)
  • Context: founder-to-company assignment — normal, but the 7-year execution-to-recording lag (2009 execution, 2016 recordation) coincided with pre-assertion record clean-up.

• 2016-12-29 (executed/effective) / recorded 2017-01-05 — Reel 041268/0108 [unconfirmed for '090; 50 properties on the recorded abstract]

  • Conveyance: Merger and Change of Name (Delaware Certificate of Merger, File No. 4966025, filed 2016-12-29 3:02 PM; SR 20167326785)
  • Assignors/Conveying parties: Headwater Partners I LLC and Headwater Management LLC (both 12/29/2016)
  • Assignee (surviving entity's new name): Headwater Research LLC, 1011 Pruitt Place, Tyler, TX 75703
  • Correspondent: "ANN TAYLOR, 1011 PRUITT PLACE" — i.e., the assignee's own Tyler, TX address, not an outside law firm. A Headwater-address correspondent recurring across the merger recording is a notable clerk-of-record pattern, but I only have one confirmed record on which to call recurrence → flagged, not scored as a repeat-correspondent finding.
  • Context: internal reorganization / change of name only — no change in beneficial ownership (Raleigh-controlled on both sides).

• 2024-03-13 — Reel — none retrieved—

  • Conveyance: none recorded in the Google Patents legal events for US12488090B2
  • Assignor / Assignee: n/a (application filed directly by Headwater Research LLC)
  • Context: contination filed in the name of the then-current owner; no separate per-application assignment appears on the record retrieved. (Inference, flagged: title to the '090 flows from the 2009 Raleigh assignment + the 2016 merger rather than from a fresh 2024 instrument.)

• 2025-08-20 / 2025-12-02 — No assignment events. Application granted 2025-12-02; no post-issuance assignment recorded as of the Google Patents record fetched 2026-09-24.

If Assignment Center returns nothing patent-specific for 12,488,090: that is consistent with what I observed (no per-'090 assignment event), and the practical reading is that the original assignee, Headwater Research LLC, still owns the patent.

---

Timeline diagram

timeline
    title Ownership of US 12488090
    2008 : Raleigh leaves Qualcomm
         : Founded Headwater
    2009 : Priority provisional filed
         : Raleigh assigns to Headwater Partners I LLC
    2016 : Raleigh assignment recorded at USPTO
         : Headwater Partners I merges into Headwater Research LLC
    2024 : Continuation application filed by Headwater Research
    2025 : Patent US 12488090 granted

---

NPE / troll-pattern signals

1. Shell-entity transfer — PRESENT (qualified). The title sits in a licensing/holding LLC, not an operating company: Headwater Research LLC, a Delaware LLC whose principal place of business is a residential-style address (1011 Pruitt Place, Tyler, TX 75703) and whose own 2025 complaint gives a second Tyler box/suite-style address (110 N. College Ave., Ste. 1116). Per reel 041268/0108 (recorded 2017-01-05), the entity is the product of a merger that eliminated the original operating-adjacent entity (Headwater Partners I LLC) and left a name-only shell survivor. Caveat: the transfer was founder-controlled in→founder-controlled out (Raleigh on both sides), not an arm's-length sale from a third-party operating company, so this is a non-practicing-holder finding rather than a classic fire-sale shell transfer.

2. Known asserter in the chain — PRESENT (not on the named lists, but functionally). Current assignee Headwater Research LLC is a high-frequency patent plaintiff in its own right — 2022–2025 suits against Samsung (2:22-cv-00422; 2:23-cv-00103), Verizon (2:23-cv-00352, jury verdict ~$175M, 2025-07-23), T-Mobile (2:23-cv-00379; 2:25-cv-00164), AT&T (2:23-cv-00397), DISH (2:25-cv-00907), Google/Apple/Amazon (W.D. Tex. 2025) — and a frequent IPR target (IPR2023-01336; IPR2024-01397/01407; IPR2026-00049; IPR2026-00138; IPR2026-00088/00106). It does not match the classic listed NPEs (Acacia, Marathon, IV, Wi-LAN/Mosaid, Vringo, Pendrell, MPHJ, Round Rock, etc.) — no such entity appears anywhere in this chain. I did not confirm an RPX/Unified "asserter directory" entry by name in the retrieved material; state as unconfirmed, but the litigation/IPR record independently establishes high-frequency assertion.

3. Repeat correspondent across the chain — UNCLEAR (not established). Two correspondents/contacts observed: (a) "ANN TAYLOR, 1011 PRUITT PLACE" as correspondent of record on merger reel 041268/0108 (a Headwater-address correspondent, not a law firm), and (b) Krista S. Jacobsen, Reg. No. 59,374, "Head Counsel, Headwater Partners I LLC," jacobseniplaw.com, on prosecution/§3.73(b) papers. Each appears in only one confirmed spot in the records I retrieved, and Jacobsen's role is prosecution rather than assignment recording. Per your rule, a single appearance is not a finding — no repeat-correspondent call.

4. Cascading transfers — NOT PRESENT. Only two recorded links, separated by ~7.75 years (execution 2009-03-24 → execution 2016-12-29), and the second is a same-owner merger/name change. No chained LLCs within 24 months; no shared-correspondent-address cascade.

5. Pre-litigation transfer — NOT PRESENT for the '090 (weak/UNCLEAR for the family). No assignment is dated within 6 months of any suit naming 12,488,090, because no suit naming 12,488,090 was identified at all (consistent with the earlier litigation section). Family-level oddity worth noting: the Raleigh→Headwater assignment executed 2009-03-24 was first recorded 2016-07-15 (reel 039170/0341) — a late recordation ahead of the assertion campaign — but that is not a pre-litigation transfer as your criterion defines it.

6. Bankruptcy fire-sale — NOT PRESENT. No Chapter 7/11, no 363 sale, no assignment trustee anywhere in the chain retrieved.

7. Privateering — NOT PRESENT (structurally adjacent, though). The transfer was not operating-co → NPE-to-sue-competitors. It was founder → his own holding LLC, with the operating licensee being ItsOn Inc. (a Raleigh-founded affiliate that actually deployed the technology). This is a "license-back + enforce" model, not third-party privateering; no SEC-filing-disclosed privateering was found (Headwater is private and files no 10-K/8-K).

8. Defensive aggregator (anti-NPE) — NOT PRESENT. Chain terminates at Headwater Research LLC (an active enforcer), not at RPX, AST, LOT, Unified Patents, or OIN. The patent has not been neutralized.

---

Verdict

NPE — high confidence.

Justification (2–3 sentences). The chain terminates in Headwater Research LLC, a non-practicing patent-holding/licensing LLC (Delaware merger survivor per reel 041268/0108, recorded 2017-01-05; Tyler, TX addresses; technology commercialized by a separate licensee, ItsOn Inc., per Headwater's own complaint) — signal 1 — and that same assignee is a high-frequency asserting plaintiff (Verizon jury verdict ~$175M in 2:23-cv-00352; suits against Samsung, T-Mobile, AT&T, DISH, Google, Apple, Amazon; repeated IPR target) — signal 2. Two strong signals met, so the call is high confidence, with the honest qualifier that this is a founder-controlled licensing entity carried through a name-change merger, not an arm's-length purchase of a failed operating company's portfolio — and that most of the assignment-chain evidence is family-level (US 9,615,192 / apps 13/134,028 and 14/667,516 abstracts) rather than a patent-specific Assignment Center pull for 12,488,090, which should be re-run.

Verify at: USPTO Assignment Center — https://assignmentcenter.uspto.gov/ (search 12488090) and the legacy index https://assignment.uspto.gov/patent/index.html. Also check the Darts-IP family link on the Google Patents page (family 42398802) and Headwater's most recent complaints (e.g., v. T-Mobile, 2:25-cv-00164; v. DISH, 2:25-cv-00907) for any amended patents-in-suit list adding 12,488,090.

I'll search for the specific patent number and its cited references.

Let me try to retrieve the actual front page and citation list of US 12,488,090.

Prior-Art Search — U.S. Patent No. 12,488,090

Executive summary / status

I searched for the exact number 12,488,090 across patent sources (Google Patents, USPTO/PTAB document databases, patentimages PDFs, uspto.report, and litigation mirrors). I did not auto-substitute any similar number. The results returned:

1. Confirmation of the patent's identity (bibliographic data, family, priority) — consistent with the previously generated sections.
2. Partial, second-hand copies of the "(56) References Cited" front-page lists from same-specification family members (US 8,589,541; US 9,491,199; US 10,171,995; US 10,694,385; US 11,363,496; US 11,405,429). These share the identical specification with the '090 patent.
3. No primary retrieval of the US 12,488,090 B2 front page itself — the tool budget expired before I could pull the issued patent's own "(56)" block (or its PDF at patentimages.storage.googleapis.com).

Bottom line up front: I cannot responsibly give you a reference-by-reference § 102 anticipation table for the '090 patent's citation list, because (a) I could not retrieve that list from a primary source, and (b) the citation lists in this family are hundreds of entries long (IDs spanning 1992–2010s), the overwhelming majority of which are class-"A" background art that was never used in a rejection. Below I give you (i) what is verified, (ii) the best-corroborated reconstruction, (iii) a rigorous §102 framework and my candid anticipation assessment, and (iv) exactly how to close the gap.

Cross-reference flag (not a contradiction, a continuing gap): the earlier Patent-summary section explicitly warned that the granted claim set of US 12,488,090 was unverified (only published claim 1 from US 2024/0248981 A1 was available). That gap persists and it directly limits the "which claim(s) does it anticipate" part of this task. I cannot map a reference to "claim 7" or "claim 12" of the '090 patent if I cannot see claim 7 or claim 12.

---

1. Bibliographic framing that controls the § 102 analysis

Consequence: art must predate 2009-01-28 to be § 102(a)(1) prior art. Anything on the face dated after 2009 is not § 102 art for these claims unless it qualifies under § 102(a)(2) (i.e., an earlier-effective-filed U.S. application/publication). This alone disqualifies a meaningful slice of the modern references that appear on the family's face (they were cited against later continuations that had later effective dates).

---

2. What is actually verified from the family's "(56) References Cited"

These entries were returned by multiple independent front-page sightings of same-family patents and are therefore high-confidence as family citations. I present them as found, without auto-correcting the alphanumerics; several are visibly OCR-garbled across sources (flagged).

Table A — U.S. Patent Documents (1992–2000 core, corroborated across ≥3 siblings)

* "Thematic description" caveat: these are short functional characterizations inferred from the citation context and, where visible, the printed classification codes — not verified titles or abstracts. I deliberately did not invent titles. (See §5 for why, and how to get verified titles.)

Table B — Foreign Patent Documents (family face)

Table C — Other Publications (NPL, from the family face of US 8,589,541 — verify before relying)

• Hartmann et al., Agent-Based Banking Transactions & Information Retrieval — What about Performance Issues? (1999).
• Van Eijk et al., GigaMobile — Asset Technology for Designing Personalized Mobile Service Brokerage (Jul. 2002).
• Yu Li, Dedicated E-Reading Devices: The State of the Art and Challenges, Scroll, vol. 1, no. 6 (2008).
• Dikaiakos et al., A Distributed Middleware Infrastructure for Personalized Services (Nov. 24, 2003).
• Rao et al., Evolution of Mobile Location-Based Services, Communications of the ACM (Dec. 2003).

Hallucination guard: I am not reproducing the full ~300+ item IDS as if I had read it. I saw a real, partial, OCR'd slice. Surnames/dates above are as the sources printed them; the titles in the bulleted NPL list are as OCR'd by the source I retrieved and may contain transcription errors (e.g., "Van Eijk," publication name fragments).

---

3. § 102 anticipation analysis

3.1 Legal framing (why "anticipation" is the wrong lens for most of this list)

• § 102 requires a single reference disclosing every element as arranged in the claim (no additional reference may supply the missing element). Net MoneyIN v. VeriSign; MPEP § 2131.
• The great majority of the face-listed references are background art — cited by the applicant in IDS submissions and not relied upon by the examiner. A reference appearing in a "(56)" block is not an anticipation reference; it is a disclosure-of-record.
• Because claim 1 requires "a service profile executed at least in part in a secure execution environment … associated with a service plan … monitor use … [and] verify the use," a § 102 reference would need to disclose, in one document: (1) a device-side (communications device) secure execution environment, (2) a service-policy profile tied to a service plan, (3) monitoring use against that profile, and (4) verifying the monitored use.

3.2 Reference-by-reference § 102 assessment (grouped)

3.3 The only references that are thematically close — and why they still fail § 102

1. US 5,892,900 (Ginter et al.) — "secure execution environment" theme. Fails because it addresses content/rights protection, not service-plan profiling of wireless network usage with a device-side verify step. § 103 candidate at most.
2. US 2009/0016310 A1 — cited by the examiner against the EP family member EP 3,493,505 B1 (multi-mode access-technology optimization). I could not confirm it appears on the '090 face. Not an anticipation reference.
3. The Headwater family itself — the true § 102 concern here is internal: the '090 is a continuation of US 8,391,834 → US 9,198,042 → US 10,028,144 → US 10,694,385 → US 11,405,429 (all "Security techniques for device assisted services"). Because they share the 2009-01-28 priority date, they are not prior art to one another under § 102. They are, however, a double-patenting / obviousness-type double-patenting (ODP) exposure, which is why terminal disclaimers appear in this family (noted in the earlier summary).

3.4 Candid answer to "which claim(s) it potentially anticipates"

On the evidence available, no reference cited on the face of this family anticipates any claim of US 12,488,090 under § 102. This is corroborated by the fact that the application issued (2025-12-02) without the examiner allowing claims over any anticipating reference. Converting any of the above into a § 102 attack would require producing a single reference I have not seen that discloses the secure-execution-environment + service-profile + monitor + verify combination — and I found none.

I could not perform a definitive per-claim mapping because (a) the '090's own (56) list was not retrievable in this session, and (b) the granted claim set of '090 remains unverified (continuing the caveat from the earlier sections).

---

4. What I will not do

• I will not enumerate all ~300+ cited items as if I read the '090 front page.
• I will not supply invented titles/abstracts for references I only saw as OCR'd number/inventor/date rows.
• I will not attribute the family's citation list to '090 as if it were verified for that patent, nor attribute the Alpha Modus "'890 patent" or any other similar number to this analysis (per your strict rule).

---

5. Explicit uncertainties and how to close them

1. The '090-specific "(56)" block is unverified. I reconstructed from siblings. Some references may be added (continuations often add new IDS art) or dropped relative to siblings.
2. Descriptions are thematic, not verified. The family front pages I reached were partially OCR-garbled (e.g., "5,597,100"/"5,633,686"/"5,889,497"/"6,078,935"/"6,141,606" variants appeared in one source vs. "5,577,100"/"5,633,868"/"5,889,477"/"6,078,953"/"6,141,686" in another). I printed them as found and flagged, per your instruction not to auto-correct identifiers.
3. Granted claim set unverified → per-claim § 102 mapping is not possible with confidence.
4. Date discrepancy persists from earlier sections (system date Sept. 29, 2026 vs. task date April 26, 2026); reported as found.

Recommended primary-source verification (in priority order)

Confidence summary: Patent identity, priority chain, and "no § 102 anticipation apparent from the family face" — moderate-to-high. Exact '090 reference list, per-claim mapping, and reference descriptions — low / unverified, and I've labeled them accordingly rather than filling gaps with guesses.

I'll start by trying to retrieve the actual prior-art citations for this patent, since the fetched page text I was given contains the specification, abstract, and CPC classifications but not a "Patent Citations / References Cited" prior-art section.

Strong lead: an IPR against a Headwater patent lists a full prior-art set. Let me pin down which patent that IPR targets and pull the actual cited references for this family.

Obviousness Analysis — U.S. Patent No. 12,488,090 B2

Security techniques for device assisted services (Headwater Research LLC; Raleigh)

---

0. A required sourcing flag before anything else

The page text I was given contains no "Prior Art" section. The Google Patents fetch supplied to me includes the bibliographic data, CPC classifications (which are labeled "Prior art keywords: service / communications device / network / secure / partition"), the Landscapes, the Abstract, and the full Description with FIGS. 1–11 — but the "Patent Citations / References Cited" block is absent, as is any examiner-cited-art list. The only reference-like content on the page is the auto-generated "Definitions" glossary (e.g., "wire line access networks… such as cable and DSL"; "wire line user service consumption habits…"), which is a Google Patents text-parsing artifact, not prior art.

Because I was instructed to use the page's prior-art results and there are none, I am substituting the prior art already of record against this exact specification — i.e., the references the USPTO/EPO and the PTAB have applied to the sibling patents that share this same disclosure. That is the most defensible substitute available, and it is unusually powerful here because the family has already been litigated twice over.

---

1. The claim model I have to test (and its uncertainty)

I could not retrieve the issued claim sheet of 12,488,090. The prior sections flagged this. Two candidate claim models exist, and they produce different obviousness pictures:

Model A is the far more likely target for a §103 attack, because it is essentially a two-element claim: (i) device-side service-profile enforcement/monitoring, and (ii) doing it inside a secure execution environment. Model B would be materially harder to invalidate and is where Headwater's litigation value sits (it is the claim structure the '429 patent actually asserted).

⚠️ Any conclusion below is provisional. The granted '090 claims must be read before this analysis is relied upon.

Priority / governing statute. The '090 issued from an application filed 2024-03-13, but every claim is presumptively entitled to the 2009-01-28 provisional chain via 12/380,780 (filed 2009-03-02) → 12/694,445 (2010-01-27) → 13/737,748 → … . If all claims are supported by that earlier disclosure, pre-AIA 35 U.S.C. §§ 102/103 govern — exactly as the Board held for sibling US 9,198,042 ("Because the '042 patent issued from an application filed before that date, our citations to 35 U.S.C. §§ 102 and 103 in this Decision are to their pre-AIA versions"). If any claim is not so supported (a real risk for Model B's secure-modem-subsystem language, which first appears in the 12/694,445 CIP and provisional 61/252,151 of 2009-10-15), AIA § 103 applies and the effective date slips to at most 2009-10-15 or 2010-01-27 — which shifts, but does not eliminate, the prior-art field.

---

2. Prior-art inventory actually of record (grouped by what it proves)

Group I — device-side service policy/profile enforcement, monitoring, and reporting (the "DAS mechanics")

Group II — secure execution environments, protected partitions, and encrypted protected storage (the "secure execution environment" element)

Group III — intermediate networking / gateway devices — Polson (EX-1008); US 8,064,417; US 7,672,695; US 7,881,267; US 2008/0244018; US 2009/0265754.

The single most important fact in this file: in IPR2024-00809, the Board issued a Final Written Decision on Oct. 14, 2025 determining all challenged claims (1–18) of sibling US 9,198,042 unpatentable under 35 U.S.C. § 318(a), on grounds of:

• Ground 1 — claims 1, 2, 6–18 obvious over Limont + Wright + Xu;
• Ground 2 — claims 3–5 obvious over Limont + Wright + Xu + Polson.

US 9,198,042 arises from application 13/737,748, which is the direct ancestor of 12,488,090 in the same continuation chain, from the same specification and same FIG. 1–11 disclosure. A POSA-facing tribunal has already held that the shared specification's core subject matter — receiving reports from a wireless end-user device over a service control link and reconfiguring the device based on current service policy — is obvious.

---

3. Element-by-element mapping (Model A — the likely target)

For Model B, add: secure modem subsystem ↔ Polson's removable WWAN interface and gateway; first + second secure control channels ↔ Polson's routing engine plus the Group II encrypted-partition references; secure memory partition accessible only from the secure execution environment ↔ ARM TrustZone secure-world memory and US 2006/0112427 / US 2006/0224742 encrypted-partition teaching; and "separately secure from" ↔ the TrustZone architecture's express separation of secure vs. non-secure worlds.

---

4. Proposed grounds of rejection under § 103

Ground 1 (primary; Model A)

Claim 1 obvious over Limont in view of Wright and Xu, further in view of ARM TrustZone (EX-1009/EX-1010) and/or US 2006/0112427 (EX-1011).

Motivation to combine. Limont teaches the complete device-assisted architecture — server-side policy determination, transmission of policy settings to the wireless device, application and monitoring on the device — and, per the IPR record, "states policy settings should be 'locked down' on the wireless device" but "does not expressly state that the policy settings should be encrypted." Wright and Xu supply precisely that missing measure: "policy settings should be encrypted (and optionally stored in secure memory) on a wireless device in order to prevent unauthorized access to the settings." TrustZone and the encrypted-partition references then supply the hardware implementation — a hardware-enforced partition with secure-world memory and secure boot — which is the ordinary, well-known way (as of 2007–2009, and reflected in the specification's own recitation of "secure virtual execution environment or a separate hardware security function," "secure kernel operating modes," and "a separate bank of isolated memory space within the host CPU") to implement "lock down" and "secure memory."

KSR rationales. (a) The references are in the same field (mobile/wireless device security and service policy enforcement). (b) They address the same problem — a subscriber or malware defeating or falsifying device-side service measurement and policy enforcement (the specification itself frames the entire invention as solving exactly this). (c) The combination is a combination of familiar elements according to known methods yielding predictable results: putting a previously tamperable agent into an existing hardware-protected partition gives the known benefit of tamper resistance. (d) There is an express design incentive / market pressure — the Background admits that "network capacity will increase… [but] these capacity gains are likely to be less than what is required," and that carrier costs rise with bandwidth, giving service providers a direct incentive to make on-device metering and control trustworthy enough to bill and enforce on.

Ground 2 (Model B / the '429-style independent claim)

Limont + Wright + Xu + Polson, further in view of TrustZone (EX-1009/1010) + US 2006/0112427 (EX-1011) + US 7,849,310 (EX-1012).

Polson supplies the intermediate-networking/gateway framing the '429-style claim needs ("gateway… refers to any computing device capable of facilitating transmission of data from one or more LANs to one or more WWANs…," EX-1008 ¶[0026]; removable WWAN interface ¶[0020]; subscription-based policy forwarding ¶[0039]) — which is why the Board folded Polson in as the fourth reference for the dependent claims. TrustZone-type partitioning supplies the "separately secure" and "secure memory partition accessible only from the secure execution environment" limitations, since the trusted-world/normal-world split is by definition a "separately secure" partition with memory inaccessible to the normal world.

Ground 3 (alternative / cumulative)

Pearce + Aarnos + Group I references, in view of Group II. Pearce (mobile phone policy settings) and Aarnos (storing and modifying policies on mobile phones) are the closest art to "implement a service profile … associated with a service plan" on a handset rather than a gateway, and they were already collected as background against this family. Combining them with the secure-partition art attacks the claim from a second direction and is useful to defeat a "Limont is a pre-phone architecture" argument.

Ground 4 (design-around for Model A's "verify" step)

Any of the above + Wyld US 8,028,060 / Van Camp US 8,914,783 / Fadell US 2010/0017506. Verification of device-reported usage against independent measures (network CDRs, alternate measurement points) is exactly what Wyld/Van Camp-style device-management and usage-monitoring references teach, and the specification concedes as much (comparing "monitored service usage versus other service usage measures and/or combined with various other network service usage measures").

---

5. Where the attack is strong vs. weak

Strong.

• The EPO has already issued "Y" citations against this family — US 2007/0255942 (Weller) and US 2009/0016310 (Rasal). A "Y" designation means the examiner regarded those documents as relevant in combination with another reference. That is an independent examiner's combination-level obviousness signal on the same disclosure.
• A PTAB Final Written Decision already invalidated all 18 claims of the sibling '042 on the shared specification.
• The specification admits the security techniques are conventional: TrustZone-era "hardware security features," "secure kernel operating modes," "virtual execution partitions… provided by the operating system," SIM/secure-element options, and "secure memory, secure modems, secure memory partition(s) in the CPU/processor."
• Under AIA 37 C.F.R. § 1.104-type analysis, Model A's claim 1 recites a result ("execute at least in part in a secure execution environment") without hardware specificity — inviting a "result-oriented claim" / broad-scope reading that maximizes the prior-art coverage.

Weak / where a patent owner will fight.

1. The "secure execution environment" element is the whole case for Model A. Headwater will argue that Limont/Wright/Xu merely encrypt stored settings, and that none of them teaches executing the policy/monitoring agent itself inside a hardware-isolated partition. If the granted claims require execution (Model A says "executed at least in part in," which is worse for Headwater; a claim requiring the entire enforcement path in the partition is better for Headwater), the combination must explicitly tie TrustZone to the policy agent execution, not just to storage. That link must be established with record cites — the Houh declaration backgrounds TrustZone but the grounds did not rely on it, so a petitioner would be building this argument largely from the background section and expert testimony.
2. No reference has been identified that expressly puts service-usage metering in a trusted execution environment for billing purposes. That is the narrowest, most defensible reading of the '090's contribution, and it is the theory on which Model B's "separately secure" language was drafted.
3. Objective indicia. Headwater's Verizon verdict (US 8,589,541 / 9,215,613; $175M jury verdict July 23, 2025; final judgment Apr. 23, 2026; now on appeal, Fed. Cir. 26-1884) and its active licensing campaign provide a commercial-success / industry-recognition narrative. Counterweight: the '042 FWD, and the fact that the asserted patents in most suits are other family members.
4. No IPR, no litigation, and no §103 rejection of record against 12,488,090 itself has been located (per the earlier Litigation section, which found no case naming this number). Any obviousness conclusion here is therefore an a priori analysis, not a reported outcome.
5. § 103(c) / common-ownership risk for same-family art. Headwater may attempt to rely on the earlier family publications (e.g., US 2010/0195503 A1; WO 2010/088275; EP 2,392,088) — but those are the same inventive entity and same disclosure, so they are not "by another" and cannot be § 102(e)/(a)(1) art against the '090 as long as the '090 gets the 2009 date. The viable attack runs through the third-party references, not the family's own papers.

---

6. What must be confirmed before relying on this

1. Obtain the granted claim sheet of US 12,488,090 (7, 12, 18, or 20 claims?). Everything above is conditional on which model applies.
2. Read the file wrapper for the '090 (application 18/604,106) — if the examiner allowed over Limont/Wright/Xu/TrustZone, capture the statement of reasons for allowance; if the examiner never cited them, note the art's continued availability via IPR (§ 311(b) — IPR may be based on patents and printed publications only; Polson and TrustZone materials are both printed publications).
3. Determine the § 102/103 regime by testing whether each claim's "secure modem subsystem"/"separately secure" language has § 112 support in provisional 61/206,354 (2009-01-28) and application 12/380,780 (2009-03-02), or only in 61/252,151 (2009-10-15) / 12/694,445 (2010-01-27).
4. Verify the two truncated/ambiguous identifiers before citing them: "US 2006/0224742 A1" vs. the exhibit table's "US 2006/022474A1," and confirm US 2007/0255942 ("Weller") — Weller is the EPO's "Y" reference and is not in the IPR exhibit list, making it a genuinely independent second opinion.

---

7. Bottom line

If US 12,488,090 carries the published claim 1 (Model A), it is highly vulnerable — it reduces to (i) on-device service-profile implementation and usage monitoring, which Limont/Wright/Xu/Polson already render obvious, combined with (ii) a hardware-protected execution partition, which ARM TrustZone and the encrypted-partition references supplied before the 2009 priority date, with strong KSR rationales (same field, same problem — anti-tamper metering — predictable result, express market pressure). The EPO's own "Y" combination citations and the Oct. 14, 2025 PTAB Final Written Decision invalidating all claims of the sibling '042 on this identical specification are the two strongest grounding facts in the record.

If it instead carries '429-style language (secure modem subsystem; a first secure control channel; a second secure control channel from a "separately secure" execution environment; secure memory partition accessible only from that environment), the art must be stitched from four or five references, the TrustZone linkage must be established by expert testimony rather than by a prior ground, and the combination is substantially weaker — that is the claim structure Headwater evidently regards as its moat.