T 1179/14 (Reducing security risk/KASPERSKY) 20-06-2017

The invention

1. The application is concerned with reducing the security risks in a computer network based on individual users' security ratings.

1.1 The security ratings are calculated based on the users' personal characteristics and their behaviour, including their use of external drives, the Internet and social media, the frequency with which they install software and how many security incidents they have had (see page 5, last paragraph; page 6, paragraph 3, to page 7, paragraph 2; page 8, paragraph 4, to page 9, paragraph 2; table 1 on pages 12-13; page 14, lines 4-17; figures 2-4 and 6). Moreover, the users' communication behaviour is monitored, and an individual user's security rating takes into account both communication with another user that takes place and that which is merely "probable" in view of the proximity of the two users' locations or the similarity of their job duties (see page 8, paragraphs 2-3, and figure 2, "detection agent" 210 and "event log" 220).

1.2 Based on the security ratings, "security settings" are selected for each individual user and sent to a "protection agent" on the user's computer (see figure 2, nos. 230 and 240). The protection agent may be (a component of) an "antivirus application, responsible for spam filtering, spoofing, detection of network attacks and viruses" (see page 7, lines 21-25) or a "firewall" (see page 15, table 2 and lines 3-5). The "selected security settings" may include "settable parameters for various components of the protection agent" and relate to "security policies of the computers, software usage and installation restrictions, network access settings, computer usage restrictions, user training materials, and administrative notifications" (see page 7, lines 23 and 26-28, and page 11, lines 1-4).

1.3 More specifically, it is disclosed that the system according to the invention may prohibit a user from launching executable files from external drives if that user has been using "many external drives", or impose "traffic limitations" such as "traffic checks" or the "disabl[ing of] the access to unauthorized web sites" depending on the user's "website browsing level" (see page 7, last paragraph, to page 8, paragraph 1; page 14, lines 4-17; and figure 15, table 2). Alternatively, the administrator may order "preventive measures" such as training programs or "other sanctions" (see page 11, last eight lines, and figure 7).

The prior art

2. D1 discloses a system that continuously tracks each user's activities so as to produce a "risk score" (abstract, paragraphs 33, 38, 40, 47, figures 1 and 7-9) and to assess the user's compliance with a given security policy (see paragraphs 15 and 16).

2.1 If the user does not comply with the security policy, an administrator may be alerted (see paragraph 15, last sentence). If the user's risk score is too high, various protective measures may be taken, including training and mentoring of the user, improving business processes or "modify[ing] the security policies enforced on the users" (see paragraph 16, fourth and last sentences, and paragraph 47, last two sentences).

2.2 Various user activities are tracked, including web browsing, the use of email and of hardware peripherals, and the activity in the computer's file system (see figure 7, no. 701a-d, paragraph 68). Moreover, entire sequences of user activities are detected and evaluated, such as the downloading and launching of executable code from a web browser, the copying of files from USB sticks, and the installation of software (see figures 9c and 9d, e.g. sequences 5, 7 and 11). By way of example, it is mentioned that emails are dangerous in particular if the "recipient[s]" are "outside the organisation" (see paragraphs 73 and 74, and figure 7, no. 701b, dash 4).

Inventive step

Main request

3. D1 discloses the features of the preamble of claim 1, namely the collection of "information about computer usage, security incidents and electronic communications between computer users" (see esp. D1, figure 7), the retrieval of "user profiles" (see e.g. paragraph 33), the calculation of a "user security rating" (see e.g. abstract) and the use of that rating so as to "reduc[e] security risk[s]" in a computer network.

3.1 D1 further discloses that a user's security rating is determined based inter alia on "communication flow events comprising data transmissions" (see figure 7, no. 701a and b) and that email conversation with users outside the organisation is riskier than with users within it (see paragraphs 73 and 74).

3.2 D1 does not, however, disclose the following features of claim 1:

(a) A user's security rating is based on messaging or "social communication" between the user and a specific other user, on the "probability of electronic communication flow" between users, or on the security ratings of the user's communication partners.

(b) There are "protection agents" on the users' computers which receive the determined "security settings" and use them "to reduce security risk in the computer network".

4. Re difference (b) D1 discloses the generation of a detailed risk report for each individual user for assessment by the system administrator (see figures 11a-k, paragraph 86). On the basis of this report the system administrator decides on any consequences (see paragraphs 16 and 47). To enforce them, D1 discloses training, mentoring or the threat of dismissal (paragraph 47).

4.1 The board considers it to be obvious that a system administrator may also want to address undesirable behaviour with individual prohibitions: for example, if a user performs particularly risky operations such as visiting unauthorised websites or accessing a private USB stick from his office computer, an obvious sanction would be to prohibit such operations for that user.

4.2 The decision to impose a sanction is, in the board's judgement, a non-technical decision by the system administrator.

4.3 Claim 1 of the main request does not specify what the protection agent does and thus how precisely it contributes to enforcing the security settings. The description includes the option of sending training material or administrative notifications to the user concerned (see page 11, paragraph 1). From that perspective, the claimed protection agent may be construed as merely providing automated support for the sanction disclosed in D1.

4.4 The board takes the view that such automation per se is obvious and thus cannot give rise to an inventive step.

5. Re difference (a) The fact that, according to difference (a), further security-related parameters are considered may improve risk assessment and thus help the system administrator to address security risks.

5.1 The board agrees with the decision under appeal (see reasons 7.4) that the idea of adjusting a user's security rating in view of the security rating of that user's communication partners is an administrative decision which thus cannot, per se, contribute to an inventive step.

5.2 Moreover, the board takes the view that the idea is obvious over D1. D1 already discloses that email communication with users outside the organisation is riskier than with users within it. It is merely a small modification of this idea to treat individual users separately. Furthermore, the board considers it to be well known that some websites are more likely to cause malware infections than others. Accordingly, it would be obvious to treat some websites as riskier than others. The same consideration applies by analogy to a user's different communication partners.

5.3 If determining a security rating requires establishing the security ratings of users with which a given user communicates or might communicate (see the application, page 8, lines 8-18), it would be straightforward for the person skilled in the art to provide means for obtaining them.

6. The board concludes that differences (a) and (b) are insufficient to render the subject-matter of claim 1 inventive over D1.

Auxiliary requests 1 and 2

7. Claim 1 of the first auxiliary request adds the features that

(c) the users' security ratings are also based on "external drive usage events",

(d) the security settings may comprise prohibitions on launching executable files,

(e) depending on a user's "website browsing levels", corresponding "traffic limitation levels" are determined, and

(f) the protection agents may "enable" corresponding "traffic checks".

Claim 1 of auxiliary request 2 clarifies that the security settings according to (b) are "applied" to the protection agent and that it is the role of the protection agent to "enable" prohibition of launching executable files from external drives.

7.1 D1 discloses the detection of external drive usage events and of users' "website browsing levels", as well as their use for determining security ratings (see e.g. figure 7, no. 701d).

7.2 The board considers it obvious that a system administrator will, when detecting that an individual user performs activities considered to be particularly risky, consider checking these activities more carefully or prohibiting them entirely. For instance, the board considers it obvious to require that a user stop using "external drives" or visiting specific websites. Where possible, it would also be obvious, in the board's judgement, to use automated support, e.g. in the form of a "protection agent" on the user's computer, to enforce such prohibitions.

7.3 As a consequence, the board also finds the subject-matter of claim 1 of auxiliary request 2 to lack inventive step over D1, Article 56 EPC. A fortiori, this argument also applies to claim 1 of the first auxiliary request.