T 1073/15 (Multi-level authentication/KASPERSKY) 15-12-2017

The invention

1. In general, the application relates to what is called multi-level authentication.

1.1 It is known to require two levels of authentication before a user can gain access to a protected resource: for instance a password and a token. This is referred to as two-level authentication (see description, page 1, lines 17-29).

1.2 Beyond that, the invention proposes the use of tokens and corresponding wireless transponders (see figure 1). A user, in order to get access to a resource, must connect his token to the computer and have the transponder in the proximity of the token (see page 7, lines 24-32, figure 4). In a typical scenario, users will keep their transponders in their pockets (e.g. on a key ring) while working on the computer. In this scenario, a transponder represents the "presence" of the associated user so that the system can detect when the user leaves the computer and take protective action (e.g. by blocking access).

1.3 Sometimes the "presence" of several transponders is required (hence "multi-level authentication"; see e.g. page 7, last paragraph, figure 4), for instance those of a "normal" and a "supervising" user.

1.4 The invention means to make such a multi-level authentication method more flexible and more secure.

1.5 The invention is stated to achieve this by enabling the specification and enforcement of access rules such as those depicted in the tables on pages 11 and 13. A rule of specific interest is that users may get access to a computer only when a "supervising user" (such as the chief accountant) is present, too (see page 13, rule 4, and text below the table). The description discusses several scenarios and proposes rules addressing the risks in these situations.

1.6 It is disclosed that "the systems checks for any change in [the] number of transponders [...] within the reception area of [the] token" and that "[i]n case of a change in their number", "new rules [...] may be applied". In other words, it is disclosed that a change in the number of present transponders may trigger the application of a different rule (see page 8, lines 27-29, figure 5, no. 510).

The prior art

2. D1 discloses presence-based computer access control of the type relied upon in the application (see abstract and figure 1). It is also disclosed that the presence of a plurality of transponders (paired with the same "plug") may be required (see paragraphs 23 and 63) and that rules are evaluated before access can be granted (see figure 4). The fact that it requires two crucial actions for a user to obtain access to a resource, namely the insertion of a plug and the presence (and authentication) of an associated transponder, is modelled in terms of state diagrams (see figure 5 and 6 and paragraphs 63 and 64).

Claim construction - what is a "supervising user"?

3. Claims 1 and 8 refer to "a transponder [...] of the supervising user of the first user".

3.1 It is, however, neither claimed nor disclosed how it is determined that a transponder is that of a supervising user. In fact, the claims do not require that this is "determined" at all. Rather, the system administrator may specify that user A is authorised to access a particular resource only in presence of user B because B happens to be the supervisor of A, irrespective of whether this is factually true and, even if so, whether the system administrator retrieved this bit of information from a personnel database or knew it by heart. The invention itself would then only have to check for the presence of A's and B's transponders without also checking the administrative roles of A and B. If B ended up being A's supervisor, the system would not change its behaviour until it was reconfigured to take into account that fact.

3.2 In view of this, the board takes the view that, from the perspective of the claimed system (or method of operating it), the reference to a "supervising user of the first user" is indistinguishable from a mere "second user".

Article 56 EPC

4. The board agrees with the decision under appeal that D1 is a suitable starting point for assessing inventive step.

4.1 D1 does not mention supervising users, let alone disclose that

(a) the rules may require the presence of a "transponder of the supervising user" of another "first" user.

4.2 Also, D1 does not disclose that

(b) different combinations of rules may be applied to different types of resources.

4.3 D1 discloses detecting the events that a transponder appears or disappears from the proximity of the associated plug (see especially paragraph 64), and that the system state changes in response to such events (see figure 6). The board agrees with the examining division that in the different system states diffe­rent access rules apply (see the decision, point 5 of the reasons; page 6, penultimate paragraph); in the inter­mediate state users have no access (yet), in the access state they do. D1, however, does not disclose that

(c) different access control rules are applied based on "a detected change of a number of transponders".

5. Regarding (a), the examining division found this to be the only difference between the then claimed invention and D1 (see the decision, point 4.2 of the reasons).

5.1 As argued above, the board is not convinced that the required presence of a "supervising user" is a feature of the claimed method or system at all, since the administrative hierarchy between the owners of two required transponders need not, according to the claims, be checked by the method or represented in the system.

5.2 If it was assumed, for the sake of argument, that the "supervising user" constituted a feature of the claimed method and/or system, the board would agree with the examining division (see points 4.3 and 4.4 of the reasons) that this was a non-technical difference. The hierarchy between two users A and B can be changed by an administrative act without any impact on the functioning of the claimed system or method of opera­ting it. The board notes that the appellant did not address this aspect of the decision in its grounds of appeal.

6. Regarding (b), the board considers that, in general, it is a non-technical matter to determine, as a security policy, under which conditions an individual user should or should not have access to a specific resource or "type of resources". Evidently, different resources in a system may have different security requirements.

7. Regarding (c), D1 discloses that the access to a system may require the presence of one or more transponders, depending on the required level of security (see D1, paragraphs 23 and 63). For example, a security policy might prescribe that a user be given access to one resource if one transponder is present and to another resource if two separate transponders are present. If both rules were applied simultaneously, and a required transponder were present, the rules governing the user's access might change when another transponder appeared or disappeared.

7.1 The appellant correctly notes (see grounds of appeal, page 4, paragraph 3) that the state diagram depicted in figure 6 only relates to a single transponder. However, the skilled person would know that if the presence of several transponders were required, the state diagram would have to be modified so that the "access state" is only entered once all required transponders are detected and it would return to the "intermediate state" as soon as any one of them disappeared. The board considers that this modification of the state diagram and its implemen­ta­tion would be straightforward for the skilled person.

8. In summary, claim 1 - and, by the same token, claim 8 - lacks inventive step over D1, Article 56 EPC 1973.