T 1211/10 (Two-channel authentication/ERICSSON) 16-04-2015

Reasons for the Decision

1. The admissibility of the appeal

In view of the facts set out at points I to III above, the appeal complies with the EPC admissibility requirements and is thus admissible.

2. The context of the invention

2.1 The application relates to a two-channel authentication and transaction authorisation method for e-commerce transactions.

2.2 The user conducts an online shopping transaction at a merchant's website using a PC with an Internet connection; see 101 and step 1 in figure 1 and page 10, lines 16 to 20. The user fills a notional "shopping cart" and proceeds to the "check out" point where he/she is requested to enter the number of the mobile phone (103 in figure 1) which he/she intends to use for the authentication and authorisation process (page 10, lines 18 to 23; 203 in figure 2A; page 15, lines 10 to 11). Figure 4 shows an example PC screen on which the user enters his/her mobile phone number.

2.3 The user then receives on his/her mobile phone a WAP push message, sent through the mobile phone operator's PLMN, comprising a hyperlink to a WML contract at the WAP server (see page 11, lines 1 to 4 and 9 to 14; 205 in figure 2A; page 15, lines 12 to 19). Figure 5 shows the screen of the mobile phone displaying the message received at the mobile phone.

2.4 When the user follows the hyperlink, a WML contract representative of the transaction initiated at the PC is displayed on the mobile phone as a WMLScript signText string (see page 11, lines 13 to 19; 206 in figure 2A and 207 in figure 2B; page 15, line 20, to page 16, line 3). The WML contract is shown in figure 6. If the user accepts the terms of the contract, he/she digitally signs it by means of the signText routine with his/her private key securely stored on the mobile phone and transmits it back to the merchant (see page 11, line 19, to page 12, line 2; 208 in figure 2B; page 16, lines 20 to 21).

2.5 The signed contract is forwarded by the merchant to an operator or an "acquirer" or "issuer" for signature verification and archiving of the signed payment contract (see page 12, lines 7 to 10; 210 and 211 in figure 2B, 212 in figure 2C; page 16, line 22, to page 17, line 11). Once the signed contract is verified, the user receives, both on the PC and on the mobile phone (see figure 9), a confirmation that the transaction has been authorised (see page 12, lines 10 to 15; 216 in figure 2C; page 17, lines 18 to 21).

3. The admittance of the requests

The claims according to the main, second and third auxiliary requests are the same as those of the requests upon which the appealed decision was based. The first auxiliary request is a request which was unintentionally withdrawn before the first instance and was re-filed with the statement of grounds of appeal. The fourth to fourteenth auxiliary requests were submitted in reply to the board's summons to oral proceedings and hence, according to Article 13(1) RPBA (Rules of Procedure of the Boards of Appeal; see OJ EPO 2007, 536), the board has a discretion whether or not to admit them into the proceedings. Given that the amendments are not complex and are occasioned by the board's objections under Article 84 EPC 1973 and the board's introduction of two new prior art documents with the summons, all requests are admitted into the proceedings.

4. Clarity, Article 84 EPC 1973

4.1 In the annex to the summons to oral proceedings the board raised objections under Article 84 EPC 1973, regarding the clarity of the claims, in particular against the terms "linking" and "representative".

4.2 The appellant indicated in its letter of 16 March 2015 (page 5, second full paragraph) that the meaning of the term "representative" is that "the second information set is ... representative of the first information set ... enabling the user to recognize that one information set on one device represents the other on the other device".

4.3 Concerning the term "linking", the appellant submitted in the same letter (page 6, first and second paragraphs) that the first and the second information sets are "linked in a sense that they relate to the same transaction in order to enable ... e.g. ... a user interaction with respect to any of the information sets" and that "both information sets are ... linked, e.g. ... via a transaction ID or via a WAP push message with ... [URL] based connection on which the user clicks to enable the linking".

4.4 In the light of the appellant's explanations, the board finds that the claims are sufficiently clear for the purpose of assessing the compliance of the application with the requirements of Articles 52 EPC and 56 EPC 1973.

5. Article 52(2)(c) EPC (methods for doing business, etc.)

5.1 Although the examples given in the description relate principally to commercial applications, in particular to online shopping, the board considers the invention not to fall under the exclusions listed in Article 52(2)(c) EPC. In particular, the board does not accept the reasoning in the appealed decision that the problem to be solved by the computing devices used in the invention is "not a technical problem but a business one"; see point 1.5 of the reasons. The board considers that, contrary to the finding in the decision, the aim of the invention is token-based authentication by means of a mobile phone, which is a technical problem. The particular application context in which this problem is solved, i.e. online shopping, does not detract from the technical nature of this problem.

5.2 The board also does not agree with the statement in the decision that the dependent claims of the then main request "do not introduce any further limiting features not falling under the exclusions of Article 52(2)(c) EPC"; see point 2 of the reasons. In the board's view, the features set out in these claims, which relate to WAP push messages, HTML and WML formatting, digital signatures using a WAP signText script and public key infrastructure (PKI) information are, in the context of this case, not related solely to business activities.

5.3 Consequently the board considers document D3 to be a more appropriate starting point for the assessment of inventive step than the "commonly known technical apparatus [such as] the Internet access device (common PC), a mobile terminal (mobile phone), public mobile network ([GSM]) and the Internet" relied on in the decision; see point 1.11 of the reasons.

6. Document D3

6.1 D3 discloses a two-channel authorisation method using a mobile phone for e-commerce transactions, figure 5 giving an overview of the system implementing the method. The user orders goods from a merchant's online catalogue using a portable computer having an Internet connection ([0060] and [0063]).

6.2 When the user proceeds to the order confirmation process, the merchant system asks for the user's mobile phone number ([0064], first sentence).

6.3 According to one embodiment, disclosed in paragraph [0086], the user then receives a "WML deck (script applet)" on his/her WAP-enabled mobile phone via the WAP push feature. The "applet" contains the order ID and asks the user to confirm the order.

7. The construction of the requests

7.1 Among the requests filed with the statement of grounds of appeal, i.e. the main and first to third auxiliary requests, the claims according to the second auxiliary request set out the invention in the highest level of detail. The fourth and fifth auxiliary requests are based on the second auxiliary request (see the appellant's letter of 16 March 2015, page 2) and were filed by the appellant as alternatives addressing the clarity objections raised by the board (see ibid., page 6, third to fifth paragraphs).

7.2 The sixth to fourteenth auxiliary requests form three groups of three requests, namely the sixth to eighth, ninth to eleventh and twelfth to fourteenth auxiliary requests. Within each group, the claims are based on those of the second, fourth and fifth auxiliary requests, respectively. For instance, the claims of the sixth auxiliary request are based on those of the second auxiliary request, the claims of the seventh auxiliary request are based on those of the fourth auxiliary request and the claims of the eighth auxiliary request are based on those of the fifth auxiliary request. Each group of requests incrementally adds a further feature to the previous group of requests. Consequently, of all the requests on file, the twelfth to fourteenth auxiliary requests set out the invention in the highest level of detail.

7.3 The following assessment of inventive step is based on the twelfth to fourteenth auxiliary requests. Since the board comes to the conclusion that claim 1 of these requests lacks an inventive step, it follows that claim 1 of the higher ranking requests on file does not involve an inventive step either (see point 11 below).

8. The twelfth auxiliary request

8.1 It is common ground between the appellant and the board that the embodiment in D3, [0086] involving the use of the WAP push feature forms the closest prior art.

8.2 According to the appellant, the subject-matter of claim 1 differs from the closest prior art in the following features:

i) the WAP push message sent to the mobile terminal comprises a hyperlink to the contract and not the contract itself.

ii) The contract displayed on the mobile terminal is digitally signed with the private key of the user (i.e. the penultimate step of claim 1, "receiving authentication information ...").

iii) The signed contract is forwarded to a "separate acquirer or issuer or operator server" for verification (i.e. the last step of claim 1, "sending a request for verification ...").

8.3 The appellant argued in the oral proceedings that these difference features solved the problem of improving transaction security.

8.4 Regarding difference (i), the board is not convinced by the appellant's argument that the use of a hyperlink decreases the likelihood of mistakes that can occur during manual entry and thus contributes to transaction security. The appellant interprets D3, [0086] such that an applet is directly pushed to the user's mobile phone. If this is the case, then no manual URL entry is required in D3 and thus no mistake can occur. In the board's view, the effect of this difference is to reduce the volume of data initially transmitted to the mobile phone, which also reduces the initial response time on the second authentication channel. These effects are distinct from and not related to improved transaction security. As discussed with the appellant at the oral proceedings, the board further considers that sending a hyperlink to an information set instead of the information set itself would have been an obvious way for the skilled person to improve the initial response time.

8.5 Regarding difference (ii), the board regards the objective technical problem as providing a cryptographically non-repudiable confirmation of an electronic transaction. This problem is solved, in the language of the claims, by means of authentication information comprising client-side public key infrastructure (PKI) information, e.g. the contract being digitally signed with the user's private key stored on the mobile phone. As indicated to the appellant at the oral proceedings, the board considers this solution to be usual for the skilled person, since public-key infrastructures and the cryptographically non-repudiable nature of the digital signatures they produce would have been known to the skilled person at the priority date of the application (8 November 2001).

8.6 Regarding difference (iii), the application documents do not explain the reason why the merchant server does not verify the signed contract itself, but outsources this task to a separate entity, in particular whether this is due to a legal requirement or for technical reasons. The appellant argued that this measure contributed to improved transaction security by releasing the merchant from the obligation of key and certificate management. The merchant could thus rely on the services of a specialised entity to ensure that the keys used were still valid. The board is not convinced by this argument. In a public key infrastructure the validity of a key is typically ensured by a separate certification authority. If the validation of a digital signature relies on the signer's public key issued earlier, then no interaction with the certification authority is required at this point. Such an interaction may be needed, however, in order to establish that the key certificate has not been revoked. Thus "sending a request for verification" to a "separate [...] authority server" is already obvious over standard PKI architecture. To the extent that "verification of the received authentication information" involves steps not commonly performed by the certification authority, the board first notes that adding a further party to the verification process need not improve the security of the process. Indeed, it may introduce an additional security risk. Adding a further party to the verification process may, however, relieve the merchant server of some of its computational burden, which is obvious since outsourcing computational tasks to other servers is standard practice in the relevant art.

8.7 Therefore the board concludes that the subject-matter of claim 1 according to the twelfth auxiliary request does not involve an inventive step, contrary to Article 56 EPC 1973.

9. The thirteenth auxiliary request

9.1 Claim 1 of the thirteenth auxiliary request differs from that of the twelfth auxiliary request in, besides using a different wording to address the clarity concerns raised by the board in its summons, setting out that the second information set presented on the mobile phone includes a limited amount of information about the transaction compared to the first information set presented on the PC.

9.2 Although D3 does not make any explicit comparison between the amount of information pushed to the mobile phone with the amount of information presented at the PC, where the transaction is initiated, the explicit reference in [0086], last sentence to the fact that the WML applet contains the order ID implies that the other parts of transaction information are not necessarily delivered to the mobile phone. Thus, as was discussed with the appellant at the oral proceedings, the board considers this feature to be implicit in D3. The appellant did not dispute this interpretation of D3.

9.3 Therefore the board finds that the subject-matter of claim 1 according to the thirteenth auxiliary request does not involve an inventive step, contrary to Article 56 EPC 1973.

10. The fourteenth auxiliary request

10.1 Claim 1 of the fourteenth auxiliary request differs from that according to the twelfth auxiliary request in that, besides using a different wording to address the clarity concerns raised by the board in its summons, it sets out the first and second information sets both comprising the name of the merchant and a transaction identifier.

10.2 Although D3, [0086] does not explicitly mention the name of the merchant, the board takes the view that the skilled person reading D3 would understand that the name of the sender of a WAP message, in this case the merchant, would be displayed to the recipient. The WML applet mentioned in the same passage contains the "order ID". The appellant argued, referring to [0078], second sentence, that the "order ID" refers to a particular product in an online catalogue and not to a transaction. The board does not accept this argument in view of the statement in D3, [0078] that the merchant "assigns an order ID" for each product or set of products ordered by a particular customer. In view of the term "assigns", the board finds that the order IDs in D3 are not associated with products but with orders or transactions. The appellant did not challenge this interpretation of D3 when it was discussed at the oral proceedings.

10.3 Hence the board finds that claim 1 according to the fourteenth auxiliary request does not involve an inventive step, contrary to Article 56 EPC 1973.

11. Higher ranking requests

11.1 As the subject-matter of claim 1 of the twelfth auxiliary request is considered not to involve an inventive step, and since claim 1 of the main, first to third, sixth and ninth auxiliary requests is even broader than claim 1 of twelfth auxiliary request, their subject-matter is also considered not to involve an inventive step, contrary to Article 56 EPC 1973.

11.2 Similarly, the subject-matter of claim 1 of the fourth, seventh and tenth auxiliary requests, which is broader than that of claim 1 according to the thirteenth auxiliary request, also does not involve an inventive step, contrary to Article 56 EPC 1973.

11.3 Finally, the subject-matter of claim 1 of the fifth, eighth and eleventh auxiliary requests, which is broader than that of claim 1 according to the fourteenth auxiliary request, also does not involve an inventive step, contrary to Article 56 EPC 1973.

12. The requests with the "archiving feature"

12.1 The appellant requested that the board consider whether any of the foregoing requests in combination with the feature "Operator ... archives signed payment contract" according to step 212 in figure 2C would yield patentable subject-matter.

12.2 The appellant argued that storing a copy of the signed payment contract at the operator could be useful in repudiation disputes (see page 17, lines 10 to 11, of the application) and gave the example scenario in which the merchant tampers with the signed payment contract and the provision of an untampered copy of the contract by a trustworthy third party could be desirable.

12.3 The board finds that this feature is unable to lend inventive step to claim 1 of the foregoing requests, contrary to Article 56 EPC 1973, because the effect of cryptographic non-repudiability is already achieved in the present invention by the use of the digital signature. Digital signatures with private keys are typically implemented by encrypting a hash value of the document with the private key of the signer. Besides being cryptographically non-repudiable, as only the signer is supposed to have access to the private key, this process also assures document integrity, as any later modification to the document would change its hash value and thus invalidate the signature. Keeping an additional copy of the signed document with the operator, apart from any well-known advantage of keeping backup copies of digital files, would not further contribute to the transaction security of the contracts achieved by the digital signature process. Whilst there might be legal reasons for the operator to keep an additional copy of the signed payment contracts, merely fulfilling such legal requirements would not constitute a non-obvious technical contribution (see e.g. T 641/00 - Two identities/COMVIK, Headnote, OJ EPO 2003, 352).

13. The requests for referral of questions to the Enlarged Board of Appeal

13.1 The appealed decision is based on the premise that the invention is merely the implementation of a business method using commonly known technical means.

13.2 The appellant identified a basic line of argumentation in the decision under appeal from which it derived a "new assessment approach" characterising, in its opinion, the "stance being taken by the EPO towards business methods"; see the statement of grounds of appeal, page 5, third paragraph, and page 7, third paragraph. It criticised this approach and requested that the board refer the questions listed at XXI supra to the Enlarged Board of Appeal. The appellant considered answers to these questions to be of fundamental importance in order to assure legal certainty, and expressed its concerns over a "threatening scenario that the new assessment method could be applied to telecom inventions on a wide scale"; see the statement of grounds of appeal, page 20, fourth full paragraph.

13.3 As the board stated in the annex to its summons to oral proceedings, the examining division in the appealed decision had apparently adopted the first of the two approaches generally followed in cases related to a mixture of technical and non-technical features, as summarised by board 3.5.01 in T 756/06 (not published; see point 5 of the reasons), and thus not a "new" one.

13.4 As the board also stated in the annex to its summons, the Enlarged Board in G 3/08 (OJ EPO 2011, 10; see point 10.13.1 of the reasons) could not identify any divergence in the case law on this issue, referring in particular to the pertinent summary in T 154/04 (OJ EPO 2008, 46), in spite of the considerable number of decisions by different boards (see G 3/08, point 10.13.2 of the reasons).

13.5 The appellant then requested that further questions, listed at XXII supra, be referred to the Enlarged Board of Appeal.

13.6 According to Article 112(1)(a) EPC, a condition for a referral to the Enlarged Board of Appeal is that a decision is required in the case before the board in order to ensure uniform application of the law or if an important point of law arises. The answer to the referred question should not be merely of theoretical or general interest. In the present case the board is in no doubt that it is in a position to come to its own conclusion. Furthermore a divergence in the jurisprudence of the boards of appeal was not identified. The questions listed at XXII supra are of mere theoretical interest, since they concern whether it is conceivable that two approaches could lead to diverging conclusions for the same claim. From among earlier questions of the appellant, listed at XXI supra, questions 1 and 2 are based on the appellant's unproven allegation that there is a "new method for assessing inventive step" at the EPO, whilst questions 3 to 7 are not regarded as important points of law, since they concern the appropriateness of an examining division's choice of wording. Thus the requests for referral to the Enlarged Board of Appeal are rejected.