Patentability of Computer-Implemented Inventions in the field of Computer Security

Transcription

1 Patentability of Computer-Implemented Inventions in the field of Computer Security Erik Veillas Patent Examiner, Cluster Computers European Patent Office TU München Munich, 21 June 2011 Acknowledgments J. Mäenpää, G.Savvides

2 Agenda 1. Patent Basics 2. Legal framework for Computer-Implemented Inventions 3. Patentable vs non-patentable CIIs in practice 2

3 What is a patent? The fundamental tradeoff of patent law - a social contract full disclosure of a new invention the inventor PATENT an exclusive right granted to the inventor - to exclude anyone else from commercially exploiting the invention - in a territory - for a limited period the society (via the patent office) 3

4 What does a patent application look like? Claims Claim 1: A computer-implemented method for securely entering critical data comprising: - generating a virtual keypad having substantially the same layout of keys as the layout on the keypad, with the keys in a random organization; - prompting the user to enter the critical data per the virtual keypad; -mapping the inputted data from the keys of the keypad memory buffer to the keys of the virtual keypad to determine the critical data entered via the virtual keypad. Full disclosure of what the invention is and how it works Scope of protection applied for 4

5 How to obtain patent protection in Europe? 1. The national route 2. The regional route: European Patent Convention separate procedures for each state procedures differ according to national law one application filed at one office for up to 40 states one centralized procedure, one single final decision regarding patentability applicant selects the desired states results in a bundle of national patents EP DE IT UK DE IT UK There is no such thing (yet) as an EU-patent! IT DE FI TR RO NO 5

6 What happens to a European patent application? withdraw? 0 18 months application filed search results & written opinion publication the invention becomes visible to the competitors! 6

7 7

8 What happens to a European patent application? withdraw? 0 18 months 24 refusal appealable decision application filed search report& Written opinion publication examination grant opposition period starts Claim 1: A computerimplemented method : - Generating...; - Prompting...; - mapping...;; Claim 1: A computerimplemented method - Generating...; - Prompting...; - mapping...;; - encrypting...; - sending...; - repeating..: national validation IE CZ NO y y IT DE R O FI 8

9 Patents - What can be protected? In Europe, patentable matter must be new to the world be inventive (i.e. not an "obvious" solution) relative be industrially applicable have technical character absolute 9

10 Is a claimed invention new? It is new if it distinguishes itself by at least one technical feature from any of the pieces of prior art available. The prior art to be considered must have been made available to the public by means of a written or oral description, by use or any other way before the date of filing/priority. 10

11 Is a claimed invention new? 11

12 Is a claimed invention new? Claim 1. A computer-implemented method for securely entering critical data comprising: -generating a virtual keypad having substantially the same layout of keys as the layout on the keypad, with the keys in a random organization; - prompting the user to enter the critical data per the virtual keypad; - mapping the inputted data from the keys of the keypad memory buffer to the keys of the virtual keypad to determine the critical data entered via the virtual keypad; - whereby the critical data in the memory buffer of the keypad will not reveal the critical data to a malicious keylogger; - whereby the step of generating the virtual keypad is repeated each time the user enters a character. 12

13 Is an (alleged) invention inventive? Problem-Solution Approach Establish closest prior art (single piece of evidence, most often in the form of a patent disclosure or scientific publication) Determine the features of the claim that are known in combination from the closest prior art Determine the distinguishing features of the claim and their technical effects Formulate an "objective" technical problem Decide whether the proposed solution is obvious for the skilled person based on this problem and the state of the art. 13

14 Is our scrambled keypad inventive? Problem Solution Approach: - CPA = - Difference = generation of the scrambled keypad repeated each time the user types a character - Effect = key-logger taking a single screenshot will only obtain an obsolete randomized keypad for most characters - Objective problem = improve protection against key logging malware - Inventive or not inventive? Pointers to solution, etc...? 14

15 Agenda 1. Patent Basics 2. Legal framework for Computer-Implemented Inventions 3. Patentable v. non-patentable CIIs in practice 15

16 "Computer-implemented invention" - CII - an invention whose implementation involves the use of a computer, computer network or other programmable apparatus - computer programs are a form of computer-implemented inventions Guidelines C-IV, distinction software/hardware is not the key point Examples: a software-controlled... - washing machine cycle; - car braking system; T26/86 Koch and Sterzel - multi-touch interface of a smartphone. 16

17 Exclusions from patentability, technical character Article 52(1) EPC: European patents shall be granted for any inventions, in all fields of technology... Article 52(2) EPC: The following in particular shall not be regarded as patentable inventions within the meaning of paragraph 1. a) discoveries, scientific theories and mathematical methods; b) aesthetic creations; c) schemes, rules and methods for performing mental acts, playing games or doing business, and programs for computers; d) presentations of information. Article 52(3) EPC:... above subject-matter or activities only excluded when taken as such! 17

18 Exclusion Subject-matter is not excluded from patentability Subject-matter is excluded from patentability No technical character Technical character Subject-matter At least one feature has technical character => subject-matter has technical character. 18

19 Computer Program - Technical Character? A further technical effect is the result produced, when the computer program is run on a computer, which goes beyond the normal physical interactions between the program and the computer. T1173/97 IBM 19

20 Computer Programs no further technical effect further technical effect auction scheme control of a brake in a car translation between natural languages control administrative rights to access cognitive content game software faster communication between mobile phones secure data transmission (encryption of data) resource allocation in an operating system 20

21 Inventive Step : Adapted Problem Solution Approach Closest prior art : always chosen from a field of technology. Differences : only technical differences between the closest prior art and the claimed subject-matter are relevant. Objective technical problem : no pointers to the technical solution permitted but non-technical aim may appear as a constraint that has to be met. "Where a claim refers to an aim to be achieved in a nontechnical field, this aim may legitimately appear in the formulation of the problem as part of the framework of the technical problem that is to be solved, in particular as a constraint that has to be met." Person skilled in the art : Obviousness of solution determined based on average ability in information technology and knowledge of tall state of the art at filing. T614/00 COMVIK and T172/03 RICOH 21

22 Two specific hurdles for CIIs Devoid of technical character? Art. 52 EPC Inventive step Art. 56 EPC 22

23 Agenda 1. Patent Basics 2. Legal framework for Computer-Implemented Inventions 3. Patentable v. non-patentable CIIs in practice 23

24 Example I: Excluded claim A security policy for controlling a subject's access to an object comprising : defining a clearance level for the subject; defining a security level for the object; determine whether to grant access to the object based on the object's security level and the subject's clearance level. Non-tecchnical process/ aspects Clearly Technical Aspects none 24

25 Example I: The subject matter of the claim defines a model which is purely abstract and devoid of any discernible technical character. The enforcement of an abstract company policy specifying worker's access rights to buildings based on the building's security levels and the worker's clearance levels by (human) security guards who have memorized this policy falls under the scope of this claim. No clear use of technical means is involved. objection under Article 52(1) because the claim constitutes excluded subject-matter in the sense of Article 52(2) & (3) 25

26 Example II: Computer-Implemented access control method A computer-implemented method for controlling a user's access to a computer resource in a network comprising : allocating a clearance level to the user in a memory; allocating a security level to the computer resource in a memory; determine whether to grant access to the computer resource based on the stored user's clearance level and the stored resource's security level; = + security policy 26

27 Example II: Inventive Step Closest prior art: Differences: Requirements specification: Skilled person: Objective technical problem: Solution: computer network (trivial) no technical differences = security policy ("allow access to content acc. to clearance and security level") data processing expert implement said security policy on said computer system implementation/ automation is straightforward. 27

28 Example III: Computer-implemented method of securing the booting of a computer A computer-implemented method for securing the booting of a computer, the method comprising reading all the instructions of a program block involved in said boot computing a first hash value based on said instructions using the following non-linear functions in the respective rounds of the hash algorithm : F = (X and Y) or (( X and Z) G =... a series of mathematical steps... reading a second pre-determined hash value stored in a Trusted Platfrom Module. executing the program block if the computed hash value and the predetermined hash value are equal and interrupting the boot process otherwise. clearly technical aspect A computer implemented method of reading, computing, executing, etc.. prima facie non-technical aspects the series of mathematical steps... Technical interaction? 28

29 Example IV: Real Case T0273/02 Claim wording (somewhat simplified) An IC card connected to a terminal device for transmitting and receiving commands and data, comprising: a memory including a plurality of files each having a plurality of areas; first storage means for storing first access inhibit information relating to the files of the memory; second storage means for storing second access inhibit information relating to individual areas of a file; first inhibiting means for inhibiting a read/write/erase access operation to a specific file and its areas when the access operation to the specific file is inhibited by the first inhibit information stored in said first storage means; and second inhibiting means for inhibiting a read access operation to individual areas of a file according to the second inhibit information stored in said second storage means when the access operation to the specific file is not inhibited by the first inhibit information stored in said first storage means. 29

30 Example IV: Inventive Step Technical character: Closest prior art: Requirements specification: Non-technical differences: Technical differences: Skilled person: Objective technical problem: Solution: yes IC-card with memory including file having areas, access to which was separately controllable. forbid reading of invalidated files at all times because of the sensitive nature of some cognitive data as identified by card issuer the requirement specification access inhibition flag and means at file level (to inhibit read after end-of-life of card) data processing expert implement requirement specification obvious to add appropriate storing means for permissions : simple reprogramming with same type of flags as in CPA but instead dedicated to read access of whole file. 30

31 Summary a priori in the light of prior art objection NO TECHNICAL CHARACTER EXCLUSION Art.52(2),(3) EPC NO DIFFERENCE NOVELTY Art. 52(1), 54 EPC TECHNICAL CHARACTER DIFFERENCE: NOT TECHNICAL OBVIOUS NOVELTY/ INV. STEP Art.52(1) and 54 or 56 EPC INV. STEP Art. 52(1) and 56 EPC TECHNICAL NOT OBVIOUS other requirements? clarity, sufficiency of didisclosure,.. 31

32 Any Questions? Thank you for your attention! 32

33 Further Information Brochure by the EPO: Patents for software? European Law and Practice WIPO: Experts' Study on Exclusions from Patentable Subject Matter and Exceptions and Limitations to the Rights

34 Technical character Implicit requirement of the law : inventions should not be at the level of an abstract idea and should be in a field of technology (implied by Art.52 EPC). Not defined precisely anywhere. Based on "modern" case law, it is automatically conferred by the presence of any type of concrete, physical means ("any hardware approach") or by an involvement in solving a technical problem. absolute requirement. Computer programs may have technical character but do not get some automatically by virtue of the fact that they change the behaviour of a technical device as the exclusion would otherwise be void. 34

35 Case Law HITACHI: T258/03 ( ) Circumventing a technical problem rather than solving it by technical means cannot contribute to the technical character of the subject-matter claimed. Technical Problem: delays in propagation of information between bidders and a server Solution: adapt auction method such that any data transmission delays become irrelevant => this is not a technical solution since it only concerns modification to the rules of the auction. 35

36 Case Law concerning automating a constraint. RICOH: T172/03 ( ) Where the claim differs from the closest prior art only in a mere automation of constraints imposed by the purely non-technical aspects, such automation using conventional hardware and programming methods is considered to be obvious to a skilled person. 36

37 Legal Aspects of Patent Protection A patent entitles its owner to prohibit or license the : production use distribution/ sale by a third party of products/ processes (and their equivalents) falling within the scope of the claims exception: - private use - academic research patent right infringement to be interpreted by national courts Note: A patent does not grant the right to use the invention! 37