T 0405/24 (Correlating network-threat indicators/CENTRIPETAL) 30-09-2025

1.1 MAIN REQUEST (PATENT AS GRANTED)

Claim 1 as granted comprises the following limiting features (outline based on the one used in the decision under appeal):

1. A method comprising:

1.1 receiving, by a packet-filtering system

configured to filter packets in accordance with

a plurality of packet-filtering rules

corresponding to a plurality of network-threat

indicators, a plurality of packets;

1.2 identifying packets comprising unencrypted

data,

1.2.1 wherein one or more packets, of the packets

comprising unencrypted data, comprise data

configured to establish an encrypted

communication session between a first host and

a second host;

1.3 determining identified packets comprising

unencrypted data that correspond to at least

one of the plurality of the network-threat

indicators;

1.4 generating, based on the plurality of

packet-filtering rules, log data of the

identified packets comprising unencrypted data

that correspond to at least one of the

plurality of the network-threat indicators;

1.5 identifying packets comprising encrypted data;

1.6 correlating, based on the log data of the

identified packets comprising unencrypted data

that correspond to at least one of the

plurality of network-threat indicators, packets

comprising encrypted data that correspond to

at least one of the plurality of network-threat

indicators;

1.7 routing, by the packet-filtering system,

filtered packets to a proxy system based on a

determination that the filtered packets

comprise data that corresponds to at least one

of the plurality [of] network-threat

indicators.

1.2 Claim 1 - added subject-matter (Articles 100(c) and 123(2) EPC)

1.2.1 The board agrees with the opposition division and the respondents that granted claim 1 contains added subject-matter. Feature 1.7 bears no limitation in respect of the type of "filtered packets" being "routed" to the "proxy system".

Original claim 7, cited by the appellant as providing basis for this feature, rather discloses that the one or more "network-threat indicators" comprise a domain name and that the "packet-filtering system" is configured to route the one or more of the packets to the "proxy system" based on a determination that at least one of the first host or the second host corresponds to the domain name (board's emphasis). The action of "routing" in the original context (see Fig. 3A, step #9) thus relates to packets comprising unencrypted data (or copies thereof) being sent from "host 106" to "host 142". Those packets are "redirected" to proxy 112 instead. However, once the "SSL/TLS" connection between host 106 and proxy 112 is established (see Fig. 3B, step #17) and the subsequent packets comprise encrypted data, the packet-filtering system does not perform any further "routing" or "redirection". Rather, as indicated in Reasons 27 of the decision under appeal, those packets comprising encrypted data are just either "logged" or "dropped" (see Fig. 3B, steps #19 and #27 and paragraphs [37] and [46] of the application as filed).

1.2.2 The appellant argued that "routing filtered packets to a proxy system" in the context of claim 1 was to be broadly construed, i.e. it should not be narrowly interpreted as "network-layer routing" only. Rather, it should include any kind of "sending", "forwarding" or "logging". The unit "RG1" in step #19 of Fig. 3B at the very least "forwarded" to the proxy device "PD1" those packets (comprising encrypted data) which were not "dropped" but "logged". Thus, when applying the conclusions of G 1/24, i.e. in particular that the description and the drawings shall always be "consulted" to interpret a claim, to the present case, the skilled person in the field of data communications would have understood that such "forwarding" was providing a basis for the "routing" action of feature 1.7. In other words, as the appellant argued, if multiple technically sensible interpretations of a certain claim feature exist, the one which is supported by the patent description should prevail.

1.2.3 This argument is flawed right from the outset. First, even if the Order of the G 1/24 (related to assessing compliance with Articles 52 to 57 EPC only) could indeed be extrapolated to the assessment of compliance with Article 123(2) EPC, there is no indication in G 1/24 that "consulting" or "referring to" the description and drawings could translate to adopting a claim interpretation which ensures that the disputed feature is originally disclosed and thus necessarily complies with Article 123(2) EPC. Such an approach which inherently assumes that there may be only one "correct" interpretation of a claim feature, namely the one derivable from the original description as its intended meaning (which is apparently advocated e.g. by T 367/20-3.2.03, Reasons 1.3.9 and 1.3.16 in the event of "mutually exclusive" interpretations or by the recent decision T 2048/22-3.3.02, Reasons 1.2.1 and 1.2.2 in the case of claim ambiguities), would not lead to an objective assessment of compliance with Article 123(2) EPC and thus jeopardise legal certainty. It would be tantamount to interpreting a claim feature such that, in the end, virtually no violation of Article 123(2) EPC within the meaning of the

well-established "gold standard" could arise. Rather, there is a significant body of case law holding that all technically reasonable interpretations of a disputed claim feature are to be taken into account when assessing compliance with Article 123(2) EPC (see e.g. T 945/20-3.4.02, Reasons 2.4; T 470/21-3.3.05, Reasons 2.1; T 2034/21-3.3.04, Reasons 11; T 193/22-3.3.06, Reasons 3.5).

Second, even assuming arguendo that the "forwarding" of logged packets (comprising encrypted data) to the proxy device "PD1" in step #19 constituted a specific instance of the more general "routing filtered packets to a proxy system", this would still fail to justify the claimed generalisation, which also encompasses, inter alia, network-layer routing of filtered packets not being necessarily logged.

1.3 Thus, the ground for opposition under Article 100(c) EPC in conjunction with Article 123(2) EPC prejudices the maintenance of the patent as granted.

2. AUXILIARY REQUESTS 1 TO 7 AND 9 TO 15

Claim 1 of each of auxiliary requests 1 to 7 and 9 to 15 differs from claim 1 as granted, inter alia, in:

1.7' routing, by the packet-filtering system, filtered

packets comprising encrypted data to a proxy system based on a determination that the filtered packets comprise data that corresponds to at least one of the plurality [of] network-threat indicators [auxiliary requests 1 to 5, 7, 9 and 10].

1.7" routing, by the packet-filtering system, the

filtered packets to a proxy system based on a

determination that the filtered packets comprise

data that corresponds to at least one of the

plurality [of] network-threat indicators [auxiliary requests 6 and 11].

On the other hand, feature 1.7 remains unamended in claim 1 of each of auxiliary requests 12 to 15.

2.1 Claim 1 - added subject-matter (Article 123(2) EPC)

2.1.1 None of features 1.7, 1.7' and 1.7" reflects the original disclosure in respect of "routing" of packets (see point 1.2 above).

2.1.2 It follows that auxiliary requests 1 to 7 and 9 to 15 (labelled "Auxiliary Request 1" to "Auxiliary Request 7" and "Auxiliary Request 8" to "Auxiliary Request 14") are not allowable under Article 123(2) EPC, either.

3. AUXILIARY REQUEST 8

Claim 1 of auxiliary request 8 (labelled "New Auxiliary Request 2a") differs from claim 1 as granted in the following:

- feature 1.6 explicitly requires, inter alia, "correlating the packets comprising encrypted data with one or more packets comprising unencrypted data previously determined to comprise data corresponding to at least one of the plurality of network threat indicators" (board's emphasis),

- feature 1.7 requires "routing (...) filtered packets being the determined identified packets, to a proxy system based on the determination that the filtered packets comprise unencrypted data that corresponds to at least one of the plurality of network-threat indicators" (board's emphasis).

3.1 Admittance into the appeal proceedings (Article 12(6), first sentence, RPBA)

3.1.1 Auxiliary request 8 (labelled "New Auxiliary Request 2a") was filed as "auxiliary request 2a" during the oral proceedings before the opposition division and was not admitted into the opposition proceedings for being late-filed and, inter alia, not being prima facie compliant with Article 123(2) EPC.

3.1.2 In accordance with Article 12(6), first sentence, RPBA, the board shall not admit requests, facts, objections or evidence which were not admitted in the proceedings leading to the decision under appeal, unless the decision not to admit them suffered from an error in the use of discretion or unless the circumstances of the appeal case justify their admittance.

3.1.3 The board holds that the opposition division correctly exercised its discretion not to admit this claim request, for the following reasons:

(a) First, the opposition division assessed, inter alia, "prima facie allowability" of auxiliary request 8, which is a well-established criterion as regards admittance considerations in first-instance proceedings.

(b) Second, the opposition division's finding that the objections under Article 123(2) EPC regarding feature 1.6 of claim 1 still applied (see the decision under appeal, Reasons 45) was not unreasonable. Even when reviewing the opposition division's assessment in substance, the board in fact agrees with this objection as anticipated in its preliminary opinion on the main request and further confirmed after discussion during the oral proceedings before the board. This is because, contrary to the original application, feature 1.6 does not specify with which other data the "packet comprising encrypted data" are actually correlated and it cannot be implied that the "packet comprising encrypted data" should be necessarily correlated with the (previously identified) "packets comprising unencrypted data corresponding to the network-threat indicators". As with feature 1.7 (see point 1.2.2 above), the appellant's arguments rooted in the application of G 1/24 fail to convince the board that the application as filed discloses feature 1.6 in its breadth.

3.1.4 The board sees therefore no reason to overrule the opposition division's discretionary decision.

3.2 Consequently, the board did not admit auxiliary request 8 (labelled "New Auxiliary Request 2a") into the appeal proceedings (Article 12(6), first sentence, RPBA).

4. AUXILIARY REQUEST 2b

Claim 1 of auxiliary request 2b (labelled "New Auxiliary Request 2b") likewise differs from claim 1 as granted in further limitations to features 1.6 and 1.7. In particular:

- feature 1.6 also requires, albeit with a wording different from the one of claim 1 of auxiliary request 8, "correlating the packets comprising encrypted data with one or more packets comprising unencrypted data previously determined to comprise data corresponding to at least one of the plurality of network threat indicators" (emphasis added),

- feature 1.7 also requires, with a wording slightly different from the one of claim 1 of auxiliary request 8, that the "filtered packets" comprise "unencrypted data" (emphasis added).

4.1 Admittance into the appeal proceedings (Article 13(2) RPBA)

4.1.1 The claims of auxiliary request 2b (labelled "Auxiliary Request 2b") were filed after notification of the board's communication under Article 15(1) RPBA. Hence, the admittance of this request is governed by Article 13(2) RPBA, according to which any amendment to a party's appeal case is, in principle, not taken into account, unless there are exceptional circumstances, which have been justified with cogent reasons by the party concerned.

4.1.2 As to the admissibility of auxiliary request 2b, the appellant submitted that the opposition division had concluded that the auxiliary requests on file had been caught in an "inescapable trap" between the requirements of Articles 123(2) and (3) EPC. Thus, the appellant had no guidance or instructions as to how to amend the claims in appeal. Nor did the appellant know how the board would interpret claim 1 or which objections would apply. It was thus necessary to hear the board before making further amendments. Only during the oral proceedings did the appellant learn how the board interpreted feature 1.6. Besides, claim 1 of auxiliary request 2b was clear and overcame what had been discussed about feature 1.7, since there was now a clear limitation to packets comprising "unencrypted data".

4.1.3 In the board's view, the above are no "cogent reasons" justifying "exceptional circumstances":

(a) First, the question of added matter in connection with features 1.6 and 1.7 had been discussed exhaustively already in the opposition proceedings. The board has neither denied nor confirmed the opposition division's stance on the existence of an "inescapable trap" because it had and has no bearing in the examination of the appeal. Yet, however adverse the opposition division's conclusions, the appellant could have filed auxiliary request 2b already during the opposition proceedings. Second and indeed decisively, the board at no point has deviated from its preliminary opinion during the oral proceedings before the board. It may well be that the appellant has better understood the board's position as a result of the debate that took place during the hearing. But this is the very purpose of every hearing, rather than an "exceptional circumstance". If the appellant's position was correct, every substantive discussion during an oral hearing could qualify as an exceptional circumstance in that it allowed a party to obtain a better understanding of the board's position, even if identical to the one as expressed in the preliminary opinion. If at all, the opposite is true: A change of opinion of the board due to a better understanding of a party's arguments during an oral hearing may be a legitimate reason for a party to react. Third, it is not the board's duty - particularly in inter partes proceedings - to provide any kind of "guidance or instructions" to the parties about how to best defend their respective cases.

4.2 Thus, the board did not admit auxiliary request 2b (labelled "New Auxiliary Request 2b") into the appeal proceedings (Article 13(2) RPBA).

5. Since there is no allowable claim request on file, the appeal must be dismissed.