T 0181/92 19-04-1996

1. The appeal is admissible.

2. Allowability of the amendments

The Board is satisfied that the patent as amended does not contain subject-matter which extends beyond the content of the application as filed (Article 123(2) EPC).

The amendments to the patent as granted are mainly due to the abandonment of the first embodiment of the invention. The Board finds that the amendments do not cause the scope of protection to be extended (Article 123(3) EPC).

3. Prior art

3.1. The key document in the opposition division's decision is D2. In the course of the appeal proceedings, D13 was admitted by the Board since it appeared to be of sufficient relevance. These two documents will be considered in the present decision.

3.2. However, the Board decides to admit neither the technical opinion by Professor Seitzer nor D14.

Said technical opinion was filed about four years after the opposition period expired, D14 five years after. For documents to be admitted at such an advanced stage of the proceedings they must, in the Board's judgment, be decisive, ie they must prima facie be so relevant as to determine the outcome of the appeal. This is not the case for the technical opinion for the reasons indicated in the Board's communication dated 14 March 1995. In fact, it appears that said opinion supports the Board's interpretation of the prior art documents D2 and D13. Also the additional citations from books in the computer field referred to by the appellant to support said opinion do not add relevant matter. Nor is D14 relevant, as will be explained below.

3.3. The preferred embodiment in D14 is a card, such as a credit card, equipped with a microprocessor. The processor controls, in combination with a card reader, the routines ensuring that the card is handled only by a person identified as the true card holder. Directly after the card has been manufactured a safety code ("Schutz-Code") from a random number generator is written into a PROM cell 13 (see page 10). How the storing process is performed is not said; it is however mentioned that the memory cell is accessible only by means of a "gate" 20 which is destroyed after the code has been written, so that the storing event is unique. When the card is handed over to the user, the same safety code - of which there is a separate record - is tipped in using an external keyboard. The microprocessor looks up the stored code and compares the two numbers. If they match, the user enters a personal code ("persönliches Merkmal") into a further memory cell 14. The access to this cell is by means of another gate 22. This second storing process is explicitly said to be controlled by the microprocessor (page 11). It is also unique since gate 22 is destroyed afterwards; furthermore, after data have been written into a number of other memory cells, a gate 21, controlling the retrieval of data from the first cell 13, is destroyed. The safety code, even if known, can therefore no more be used to enter a personal code.

3.4. The appellant, when relating the teaching of D14 to that of the patent, submits that the personal code described in D14 is the first code (see page 3 of the letter filed 15 July 1995: "Zu diesem Zweck sieht beispielsweise der Anspruch 1 in der neuen Entgegenhaltung vor, daß in dem Merkmalsspeicher das persönliche Merkmal, also der erste Code, nur ein einziges Mal ladbar ist").

The Board has to disagree. The "first code", as the expression is used in claim 1 of the contested patent, is the code stored during the initial execution of the security routine. In D14 the code stored during the initial execution is not the personal code but the safety code.

The Board appreciates that the "first code" of the invention as claimed and the personal code in D14 have the feature in common that they constitute the passwords which have to be entered by the user in order to use the respective equipment, ie to play the radio respectively to perform a bank transaction. However, the function of the codes as part of their associated security routine are apparently completely different. In D14, the storage of the personal code is permitted because the user has identified himself by means of the safety code already present in the PROM. In the invention, no such identification is possible since no code has been stored before the "first code". Thus, interpreted in the way suggested by the appellant, D14 cannot lead to the invention since it is silent on the "initial execution" of the security routine claimed in claim 1. Thus the interpretation of D14, given by the appellant, clearly leads to the judgement that D14, prima facie, is not relevant.

3.5. The Board has on its own motion investigated what the situation would be if the "first code" in the meaning of claim 1 of the contested patent is identified not with the personal code, but with the safety code in D14.

However, the Board notes that also with this interpretation of D14 the "first code" (= safety code) does not in its function correspond to the "first code" of the invention, since the safety code does not constitute the password to be entered in order to use the corresponding equipment; instead, it is used as an authorization for introducing the real password, the "personal code" into the memory. Thus, as to its function the security code according to D14 resembles the factory code according to an arrangement, identified in Figure 2 and the corresponding text of the present patent, for which arrangement, however, no protection is claimed any more. According to that arrangement, the factory code is used as authorization for storage of the password, i.e. the "public code".

Moreover, the Board notes that according to D14 after the entering step of the personal code the gate 21, controlling the retrieval of data from the first cell 13. (where the security code is stored), is not immediately destroyed. Instead, said gate is destroyed after data have been written into further memory cells, the last of them may be the store 17, wherein the first account balance of the client may be written. This delay is because of the nature of the arrangement disclosed in D14 (Figure 2 - a credit card inserted into a device for initializing the card and writing the necessary data concerning a client into the memories of the card). From the description of D14 (page 12, second paragraph) it is understood that in the course of these further writing steps, it would be possible to restart the initializing process by entering the safety code again.

The Board, furthermore, notes that according to the invention after the initial execution of the security routine for storing the first code, the electronic equipment (e.g. a radio) can be immediately enabled by entering a second code matching the first code. This is quite different from the function of the arrangement disclosed in D14, wherein after the storage of a safety code in the factory, the card has to be inserted into a device (probably with the aid of a bank clerk) for storing the personal code (and when necessary additional data of the client), whereafter by inserting the card into a further device (e.g. a bank automat) the combination of the card and the device is enabled (e.g. for a bank transaction) when the personal code is entered again.

Thus, also when interpreting the "safety code" of D14 as the first code, it appears that said document, prima facie, is not relevant.

3.6. Nevertheless, when yet considering the safety code of D14 to be the "first code", it is noted that D14 does not explain how the code is stored, and in particular whether or not the microprocessor is involved. It is merely said that the code is written into a memory cell (page 11). The omission of the explanation is rather conspicuous considering that the following description makes it clear that the processor indeed stores the personal code; it might lead the skilled man to believe that the safety code is written into the cell using non-disclosed, external means.

3.7. Furthermore, even if the skilled man had the idea that the safety code might be stored in the same way as the personal code, ie using the microcomputer, he would still have no clue to the claimed feature that the security routine should include means for distinguishing between the initial execution and all subsequent executions. In D14, the initial execution is different from all subsequent ones in that the gate 20 is still intact, allowing data to be written into the memory cell 13. The present invention, on the other hand, makes no use of gates which must be mechanically destroyed; instead the function of the gate can be said to have been taken over by the computer program.

The appellant has pointed out that claim 1 of the late cited document D14 in fact only mentions the storage of the "personal code" (without mentioning a safety code). Nevertheless, the technical description of the document only relates to embodiments of the arrangement having memories for both the personal code and the safety code, both memories having to be loaded before the device can be properly used. It, therefore, appears that said claim is formulated in said way in order to get a protection which is as broad as possible. In reality the document does not teach in which way the arrangement would be designed when only the "personal code" (without the safety code) would be necessary.

3.8. It is furthermore noted that the appellant has defended the late filing of D14 by stating that the document merely reflects general knowledge.

The Board's view on this issue is the following. Although Article 54(2) EPC does not make a distinction between different kinds of prior art, it is sometimes convenient to refer to "general knowledge" in the meaning of basic facts which are typically found in handbooks. It is true that documents concerning general knowledge are often accepted at a late stage of proceedings. This is because, normally, they merely confirm facts of which there was never any real doubt. Their admission is thus not likely to prolong the proceedings and there is no reason to disregard them under Article 114(2) EPC.

In the present case, however, the Board finds that the teaching in D14 does not represent general knowledge. According to the appellant, it would have been generally known to distinguish between a first code, which is stored in such a way that it cannot be subsequently manipulated, and a further code. This principle is however similar to what is called "the fundamental idea" in D14: to store data in memories which can only be written once and whose content cannot be manipulated or determined externally (page 4, paragraph 3). If the teaching of D14 had actually become general knowledge in the six years between the publication of D14 and the priority date of the contested patent, this would have to be proved by reference to text books.

Such a proof, however, is needless since the Board has come to the judgement that the teaching of D14 is not (prima facie) relevant.

4. Inventive step

Novelty not being at issue, only the question of inventive step requires consideration. As already mentioned, the closest prior art is taken to be D2 and D13.

5. Inventive step with respect to D2

5.1. D2, a document on which all three opponents relied in the proceedings before the opposition division, discloses an electronic security arrangement suitable for blocking all functions of, in particular, a car radio, and in this way rendering it unattractive to thieves. One embodiment comprises a microcomputer equipped with a PROM. A code is stored in the PROM either by the manufacturer or by the user at the time of the purchase. Certain "priority instructions" - stored in the same memory area as the code - ensure that the radio cannot be activated unless a number is entered which is identical with the stored code.

5.2. The parties disagree on the interpretation of certain statements in D2.

The respondent has submitted that the expression "by burning a PROM" (in the original Italian: "mediante bruciatura di una PROM") meant nothing else than the well-known process of storing data into a PROM by "burning" (a conventional term referring to the blowing of diodes in the memory by means of a high current).

The appellant has rejected this interpretation since an ordinary user would not have access to the costly programming equipment needed. The expression "burning" was intended to mean "programming" in a general sense. It was well known that a microprocessor was capable of storing data in a PROM; that this was the case in D2 is clear from the statement that the microprocessor might store in non-volatile memory information about erroneous digits which have been entered by the user.

5.3. In the Board's view, a document should be read as the skilled man would read it. This implies in particular that a document may have to be interpreted to make technical sense, but the interpretation should normally not go beyond that point. The information that a PROM is programmed by burning is in itself comprehensible and needs no further clarification. The appellant's argument that such programming equipment might be too costly in the circumstances may well contain some truth, but it is not a technical consideration. It cannot be required by the skilled man to interpret documents so as to make economical as well as technical sense.

On the other hand, the appellant's argument that the microprocessor in D2 is involved in the storage of some data into the PROM is convincing. D2 is therefore regarded as disclosing only that the code is burnt into a PROM, by any means, but suggesting that, generally, data may be written into the PROM by means of the processor.

5.4. The appellant has further submitted that the processor in D2 is a single-chip computer comprising a PROM area, that this area is accessible only to the processor and that, consequently, the microprocessor would have to be able to distinguish the initial execution from all subsequent ones in order to store securely a code into the PROM. This would follow from the statement in D2 that the code and the priority instructions are stored in the same part of the memory to ensure that any attempt to tamper with the memory in order to change the stored code would modify the instructions in such a way that program execution would come to a halt and the radio would remain blocked.

The Board, however, takes the view that this passage may just as well point in the opposite direction. If the PROM consists of a conventional separate chip it would be possible to remove or destroy it in order to delete the code word; according to D2 this possibility is eliminated since the program instructions necessary for activating the radio are stored in that same chip. If instead, as the appellant assumes, the code is stored in a memory which is in any case inaccessible from the outside, it appears less important to store the instructions in the same area of the memory. Therefore, in the view of the Board, the skilled person would not necessarily interpret D2 as referring to a single-chip microcomputer, and the appellant's conclusions based on this assumption cannot be accepted.

5.5. The outstanding feature of claim 1 is, as the respondent states, that the "security routine" (ie the program controlling the security of the equipment to be protected) contains means for distinguishing between the initial execution of the security routine and all subsequent executions. The amended wording of this feature accentuates the meaning of "initial" as "the very first in the entire lifetime of the security arrangement"; the "initial execution" is a unique event. During the initial execution, a "first code" (password) is stored in the internal memory of the microprocessor in such a way that it is protected from interrogation external to the microprocessor. This is the only time a user may enter a code in the computer without a code check; any further attempt to change the code currently stored - for example by someone trying to activate stolen equipment - will fail without knowledge of the stored code.

This feature is not known from D2, which is silent on the structure of the program routine controlling the microprocessor.

5.6. In order to go from D2 to the invention, two connected technical problems had to be solved. First, the PROM must be adapted in such a way as to be completely inaccessible to the user. The arrangement according to claim 1 solves this problem by employing an internal, protected memory accessed solely by the microprocessor. Second, a way must be found to enter the code word in a secure way such that, if the electronic equipment - such as a radio - is stolen, it should not be possible for the thief to activate the radio simply by replacing the stored code by an arbitrary number. This problem is solved according to the invention by a security routine which is capable of distinguishing between the initial execution and all subsequent executions of the routine, as explained above.

5.7. The appellant has sought to demonstrate that the solution to the first problem is more or less implicitly disclosed in D2. As stated above, the Board is of the opinion that D2 may indeed suggest that the processor should be generally capable of storing data in the PROM. The idea that in particular the codeword should be stored in this way was therefore probably close at hand. This conclusion is supported by the fact that single-chip computers including a PROM area were well known per se at the time the invention was made. Thus the solution to the first problem is regarded as obvious.

5.8. As to the second problem, the appellant has submitted that the solution according to claim 1 was evident since, in D2, there appeared to be no alternative to it. However, the fact that no alternatives existed - if this is a fact - does not necessarily imply that no inventive step was involved: there seems to be no reason why a unique solution might not be non-obvious. Studying D2, the skilled person may have recognised the difficulty of entering the first code in a secure manner but could not, in the Board's view, find any hint how to attack the problem. It should be noted that the skilled person, not being aware of the present invention, could not benefit from the knowledge that a solution actually existed. He may instead have concluded that a computer comprising PROM accessible only to the processor would, in spite of its apparent advantages, be unsuitable for storing the code in the arrangement according to D2. The solution to the second problem mentioned above was therefore, in the Board's opinion, not obvious.

The subject-matter of claim 1 thus involves an inventive step over the teaching in D2.

6. Inventive step with respect to D13

6.1. D13 discloses an anti-theft arrangement for a car which takes advantage of the microprocessor and push-buttons of a built-in, digital radio. On turning the ignition key, the driver has a certain time to input a numerical code (the "code key"); if the code is not entered, the car does not start. According to Figure 2, the microcomputer comprises a microprocessor, RAM and ROM. A personal "code key" (in the original German: "Codeschlüssel") can be entered or changed by the user (page 8). As the Board understands D13, the new code key is only accepted if the user first inputs a combination corresponding to a predetermined "number code" ("Zifferncode"), ie a "first code", which is stored "permanently" ("als Festwert").

Thus, the Board in the teaching of D13 - like in the teaching of D14 (see under 3.5 above) - can see a difference from the teaching of the present patent in that this document suggests two different codes to be used in the security arrangement. According to D13, there is a "number code" to be used as an authorization for introducing the real password or personal code, i.e. the "code key". Thus, apparently the "number code" must be considered as the "first code", since it must obviously be introduced into the memory before the "code key" can be entered. However, according to its function the "code key" (which, apparently, is stored in the memory as a "second code" in an other area of the memory) has to be compared with the "first code" according to the invention, since only this code can enable the arrangement (in this case enable the starting of a car). This is contrary to the invention, according to which the apparatus can be normally operated already after the "first code" has been stored (by entering the correct code once more). Therefore, it appears to the Board that the skilled man, from this starting point, would not even arrive at a problem that would point in the direction of the invention. Yet, when a relationship to the invention has to be found, it appears that the said "number code" has to be considered as the first code, since this is apparently the very first code that must be entered into the memory.

6.2. The appellant and the respondent disagree on the question in which memory the number code is stored: the appellant is of the opinion that it is in RAM - and that this memory is battery-buffered to render it non- volatile - whilst the respondent submits it is probably stored in ROM.

In the Board's view, already expressed in the communication dated 15 February 1994, the most obvious reading is that the number code is stored in ROM. However, since this point is controversial the Board will examine the issue of inventive step with respect to both interpretations of D13. As is shown below, the result will be the same in both cases.

6.3. Assuming first that the "number code" is in ROM, the problem of how to store that code securely using the microprocessor does not even arise since the microprocessor cannot write anything into ROM. There is thus no need for the computer to distinguish between the initial execution and all subsequent ones, as claimed in claim 1. Therefore, with this interpretation of D13 the subject-matter of claim 1 involves an inventive step.

6.4. Assuming instead that the "number code" is in battery- buffered RAM, the skilled man had to devise a way of writing the code into memory. Since the RAM is intended for use with the microcomputer the skilled man might consider providing a program segment defining the storage operation. D13 does not disclose in which way the "number code" is entered but mentions (on page 8) that in order to change the code key (not the number code) the user must press a certain button. This passage arguably suggests that the number code could be entered in the same way, for example using a subroutine to which the program jumps on receiving an interrupt signal. Such an arrangement, however, would have the evident drawback that if anybody is free to store or change the "number code" at any time simply by pressing a button, there is no security at all. Thus, the problem remains how to enter a code initially. This problem is the same as the one the skilled man encountered in connection with D2 (see points 5.6 and 5.8. above). Again, the solution according to the invention is not suggested by the prior art. It, therefore appears that D13, like D2 requires that said problem must have a solution: the skilled man, noting that D13, however, does not offer a teaching to said problem (in case the "number code" is taken to be stored in RAM) may well have concluded that this basic assumption was wrong and that said "number code", in fact, was stored in ROM.

7. It follows that neither D2 nor D13 renders the subject- matter of claim 1 obvious. The Board thus finds that it has not been shown that the grounds for opposition mentioned in Article 100 EPC prejudice the maintenance of the patent.