T 1029/18 (Carrying out transactions using a mobile phone/MARGENTO R&D) 04-11-2021
Download and more information:
WIRELESS MOBILE TRANSACTION SYSTEM AND THE PROCEDURE FOR CARRYING OUT TRANSACTIONS WITH A MOBILE PHONE
Amendment after summons - exceptional circumstances (no
Amendment after summons - fresh case)
Inventive step - using a mobile device for transmitting transaction data (no
Inventive step - obvious from prior art)
I. This appeal is against the examining division's decision to refuse European patent application No.10751724.5 for lack of inventive step over US 2007/0203792 A1 (D1).
II. The appellant requested that the decision under appeal be set aside and that a patent be granted on the basis of the main or first to fourth auxiliary requests, all filed with the statement of grounds of appeal. The main, third and fourth auxiliary requests corresponded to the refused first, second and third auxiliary requests, respectively.
III. In the communication accompanying the summons to oral proceedings, the Board considered that US 2009/0144161 A1 (D7) was a more suitable starting point for assessing inventive step. The Board came to the preliminary conclusion that, given their vague nature, the distinguishing features did not involve an inventive step (Article 56 EPC).
IV. In a reply dated 28 September 2021, the appellant replaced the previous requests with a new main, first and second auxiliary request and provided arguments in favour of clarity and inventive step.
V. Oral proceedings took place on 4 November 2021 by videoconference. At the end of the oral proceedings the Chairman announced the Board's decision.
VI. Claim 1 of the main request reads:
"A method comprising
starting an application at a mobile terminal (1.1);
establishing (S3.1) a packet data connection between said mobile terminal and a transaction processing center (1.3);
wherein said transmitting of transaction data between said transaction processing centre (1.3) and said transaction terminal (1.2) is either done entirely through said mobile terminal (1.11) [sic], or is done partly through said mobile terminal phone and partly through a data connection established between said transaction terminal and said transaction processing centre, wherein data between said mobile terminal and said transaction terminal is transmitted in accordance with said selected mode of communication;
characterized by:
receiving, at said mobile terminal (1.1), input indicative of a mode of communication between said mobile terminal (1.1) and a transaction terminal (1.2);
if said packet data connection has been successfully established, examining, at said mobile terminal, a security certificate retrieved from a storage element within said mobile terminal for verifying the authenticity of the user and the application, and optionally a PIN number input (S3.3) by a user; and
if the personal user data and the security certificate do not match, notifying the user by an application control module, which generates an acoustical as well as graphical signal which are then presented on the mobile terminal's speaker and screen, respectively, and closing the application (S3.16); or if the security certificate is verified and confirmed, initiating (S3.5) data transfer between the transaction processing centre (1.3) and the transaction terminal (1.2) in at least one direction."
VII. In claim 1 of the first auxiliary request the third feature is limited to the first option for transmitting transaction data "entirely through said mobile terminal".
VIII. The appellant essentially argued that D7 did not mention security certificates and the matching procedure of claim 1 of the main request. Furthermore, the first auxiliary request provided a synergistic effect, i.e. an extra security measure, which was achieved by combining the feature of transmitting the transaction data entirely through the mobile phone with that of checking the authenticity of the application. Regarding the second auxiliary request the appellant held that the claimed acoustic coupling was not known from the prior art, in particular not from D2, and, inter alia, eliminated problems occurring in the transfer of sound-modulated data.
Background
1. The invention concerns a system for making payments using a mobile phone (see Figure 1 of the published application). A merchant enters a payment amount into a POS terminal 1.2 ("transaction terminal" in claim 1). A customer starts a transaction application on his mobile phone 1.1 ("mobile terminal") and enters a PIN. By placing the phone 1.1 near the POS terminal 1.2 transaction data is transferred to a bank 1.3 ("transaction processing centre") - see pages 12 and 13 of the application.
2. The transaction data is transferred from the POS terminal to the bank either over a data connection 1.9 such as TCP/IP (version I), or if the POS does not have an active connection, through the mobile phone over its wireless network 1.5 (version II) - see page 11 of the application. The first auxiliary request is limited to version II. The second auxiliary request further specifies that the transmission of transaction data between the POS terminal and the mobile phone occurs via acoustic coupling.
Admittance of the requests under Article 13(1) and (2) RPBA 2020
3. The present requests were filed after summons to oral proceedings had been issued. Article 13(1) RPBA 2020 states that any amendment to a party's appeal case after it has filed its grounds of appeal or reply may be admitted only at the discretion of the board. Article 13(2) RPBA 2020 further provides that any amendment to a party's appeal case made after notification of a summons to oral proceedings shall, in principle, not be taken into account, unless there are exceptional circumstances, which have been justified by cogent reasons by the party concerned.
3.1 The appellant justified the late filing of the main and first auxiliary request as being a direct reaction to the Board's clarity objections and use of document D7 as closest prior art. The proposed amendments remained within the framework of the embodiments examined by the first-instance and were not detrimental to procedural economy of the appeal proceedings.
The Board accepts this argumentation and, thus, finds the main and first auxiliary request to be filed under "exceptional circumstances" within the meaning of Article 13(2) RPBA 2020 and admits them.
3.2 The second auxiliary request adds the new aspect of data transmission via acoustic coupling, namely "completing error correction procedure, using the redundant data added to the data packet by the mobile transaction terminal". This aspect has never been examined during first-instance proceedings. The appellant argued that the details of acoustic coupling were not known from D2 and referred to passages of the description for its advantages. However, no justification why this amendment should be taken into account by the Board at such a late stage of the proceedings was provided.
If the Board were to admit this request, it would be compelled to either examine this new aspect which is contrary to the primary purpose of second-instance proceedings (i.e. reviewing the contested decision), or to remit the case to the first instance, which would clearly be contrary to procedural economy.
In addition, the amendment introduces further ambiguities. For example, it makes no technical sense that the acoustic modulation signal is reproduced and received by the POS terminal ("acoustically reproducing the acoustic modulation signal received and processed by the terminal"). Also, the feature "the redundant data" is not clear as it has no antecedent.
To conclude, the Board does not recognise "exceptional circumstances" for the second auxiliary request and, thus, using its discretion under Article 13(1) RPBA 2020, does not admit it.
Main and first auxiliary request, Article 56 EPC
4. Claim 1 of the main request defines two options for data transfer. The second option defines that the transmission of transaction data is done "partly through said mobile terminal phone and partly through a data connection established between said transaction terminal and said transaction processing centre" (Board's emphasis).
The Board agrees with the examining division that partitioning of data might involve technical considerations, but that the application does not mention any such considerations. In fact, it only states that one part of the data is transmitted via one data connection and another part via the other data connection. It does, however, not specify how each part is determined which, therefore, must be considered arbitrary.
For this reason, and the fact that the main request encompasses the first auxiliary request, the Board considers it expedient to first examine the auxiliary request for inventive step. Should this request not be allowable, a fortiori neither would the main request.
5. Claim 1 of this request is based on claim 1 of the second auxiliary request, filed with the statement of grounds of appeal. In order to delimit the invention against D7, the appellant rearranged some of the method steps and placed them in the characterising portion of the claim.
5.1 Moving these features up in the claim has introduced ambiguities as for example the terms "said transmitting of transaction data", "said transaction terminal" or "said selected mode of communication" now have no antecedent. Also, if the Board were to interpret the sequence of method steps in a temporal order, in addition of being unclear, they might not be disclosed in the application as filed.
5.2 Furthermore, the procedure for authenticating the user and application is vague to the point of being unclear and open to a number of interpretations. For example, the security certificate might refer to a PIN, personal user data or a conventional digital certificate, however, it is unclear to whom the user or application is being authenticated. The certificate might also refer to code signing, but then again it is not clear how, at the same time, it is used for user authentication. As a further example, neither the personal user data nor its relation to the security certificate are defined. This makes it impossible to establish which, if any, technical effect the (non) matching of this data achieves.
Also the application - see for example page 10, lines 8 to 12, or page 13, lines 23 to 25 - does not shed any light on the technical meaning of the authentication procedure which, thus, remains broad and vague.
6. Ignoring these clarity objections and reading the claim in a technically sensible way, i.e. assuming a conventional PIN or certificate based authentication, the Board judges that it does not involve an inventive step over D7.
6.1 D7 discloses the key aspect of the invention according to claim 1, namely a mobile payment system wherein the transaction data is transmitted from the POS terminal through the mobile phone to the bank - see paragraph [0013].
As shown in Figure 4 and described in paragraphs [0022] and [0023] of D7, the phone 402 interacts, for example using Bluetooth, with an online store 406 (this is considered a transaction terminal) and, presumably using a conventional (packet) data connection, with a payment entity (the issuer authorisation 418). Prior to making a purchase a user opens a mobile wallet application. A POS vendor plug-in 414 transmits a purchase authorisation request to the mobile phone. The wallet application executes a payment authorisation protocol using payment applications on a secure chip of the mobile phone. Finally, if the authorisation is successful (this is implicit), the request is transmitted to the payment entity.
The Board considers that, although not explicitly mentioned, a successful establishment of a (packet) data connection between the mobile phone and the payment entity is also necessary in D7.
6.2 Claim 1 differs from D7 by the following features:
(A) receiving, at said mobile terminal, input indicative of a mode of communication between said mobile terminal and a transaction terminal;
(B) examining, at said mobile terminal, a security certificate retrieved from a storage element within said mobile terminal for verifying the authenticity of the user and the application, and optionally a PIN number input by a user;
(C) if the personal user data and the security certificate do not match, notifying the user by an application control module, which generates an acoustical as well as graphical signal which are then communicated via the mobile terminal's speaker and screen, respectively, and closing the application.
6.3 The Board considers that there is no synergistic relationship between the distinguishing feature (A) and the distinguishing features (B) and (C). The selected mode of communication neither interacts nor has any implications on the subsequent authentication procedure and vice versa. Their contribution to inventive step, therefore, has to be assessed separately and independently from each other.
6.4 The Board agrees with the examining division that an option for selecting a mode of communication is based on user preferences or availability. D7 discloses several communication modes (paragraphs [0018] or [0023]) - to provide a corresponding selection option would be obvious for the skilled person, if required to do so. Thus, feature (A) does not involve an inventive step.
6.5 Features (B) and (C) are somehow related. As outlined above they relate to user and application authentication using a digital certificate, a PIN or personal user data, for example stored on the SIM card of the mobile phone (see second paragraph on page 12 of the application), and a corresponding acoustical and graphical failure notification on the mobile phone.
On the one hand, the Board has no doubts that the sub-features making up features (B) and (C), if taken individually, were well-known in the art before the priority date of the application. D1, for example, discloses storing account information on a SIM card (paragraph [0038]) and D7 mentions the use of a PIN input, which implies a failure notification, and digital certificates for authentication (e.g. in the SSL link) (paragraphs [0013], [0018] and [0023]). It also discloses the execution of a payment authorisation protocol on the mobile phone using payment applications stored on the secure chip. This must include a user authentication step which, bearing in mind the vagueness of the term in the application, can be said to require some sort of certificate.
On the other hand, as mentioned above (see point 5.2), it is not clear whether features (B) and (C) and their sub-features achieve a technical effect going beyond their individual effects. Hence, the Board cannot acknowledge any combinatorial effect which could be taken into account for the assessment of inventive step. The obviousness of the individual features is enough to prove that their aggregation is not inventive. Thus, features (B) and (C) do not involve an inventive step.
6.6 The appellant argued that the feature of transmitting the transaction data entirely through the mobile phone together with the feature of checking the authenticity of the application produced a synergistic effect, namely better security. In the Board's view there cannot be a synergistic effect as the first feature is known from D7 and, therefore, does not enter into the examination for an inventive step.
At any rate, the Board agrees that, by transmitting the transaction data to the server, the mobile phone certainly represents a potential vulnerability. It is, amongst others, for this reason that mobile devices have some security mechanism. In D7 this mechanism is provided by the security chip which stores secure data or payment applications - see paragraph [0023] - and, as set out before, achieves the same effect.
6.7 For the above reasons, the Board concludes that claim 1 of the first auxiliary request, and as a consequence claim 1 of the main request, lack an inventive step (Article 56 EPC).
For these reasons it is decided that:
The appeal is dismissed.