T 0283/12 (Mail filtering/STRATO) of 15.2.2018

Summary of Facts and Submissions

I. The applicant (appellant) appealed against the decision of the examining division refusing European patent application No. 07004098.5.

II. The examining division decided that the subject-matter of the independent claims was not an invention within the meaning of Article 52(2) and (3) EPC. It further argued that if the subject-matter of the independent apparatus claim were to be considered as having technical character, it would lack technical novelty over known email systems.

III. The search division had issued a declaration under Rule 45 EPC 1973 to the effect that carrying out a meaningful search into the state of the art had not been possible. The examining division had not performed a so-called additional search (i.e. a search carried out at the examination stage).

IV. In the statement setting out the grounds of appeal, the appellant requested that the decision under appeal be set aside and that a patent be granted on the basis of the documents on file, which were the application documents as originally filed.

V. In a communication accompanying a summons to oral proceedings, the board expressed the preliminary opinion that the objection under Article 52(2) and (3) EPC could not be upheld, but that the subject-matter of claim 1 of the main request lacked inventive step in view of notorious email systems.

VI. By letter of 12 January 2018, the appellant maintained the originally filed claims as its main request and filed first and second auxiliary requests.

VII. In the course of oral proceedings held on 15 February 2018, the appellant withdrew the main and first auxiliary requests, maintained the second auxiliary request as its new main request and filed a new first auxiliary request. At the end of the oral proceedings, the chair announced the board's decision.

VIII. The appellant's final requests were that the decision under appeal be set aside and that a patent be granted on the basis of claims 1 to 10 filed with letter dated 12 January 2018 as second auxiliary request (new main request) or, alternatively, on the basis of claims 1 to 7 filed at the oral proceedings before the board as (new) first auxiliary request.

IX. Independent claim 1 of the main request read as follows (the following text corresponds to the version filed with letter dated 12 January 2018):

"A method of filtering an electronic mail in an electronic mail system (1), the method comprising steps of:

- providing an electronic graph representation of non-content electronic mail related characteristics derived from the history of electronic mail exchange in the electronic mail system (1) in a data base (23), comprising

- providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, and

- generating the electronic graph representation a plurality of graphical vertices assigned the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information and

- assigning to a present electronic mail provided for transmission in the electronic mail system (1) an electronic indicator indicative of a potential abusive mail character of the present electronic mail, comprising:

- parsing the present electronic mail,

- processing parsed information derived from the parsing of the present electronic mail, and

- providing the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base (23),

wherein deriving the electronic mail related characteristics from the electronic mail exchange history comprises a step of analyzing electronic mails handled by at least one node provided in the electronic mail system (1)."

X. Independent claim 1 of the first auxiliary request read as follows:

"A method of filtering an electronic mail in an electronic mail system (1), the method comprising steps of:

- providing an electronic graph representation of non-content electronic mail related characteristics derived from the history of electronic mail exchange in the electronic mail system (1) in a data base (23), comprising

- providing a plurality of electronic pairs of sender and recipient information both related to one electronic mail, wherein the sender and recipient information comprises sender and recipient address, and wherein the sender and recipient address are hashed, and

- generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient address and a plurality of directed graphical edges assigned to the pairs of sender and recipient address, wherein

- the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and

- a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and

- assigning to a present electronic mail provided for transmission in the electronic mail system (1) an electronic indicator indicative of a potential abusive mail character of the present electronic mail, comprising:

- parsing the present electronic mail,

- processing parsed information derived from the parsing of the present electronic mail, and

- providing the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base (23),

wherein deriving the electronic mail related characteristics from the electronic mail exchange history comprises a step of analyzing electronic mails handled by at least one node provided in the electronic mail system (1)."

Claims 2 and 3 of the first auxiliary request were dependent on claim 1.

Independent claim 4 of the first auxiliary request read as follows:

"An electronic mail system (1), comprising:

- a plurality of network stations (5, 6, 7), each having an ability to function as at least one of a sender of electronic mail and a recipient of electronic mail,

- a data base (23) comprising an electronic graph representation of non-content electronic mail related characteristics derived from electronic mail exchange history between the plurality of network stations (5, 6, 7), and

- a filter component (21, 22) connected to the data base (23) and the plurality of network stations (5, 6, 7) and configured to assign to a present electronic mail provided for transmission an electronic indicator indicative of a potential abusive mail character of the present electronic mail, comprising:

- a parsing component (21) configured to parse the present electronic mail, and

- a processing component (22) configured to process parsed information derived from the parsing of the present electronic mail and to provide the electronic indicator indicative of the potential abusive mail character of the present electronic mail by analyzing present electronic mail characteristics derived from the parsed information based on the graph representation in the data base (23),

wherein

- the electronic graph representation of non-content electronic mail related characteristics comprises

- a plurality of electronic pairs of sender and recipient information both related to one electronic mail, wherein the sender and recipient information comprises sender and recipient address, and wherein the sender and recipient address are hashed,

- a plurality of graphical vertices assigned to the sender and recipient address, and

- a plurality of directed graphical edges assigned to the pairs of sender and recipient address, wherein

- the directed graphical edges are originating from a vertex assigned to the sender address and ending at a vertex assigned to the recipient address, and

- a weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address, and

- deriving the electronic mail related characteristics from the electronic mail exchange history comprises a step of analyzing electronic mails handled by at least one node provided in the electronic mail system (1)."

Claims 5 to 7 were dependent on claim 4.

XI. The appellant's arguments presented in writing and at the oral proceedings before the board and as relevant to the decision are discussed in detail below.

Reasons for the Decision

1. The application

1.1 The application relates to the filtering of electronic mail. It proposes a technique for detecting potential abusive electronic mail in an electronic mail system. The main example of "abusive" electronic mail given in the application is electronic spam mail.

1.2 The detailed description on page 7, line 32, to page 9, line 9, describes an embodiment of the invention with reference to the components of an electronic mail system as illustrated in Figure 2. In this system, a parsing component of a mail transfer agent extracts sender and receiver addresses from emails. From these pairs of addresses a weighted directed graph is constructed: nodes correspond to addresses, directed edges between nodes correspond to emails sent in the past from a sender address to a receiver address, and weights of edges correspond to the number of such emails.

The "relationship" between a sender address S and a receiver address R can now be determined by calculating various "arbitrary complex measures" on the basis of the graphs (e.g. whether R and S are directly connected by an edge, or whether there are paths between R and S, the number of such paths, their weights, etc.).

The "total score" of a particular email is "an arbitrary combination of all scores of its sender/recipient pairs". This total score is used as an indicator of the spam status of the email. A high total score suggests that recipient(s) and sender are tightly related, meaning that the email is not spam.

Hence, the invention's spam filter works by determining the total score of (outgoing) emails as a measure of the "tightness" of the relationships between sender and recipients and filtering/blocking the email if the total score suggests that the email is spam.

2. Exclusion from patentability - both requests

2.1 The examining division in its decision considered the subject-matter of the independent claims to lack technical character and thus to be excluded from patentability under Article 52(2) and (3) EPC, even though those claims evidently recited technical features such as "electronic mail", "electronic mail system" and "electronic graph representation".

2.2 Those technical features are still present in the independent claims of the main request and of the auxiliary request. Since it is established jurisprudence that the use of technical means suffices to ensure that subject-matter is not excluded under Article 52(2) and (3) EPC (see, for example, decision T 258/03, OJ EPO 2004, 575), the examining division's objection cannot be upheld.

3. Main request - basis in the application and wording of claim 1

3.1 Claim 1 of the main request is based on a combination of original claims 1 to 3, 5 and 7 and the additional features of original dependent claim 12.

3.2 One of the features of claim 1 reads "generating the electronic graph representation a plurality of graphical vertices assigned the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information".

3.3 At the oral proceedings, the appellant acknowledged that the wording of this feature contained mistakes and proposed that it should be read as "generating the electronic graph representation with a plurality of graphical vertices assigned to the sender and recipient information and a plurality of directed graphical edges assigned to the pairs of sender and recipient information" (underlining added by the board).

3.4 For the purpose of assessing inventive step, the board will read this feature in accordance with the appellant's proposal.

4. Main request - inventive step

4.1 The examining division considered that the subject-matter of the independent apparatus claim, if it had technical character at all, lacked "technical novelty" over a known email system. However, since no prior art under Article 54(3) and (4) EPC 1973 (applicable here) has been cited, the board prefers to consider the question whether the claimed invention makes a technical contribution to the state of the art under the heading of inventive step.

4.2 At the oral proceedings, the appellant attempted to distinguish the subject-matter of claim 1 from the technique of "auto-white-listing" described in paragraph [0011] of the published application. According to this technique, "an electronic mail is considered non-spam if the recipient has sent an electronic mail to the sender in the past". The technique is said to have the weakness that spam senders can forge electronic mails with flipped sender/recipient pairs to trigger the automatic white-listing. It is therefore said to be insufficient to consider only pairs of addresses.

Paragraph [0011] states that this technique is known, and at the oral proceedings the appellant did not dispute this.

4.3 The board considers the known method of detecting and filtering emails as spam in an email system by means of "auto-white-listing" to be a suitable starting point for assessing inventive step for the subject-matter of claim 1. An email system implementing this technique necessarily keeps track of a "history of electronic mail exchange" in the form of a list of pairs of sender/recipient email addresses. If a "present electronic mail" is provided to the system for transmission to the recipient, the system parses the email to extract the sender and recipient email addresses and checks whether this pair of addresses is present in the list. If it is not, the email is considered to be spam and filtered.

4.4 According to claim 1, an "electronic graph representation of non-content electronic mail related characteristics" is derived from the "history of electronic mail exchange". The graph includes vertices corresponding to sender and recipient information, for example in the form of email addresses, and directed edges between vertices corresponding to emails sent in the past from a sender to a recipient. The board notes that email addresses are indeed "non-content related".

4.5 The appellant argued that the list of pairs of sender/recipient email addresses maintained by the "auto-white-listing" technique could not be equated with the electronic graph representation of the claim, as the list was not a "graph representation" including vertices and directed edges.

However, one way of electronically representing a graph consisting of vertices and directed edges is by listing the edges as ordered pairs of vertices. If the vertices correspond to email addresses identifying senders and receivers and the directed edges correspond to ordered pairs of sender and receiver addresses of emails sent in the past, such a listing corresponds precisely to the list of sender/recipient email addresses maintained by the "auto-white-listing" technique.

In this context, the board notes that paragraph [0036] of the published application discloses that the invention's graph data base contains "all past pairs of hashed addresses" and that "[f]iguratively, [these pairs] constitute an electronic graph representation, where each address is a node, and between nodes there are directed edges if and only if in the past a matching pair of addresses, i.e. an electronic mail from the address represented by the first node to the address represented by the second node, has been observed". The application hence acknowledges that the electronic graph representation may take the form of a list of pairs of sender/recipient email addresses.

The board therefore considers that the list of sender/recipient email addresses maintained by the "auto-white-listing" technique falls within the scope of the "electronic graph representation" of claim 1.

4.6 The subject-matter of claim 1 therefore differs from the known email filtering method in that:

- the electronic graph representation is provided "in a data base";

- an "electronic indicator" is assigned to an email identified as being potentially abusive; and

- the electronic mails constituting the "electronic mail exchange history" are "handled by at least one node provided in the electronic mail system".

4.7 In the board's judgment, these differences are obvious implementation details. The list of email addresses has to be kept in a data store, thus forming a "data base". The "electronic indicator" is essentially an internal flag for keeping track of whether an analysed email is to be filtered or not, and the use of flags for keeping track of properties of data objects is well known in the art. Finally, it is an obvious possibility that the emails from which the white list of sender/recipient email addresses is derived are emails that have been handled by a node of the email system.

The appellant did not offer any arguments with respect to these features.

4.8 Hence, the subject-matter of claim 1 of the main request lacks inventive step (Articles 52(1) and 56 EPC).

5. First auxiliary request - basis in the application

5.1 Compared with claim 1 of the main request, claim 1 of the first auxiliary request adds the following features:

- the sender and recipient information assigned to the vertices of the electronic graph representation comprises sender and recipient addresses,

- wherein the sender and recipient addresses are hashed;

- the directed edges of the electronic graph representation originate from a vertex assigned to the sender address and end at a vertex assigned to the recipient address; and

- the weight of an edge is the number of emails between the two nodes of the graph representation assigned to the sender and recipient address.

In addition, the wording discussed in points 3.2 and 3.3 above has been clarified.

5.2 The feature specifying that the email addresses in the graph database are hashed is disclosed in paragraph [0034] of the published application. The feature relating to the weight of an edge is based on paragraphs [0036] and [0044]. The remaining added features are based on original dependent claims 4 and 6.

5.3 Dependent claims 2 and 3 are based on original dependent claims 8 and 9.

5.4 Independent apparatus claim 4 is based on original independent apparatus claim 10 with amendments corresponding to those made to the independent method claim.

5.5 Dependent claims 5, 6 and 7 are based on original dependent claims 11, 15 and 18.

5.6 The board is therefore satisfied that the first auxiliary request complies with Article 123(2) EPC.

6. First auxiliary request - remittal

6.1 As the application explains in paragraph [0034], the email addresses in the graph database are hashed to make them anonymous while preserving the ability to uniquely identify matching addresses later.

The board is not prepared to accept this technical feature as being notorious knowledge, i.e. as knowledge the existence of which at the priority date cannot reasonably be disputed. Since no documentary search into the state of the art has been carried out so far, an additional search has therefore become necessary (cf. decisions T 1242/04, OJ EPO 2007, 241, reasons 9.2; and T 2467/09 of 17 December 2015, reasons 8 and 9).

6.2 The feature specifying that the electronic graph representation also includes, as the weight of a directed edge, the number of emails sent from a sender address to a recipient address now distinguishes the electronic graph representation from the list of pairs of addresses maintained by the "auto-white-listing" technique. At the oral proceedings, the appellant argued that the electronic graph representation as now claimed provided technical advantages not known from the prior art. Since this amendment was made only at the oral proceedings and the board does not have access to the results of a search into the relevant state of the art at the priority date of the application, the board considers it appropriate to leave the assessment of these arguments to the examining division.

6.3 Hence, the case is to be remitted to the examining division for further prosecution on the basis of the first auxiliary request and in particular for carrying out an additional search.

Order

For these reasons it is decided that:

1. The decision under appeal is set aside.

2. The case is remitted to the department of first instance for further prosecution.