T 1108/13 (CRUM chip/SAMSUNG) of 1.12.2015

Summary of Facts and Submissions

I. The appeal lies against the decision of the examining division, with reasons dispatched on 17 De­cember 2012, to refuse European patent application No. 09 718 117.6. In the decision, reference was made to the document

D1: US 7 246 098 B1,

and claim 1 of the then main request was found to lack novelty over D1. An auxiliary request filed du­ring the oral proceedings before the examining division was not admitted with reference to Rule 137(3) and (5) EPC.

II. Notice of appeal was filed on 18 February 2013, the appeal fee being paid on the same day. A statement of grounds of appeal was received on 29 April 2013, in which the appellant requested that the decision under appeal be set aside and a patent be granted based on claims according to a main or an auxiliary request as filed with the grounds of appeal. The board understands this to be in combination with the description and draw­ings as published.

III. In an annex to a summons to oral proceedings, the board informed the appellant of its preliminary opinion that the claims were novel but did not show an inventive step over D1, Articles 54(1,2) and 56 EPC. The board also raised a number of clarity objections, Article 84 EPC.

IV. In response to the summons, with a letter dated 27 Octo­ber 2015, the appellant filed new claims 1-19 according to a second, third, and fourth auxiliary request and withdrew the pending main and auxiliary requests. Al­though the requests could have been renumbered at this point, the original labelling of the auxiliary requests as "second", "third" and "fourth" was maintained and is therefore used below.

V. Claim 1 of the second auxiliary request reads as follows:

"An image forming apparatus, comprising:

a main body having a main controller to control an operation of the image forming apparatus; and

a replaceable unit mounted in the main body to communicate with the main controller through a serial interface; and

a customer replaceable monitoring, CRUM, chip mounted in the replaceable unit, wherein the CRUM chip comprises:

a memory unit storing a first initialization program different from a second initialization program of the main controller, unique information associated with the replaceable unit and status information on use of the replaceable unit; and

a central processing unit, CPU, connected to the memory unit,

wherein the main controller of the main body is operable to transmit information on use of consumables used in the image forming apparatus to the CRUM chip through the serial interface, and

wherein the CPU of the CRUM chip is operable, by using an operating system, OS, of the CRUM chip, operating separately from an OS of the main controller:

a) to perform initialization of the replaceable unit using the first initialization program which operates separately from an initialization of the image forming apparatus,

b) to perform authentication and cryptographic data communication with the main controller, and to update the status information stored in the memory unit based on the information on use of the consumables transmitted from the main controller."

VI. Claim 1 of the third auxiliary request differs from that of the second by the addition of the following phrase at its end:

"... wherein the first initialization program is configured to calculate secret information required for data communication."

VII. Claim 1 of the fourth auxiliary request differs from that of the second by the addition of the following phrase at its end:

"... wherein the first initialization program is configured to check remaining amounts of toner or ink."

VIII. Oral proceedings were held on 1 December 2015 as scheduled. At their conclusion, the chairman announced the decision of the board.

Reasons for the Decision

The invention

1. The application relates to an "image-forming appa­ra­­tus" (for instance, a printer) equipped with a replace­able unit (such as a toner or ink cartridge) comprising a so-called "CRUM" ("Cus­tomer Re­placeable Unit Monito­ring") unit. The claimed unit is equipped with a chip which enables the host device to monitor the state and to retain some form of con­trol over the replaceable unit. It may, for instance, count the number of pieces of pa­per printed so as to determine the time until the cartridge must be replaced (see page 1, paragraphs [4] and [6]) or it may au­then­ticate the replace­­able unit vis-à-vis the host device.

2. The invention proposes to improve existing CRUM units by providing a "built-in CPU with an operating sys­tem" (pa­ragraph [9]). This is said to make the CRUM unit "more secure" (loc. cit.). It is also disclosed that "[t]he CPU [of the CRUM chip] may perform initia­liza­tion using the OS of the CPU, separately from the main body of the image forming apparatus" (paragraphs [12] and [98]). The application also discloses a number of tasks to be performed by the CRUM unit during initia­li­zation (see para­graphs [95], [103], [142] and [170]). The operating sys­tem it­self is only characte­rised by some of the functions it is to carry out. No specific example of an ope­ra­ting system is disclosed.

The prior art

3. D1 relates to chips running an authentication protocol (hence the term "authentication chips") for validating the authen­ticity of the chip vis-à-vis a host system (see column 1, lines 45-48; column 3, lines 29-43 and column 4, lines 20-49). It is disclosed that such au­then­tication is important in a variety of applications including elec­tro­­nic commerce, communication, smart cards or electro­nic keys (column 1, lines 24-28). More specifically, D1 discloses the use of such chips for the control of "con­su­mables", such as print rolls in came­ras or ink cart­rid­ges in prin­ters (see column 4, loc. cit.).

3.1 In this context, the authentication chips allow cloned consumables to be detected and their use to be blocked, but they are ­­­also equipped with on-board memory to main­tain "state informa­tion" (see column 23, line 46 - co­lumn 24, line 17; column 25, lines 52-54; column 43, lines 12-19; column 69, line 64). The authentication chip is set up to authenticate itself towards the cus­to­mer de­vice (the printer or the camera) by means of an ela­bo­rate proto­col, possibly involving two chips (co­lumn 25, lines 32-48), using encryption, and based on a se­cret which must not leave the chip (see column 22, lines 35-49, and column 23, lines 33-44). It is also expressly stated to be "a trivial matter to extend the protocol" according to the invention "for other uses" (column 1, lines 28-31).

3.2 The authentication chips are "programmable" (see column 62, line 49 f., and column 63, lines 2-3). The "pro­gramming" is carried out in a "Pro­gramming Station" (see column 68, lines 18-20 and 38-40). It is disclosed that manu­fac­ture of the chip does not require any par­ti­cular secu­rity, but that the "programming environ­ment" (or "Pro­­gramming Sta­tion en­viron­ment") must be secure (see e.g. column 67, line 48 et seq.; esp. lines 24-25, 31-32, 57-59, and column 73, lines 6-8).

3.3 The chip is disclosed as having, according to the "Guide­lines of Manufacture", "[b]oot circuitry for loa­ding pro­gram code" (column 69, line 40, and column 72, line 57 et seq.) and to comprise a "state machine, pro­cessor, CPU or whatever is chosen to implement the pro­tocol" (column 69, lines 64-66).

Novelty, Article 54 (1,2) EPC

4. In the decision under appeal, the examining division assumed it to be implicit in D1 that the authen­tication chip and the main controller" had "different OSs" (see reasons 11.1, page 3, 4th bullet point).

4.1 The board notes in this regard that claim 1 of the then main request does not require the CRUM chip to contain an operating system at all, reference only being made to "an initialization program which operates separately from the OS operated by the image forming apparatus".

4.2 However, claim 1 of all three present requests refers to "an operating system [...] of the CRUM chip".

5. The board agrees with the appellant (see grounds of appeal, point 2.11) that D1 does not disclose the authen­tication chip comprising an operating system.

5.1 In particular, the secure programming environment dis­cussed in co­lumns 67 and 68 is not disclosed as being with­in the authenti­ca­tion chip, but rather is under­stood to be part of an external "Programming Station environ­ment" in which the authentication chip is pro­grammed (see column 67, lines 24-25 and 58-59). And the "boot cir­cu­i­try" in the authentication chip "for loa­ding pro­gram code" (col. 69, line 40) is not an "opera­ting sys­tem" either.

5.2 Claim 1 of the main request is therefore already new over D1 by virtue of the CRUM chip operating system.

6. The decision under appeal considered (see reasons 11.1, page 3, 4th bullet point) that D1 disclosed an "initia­li­za­tion pro­gram" carried out on the authentication chip and, in order to establish this, made reference to "the program code [loaded] into Flash memory" (see col. 72, line 61) by a "boot mechanism".

6.1 The appellant challenged this aspect of the decision, ar­guing in particular that the "program code" loaded into memory was not an initialization program and that, hence, "it [could not] be seen that an initialization program is stored in the flash memory" (see grounds of appeal, point 2.6).

6.2 The board agrees with the appellant that the loa­­­ded pro­gram is not itself an "initialization program" and notes that the "boot mechanism" is disclosed as being carried out by "boot circuitry" (see column 69, line 40, and column 72, line 57 et seq.) which "must not be in ROM" in which it "could be modified in an unde­tectable way" (loc. cit.). In the board's view this im­plies and cer­tainly does not exclude that the boot cir­cu­itry is hard-wired. Hence, the boot mechanism is not disclosed as an "initia­lization program" stored in local memory.

6.3 The board thus also agrees with the appellant that D1 does not disclose an initialization program stored in CRUM chip memory (grounds of appeal, 2.9, emphasis by the board).

Inventive step, Article 56 EPC

The second auxiliary request

7. In the board's view, claim 1 of the second auxiliary request differs from D1 by the following features:

a) The CRUM chip has its "own opera­ting system" sepa­rate from that of the main controller.

b) The CRUM chip stores an "initialization program" in the local memory unit.

c) The CRUM chip and the main controller perform ini­ti­alization separately.

d) "[I]nitialization", "authentication and crypto­gra­phic data communication with the main con­troller" and "updat[ing] of the status information stored in the memory unit" are performed under the control of the CRUM chip's own operating system.

Regarding difference d), it is noted that D1 discloses the authentication chip performing "authentication and cryptographic communication with the main con­troller" (column 22, line 29 f.) and "updat[ing] the sta­tus" (co­lumn 43, lines 12-14 and 21-23). With respect to these functions, difference d) only specifies that they are performed under the control of the CRUM chip's own ope­rating system.

8. According to the application, the ope­rating system on the CRUM chip increases security (see paragraph [12]) and, by way of "checking the remaining amount of toner or ink", reduces the "time [it takes] to inform the main con­troller that consu­mables should be replaced" (see para­graphs [95], [97] and [98]).

8.1 The board accepts that these might be advan­ta­ges of the claimed invention over CRUM chips which pro­vide state data in local memory, but are otherwise passive; such CRUM chips are well-known in the art.

8.2 The board disagrees however with the appellant that the provision of a CRUM chip operating system achieves these advanta­ges over D1.

8.3 The system of D1 pro­vi­des an authentication chip which stores secrets that never leave it (see col. 21, lines 33-45) and carries out authentication protocols autono­mously. Hence, the independence of the authentication chip from the host device and the increased security are understood to be achieved even though the authen­tication protocols do not rely on an operating system on the authentication chip. The board does not see how the claimed operating system in general contributes to even further increased security and autonomy.

8.4 Likewise, the provision of a processor on the authen­tication chip separate from the processor of the image forming apparatus enables parallelism between both and therefore could speed up the combined system. This applies, in particular, if the authentication chip checks the remaining amount of toner or ink in parallel to and separate from the main controller on the image forming apparatus. This effect however is indepen­dent of whether or not the authentication chip has its own operating system.

9. During oral proceedings, the appellant argued that the invention - and in particular the CRUM chip operating system - solved the objective technical problem of "im­proving the efficient operation of the image forming apparatus". The board disagrees again. In general, the provision of an operating system, however small or light-weight it may be, consumes memory and computing time rather than saving any. The efficiency of the over­all system is improved by the provision of a separate CPU in the CRUM chip but independently of whether that CPU is equipped with an operating system.

10. The board considers that difference a) is essentially unrelated to differences b) to d), because the authen-ti­ca­tion chip of D1 may provide an "initiali­za­tion" rou­tine without any operating system being present (e.g. in firmware). Having said that, the board con­siders that in the presence of an operating system the existence of an initia­li­za­tion routine would be sugges­ted to the skilled person, in this agreeing with an argument made by the appellant during oral proceedings.

11. Regarding difference a) and in view of the discussion under point 8, the board considers that the provision of an operating system primarily achieves the effects which operating systems are generally known to achieve.

11.1 Operating systems simplify software de­ve­lopment and im­prove the portability of software between platforms by separating hardware-specific code from hard­ware-in­de­­pendent application code. This might enable, for in­stance, the customization of the same kind of authenti­ca­tion chip for several consumer devices by uploading different authentication programs, and thereby reducing manufacturing costs. Operating systems also manage hard­ware resources, for instance those necessary for data communication.

11.2 Just as the advantages of operating system are well-known in the art, so too are their costs: operating systems require additional memory and processing time. The board appre­ci­ates that both resources are precious in smart chips like the authentication chips of D1, but notes that this need not be prohibitive. Operating sys­tems for security chips (such as JavaCard OS or MultOS) were known in the art before the pri­ority date of the present application, in particular for smart cards.

11.3 The appellant, during oral proceedings, did not challenge the fact that smart card operating systems were part of the prior art, although no documentary evidence to this effect is on file. The appellant did however argue that the field of "image forming appara­tus", which was pertinent to the present application, was different from the field of smart cards, so that the skilled person trying to im­prove an image forming appa­ratus was not prompted to consider features known from smart cards. The appellant also argued that smart cards were typically inserted into running systems, i.e. sys­tems that have finished their initialization, whereas the invention was meant to speed up the initia­lization process of the image forming apparatus.

11.4 The board does not accept either of these arguments.

11.4.1 As regards the first argument, the board notes that the focus of D1 is on authentication chips usable in a va­ri­ety of applications. Al­though the applications re­la­ting to printers and cameras are discussed in more de­tail (see e.g. column 4, lines 21 et seq.), it is ex­pressly stated to be trivial to adapt the authen­tica­tion chips for other uses (column 1, lines 28-31), smart card appli­cations included (column 1, line 27). Hence, at least as regards the authenti­cation chips, D1 spe­ci­fi­cally contradicts the appellant's allegation that "image forming apparatus" and smart cards form separate and independent technical fields. Moreover, the focus of D1 on the chips and the sugges­tion that the au­thentication chips of D1 are of the type gene­rally known to be em­ployed in smart cards would be, in the board's view, a clear indication to the skilled person that features of smart card chips such as their opera­ting systems may be rele­vant to the authentication chips in question.

11.4.2 As regards the second argument, the board notes that the claims are limited to specifying that "initializa­tion of the replaceable unit" - and hence of the CRUM chip - "ope­­rates separately from an initialization of the image forming apparatus", which does not require that both ini­tia­lization routines execute in parallel.

11.5 The board therefore considers that the skilled person would, as a matter of course, balance the advantages and disadvantages of equipping the authentication chip according to D1 with an operating system, and would provide such an OS in a specific case if the required resources were considered affor­dable as a usual design trade-off.

11.6 The board therefore concludes that difference a) is in­sufficient to establish an inventive step over D1, Ar­ticle 56 EPC.

12. Regarding differences b) to d), the board first notes that the provi­sion of an initialization program or its sto­rage in the on-board memory in itself (difference b) does not establish an in­ventive step. Assuming that some initializa­tion has to be carried out on the CRUM chip, the board finds it obvious from the autonomy of the authentication chip of D1 that this initialization pro­gram be carried out independently from that of the main controller of the host device (difference c). And, fi­nally, given that the board considers the provision of a CRUM chip operating sys­tem obvious, it is also obvious in the board's view to execute the relevant programs un­der the control of that operating system (difference d).

13. In summary, the board concludes that claim 1 of the second auxiliary request lacks an inventive step over D1 in combination with common general knowledge about ope­ra­ting systems in general and the availability of smart card operating systems in particular, Article 56 EPC.

The third and fourth auxiliary requests

14. The board first notes that neither the calculation of the "secret information" nor the checking of the "re­mai­­ning amounts of toner or ink" by an "initia­li­za­tion program", set out in claim 1 of the third and fourth auxiliary requests, respectively, is necessarily rela­ted to the existence of a CRUM chip operating sys­tem. Both functions could be carried out on an authentica­tion chip according to D1 in the same way whether or not that authentication chip is equipped with an opera­ting system.

15. Turning to the third auxiliary request, the board notes that the calculation of a secret key - which clear­ly qualifies as "secret information" in the sense of the claims - on the CRUM chip may be considered to increase security for two reasons. A secret that is generated externally and has to be loaded into chip memory may leak during the upload process, which is avoided if the chip calculates the secret itself. Moreover, if the chip cal­culates the secret itself, it is arguably possible to have that chip re-calculate the secret if it has been compromised. For both reasons, the board considers it obvious to calculate the secret on the chip itself. The generation of a secret during "ini­tiali­za­tion" is obvious starting from D1 because the se­cret is needed for the sub­sequent communication between the authentication chip and the host system.

16. As regards the fourth auxiliary request, the board con­siders that the checking of the remaining amount of to­ner or ink during "initialization" solves the problem of enabling the image forming apparatus to inform the user in good time that a cartridge should be replaced. The board finds the claimed solution to be obvious how­ever. In a nutshell, it would be obvious to the skilled person that a relevant state of the apparatus must be deter­mined as soon as the user should know about it.

17. In summary, the board concludes that the additional features of the third and fourth auxiliary requests are insufficient to establish an inventive step over D1, Article 56 EPC.

18. There not being an allowable request, the appeal has to be dismissed.

Order

For these reasons it is decided that:

The appeal is dismissed.