T 1160/97 () of 4.7.2001

Summary of Facts and Submissions

I. The opponent filed this appeal against the decision of the opposition division rejecting the opposition against European patent No. 393 896.

II. Claim 1 as granted has the following wording:

"A franking machine including a printing unit (20) for printing franking impressions on mail items; an accounting unit (10) including electronic accounting circuits (12) operative to maintain a record of data relating to values of franking printed by the printing unit (20) on mail items; a secure housing (11) containing said accounting circuits (12); said printing unit (20) being located externally of the secure housing (11) and connected to the accounting circuits (12) by an insecure connection (26); code signal generation means (55) in one of the units (10) to generate a code signal for transmission to the other unit (20) via the connection (26) and comparison means (31) in the one unit (10) to receive from the other unit (20) a returned signal in response to said code signal and to effect a comparison in respect of the code signal and the returned signal and in response to the comparison being unsuccessful inhibiting operation of the one unit (10)

characterised in that the code signal generation means (55) and the comparison means (31) are located with the accounting circuits (12) in the secure housing (11); that the accounting circuits (12) generate a print data signal defining a franking impression of selected postage value to be printed; that encoding means (43) combines the code signal with the print data signal and that the print data signal combined with the code signal is transmitted via the connection (26) to the printing unit (20); said printing unit (20) being operative in response to the print data signal to print a franking impression defined by the print data signal and to return the print data signal and the code signal to the comparison means (31) located in the accounting unit (10); said comparison means (31) being operative to compare the code signal returned from the print unit (20) with the code signal transmitted to the printing unit (20) and to the returned print data signal returned from the printing unit (20) with the print data signal transmitted to the printing unit (20) and being operative to inhibit further operation of the accounting means in response to failure of the comparison."

Claims 2 to 12 are dependent on claim 1.

III. The appellant (opponent) argued essentially as follows:

The contested patent left many questions unanswered as to which technical problem was actually solved, in particular when comparing the subject-matter of claim 1 of the contested patent with the state of the art disclosed in R8 (EP-A-0 018 081). The description of the contested patent cited R8 in its introductory part. Then (column 2, lines 3 to 25), it referred to problems with a common secure housing for both the accounting means and the printer in case of a fault, and concluded that there was a need for reducing the number of occasions when it was necessary to have access to the secure housing, while ensuring that elements which were housed externally of the secure housing could not be operated to cause printing of a fraudulent franking. Claim 1 of the contested patent, however, set out that the (external) printing unit was "operative in response to the print data signal to print a franking impression" (column 8, lines 56 to 58) and "to return the print data signal" (column 9, line 1). Printing of the franking impression was therefore done before a comparison with the returned print data signal was carried out and further operation of the accounting means (not of the printing unit) was inhibited when a mismatch occurred. Only printing line by line and inhibiting both accounting and printing in response to failure of the comparison, which was not specified by claim 1, could give a satisfactory explanation. Moreover, claim 1 did not specify that the printing unit was contained in an insecure housing. Even if it did, it would not be clear how the above mentioned needs were satisfied because, in a franking machine according to claim 1, fraudulent franking could not be prevented if access to the printer was possible. While the contested patent referred to different security measures, the only problem addressed by the features of claim 1 could be that of ensuring the integrity of print data signals received by a print head while it remained connected to the accounting unit (patent specification, column 5, lines 18 to 21, and column 6, lines 9 to 14). Furthermore, Claim 1 did not exclude the possibility of one of the transmitted and return signals being encrypted as in R8 because it did not specify that these signals were identical in form and content and even the description (column 5 of the patent specification) did not require identity of these signals.

Both the contested patent and R8 related to modular systems where an accounting unit and a printing unit were connected by an insecure link. Such systems had to be distinguished from franking machines which included a printer in a secure housing as disclosed in R9 (GB-A-2 194 852). It was generally agreed that R8 constituted the closest prior art and disclosed, in combination, the features of the precharacterising part of claim 1 of the contested patent. In the multidenomination embodiment of R8 (page 10, lines 15 to 21), the number signal, the signal representing the amount of postage, and the reply signal respectively corresponded to the code signal, the print data signal and the returned print data signal of the contested patent. The reply signal in R8, although encrypted, had the same content as the combined code and print data signals in the contested patent. Printing of unauthorized franking was inhibited when a comparator (42) contained in the printing unit (12) indicated a difference between the transmitted and return signals.

However, it was generally known that any franking machine had to fulfil two absolute requirements, ie to prevent printing when tampering with the machine was detected and to prevent the accounting of postage value when franking failed to be carried out. Therefore, in practice, both the printing and the accounting functions would be stopped, as was the case in the contested patent. It merely constituted a routine choice whether the comparison means was placed in the printing unit or in the accounting unit. In both cases, one function could be directly inhibited while the other function had to be inhibited, eg by a signal from the output of the comparison means transmitted via the existing insecure link or via an extra line. The level of security would thereby be decreased. The same was true of the modular system of the contested patent, in particular if the printer were arranged in an insecure housing. The remaining differences set out in claim 1 of the contested patent would automatically disappear once the choice was made to place the comparison means in the secure accounting unit (cf Sketches 1 and 2 attached to the decision under appeal). Since franking was accounted for in the accounting unit, the print data signal was available there and would be combined with the code signal for transmission to the printing unit. In a multidenomination use, it was obvious to generate the print data signal in the accounting unit in order to control the amount of postage to be printed. The use of encryptors (34, 40) in R8 (Figure 1) did not change the content of the return signal and could also be dispensed with if a lower level of security was accepted. The subject-matter of claim 1 of the contested patent thus derived from an obvious choice and consequential modifications which involved no inventive step.

If it were accepted that the contested patent was concerned with a franking machine which only had a single secure housing and elements located externally of said housing, the person skilled in the art would certainly locate the accounting unit, and as need be other elements to which access should be prevented, in the secure housing. With the above technical considerations in mind, the person skilled in the art would locate the comparison means with the accounting unit in the secure housing and arrive at the subject-matter of claim 1 with only obvious modifications of the state of the art disclosed in R8.

R9 (page 1, lines 114 to 119; page 3, lines 40 to 45; claim 11) also directed the person skilled in the art to associate a comparator with the accounting function of a franking machine in that both the accounting function and further printing were inhibited when data relating to the print pattern and data relating to the print operation differed by more than a predetermined limit. Since R9 did not disclose a modular system with an insecure connection, it was left open as to where the comparator would be placed in this case. Nevertheless R9 did suggest arranging comparison means for inhibiting an accounting function together with an accounting unit.

IV. The respondent (patentee) argued essentially as follows:

The patent specification gave a sufficiently clear disclosure of the invention. There was no absolute security with franking machines. Claim 1 related to one aspect of security which was that of ensuring the integrity of print data signals received by a print head. The housing for the printing unit could be either secure or insecure depending on the level of security required.

The appellant's arguments were based on an ex post facto analysis of the prior art. The security of the system disclosed in R8 was provided for the benefit of the postal authorities and configured to prevent the printing of postage without accounting for the same. Therefore, in this system, it was essential to locate the comparison means in a secure printing unit and to encrypt the reply signal so that it was different from, and could not be derived from, the number signal transmitted to the accounting unit (see R8, page 9, lines 3 to 5, and page 10, lines 1 to 10). In view of this teaching of R8, the person skilled in the art had no motivation to move the comparison means to the accounting unit.

Even if the person skilled in the art, deviating from the teaching of R8, had thought of locating the comparison means with the accounting circuits in the secure housing, a binary output signal of the comparison means would then have to be transmitted to the printing unit for activating or inhibiting the printer. With an insecure communication link, fraudulent operation of the printing unit would be easily achieved by applying a binary signal to the printing unit. In view of the teaching of R8, the person skilled in the art would discard such a solution.

The Sketches 1 and 2, to which the appellant referred, were not part of the prior art and gave a false impression of the real differences between the contested patent and the state of the art disclosed in R8. They were not relevant and should not be relied upon. Apart from the different location of the code signal generation means and the comparison means, claim 1 of the present patent specified further differences with respect to R8 which did not automatically follow from the different location of these means. There was no need in R8 for a consequential change of generating the print data signal in the accounting unit and for making the printing unit responsive to the transmitted print data signal to print a franking impression. Moreover, in R8 no signal was returned and compared to the transmitted signal, but the transmitted information was encrypted in the printing unit and in the accounting unit. Returning the same signal would be contrary to the teaching of R8 which required a different, unpredictable signal ("reply signal") to be transmitted to the printing unit. In accordance with the different concept disclosed in R8, the output of the comparison means was connected to inhibit printing, not to inhibit further operation of the accounting unit.

R9 did not disclose a modular system with an insecure connection. Therefore, it could not suggest locating the comparison means in the accounting unit. It was clear from the passages cited by the appellant that the primary aim of R9, like that of R8, was to inhibit further operation of the printer. If any hint could be gathered from R9 as to how to arrange the components of a modular system with an insecure connection, it would be to associate the comparison means with the printer because the comparison indicated an erroneous operation of the printer.

V. The appellant (opponent) requested that the decision under appeal be set aside and that the European patent No. 393 896 be revoked.

VI. The respondent (patentee) requested that the appeal be dismissed and that the patent be maintained.

Reasons for the Decision

1. The appeal is admissible.

2. The subject-matter of claim 1

2.1. Claim 1 (references below are made to the patent specification) specifies inter alia accounting circuits which "generate a print data signal defining a franking impression of selected postage value to be printed" (column 8, lines 49 to 52) and a printing unit (20) which is "operative in response to the print data signal to print a franking impression defined by the print data signal" (column 8, lines 56 to 58). A code signal is generated in the accounting unit and "the print data signal combined with the code signal is transmitted via the connection (26) to the printing unit" (column 8, lines 52 to 56). Comparison means "located with the accounting circuits (12) in the secure housing (11)" (column 8, lines 47 and 48) are "operative to compare the code signal returned from the printing unit (20) with the code signal transmitted to the printing unit" (column 9, lines 3 to 6) "and to (compare) the returned print data signal returned from the printing unit (20) with the print data signal transmitted to the printing unit" (column 9, lines 6 to 9; the word in parenthesis "compare" is missing in line 6 of column 9, but constitutes an obvious correction) and are "operative to inhibit further operation of the accounting means in response to failure of the comparison" (column 9, lines 9 to 11).

2.2. A combined signal is thus transmitted from the accounting unit to the printing unit. Both the "print data signal" and the "code signal" are returned to the accounting unit and compared, in the secure housing, with the corresponding elements of the transmitted combined print data and code signals. This serves the purpose of ensuring the integrity of the data transmitted via the (insecure) connection by checking the transmission of the print data signal and, as an additional security check, of the (eg random) code signal (column 5, lines 18 to 21 and 29 to 36). These security measures are "effective to ensure detection of fraudulent attempts to operate the print head by means of signals applied externally to the print head or drive circuits thereof while the print head remains connected to the meter" (column 6, lines 9 to 14). This presupposes that it is ensured by other means that the printing unit is not disconnected. Otherwise, the transmitted signal could be easily returned by appropriate means to the accounting unit (column 6, lines 9 to 19). Although the introductory part of the patent specification addresses several problems, as pointed out by the appellant, it is clear from the patent specification as a whole that claim 1 sets out the essential features of a solution to the partial problem of ensuring the integrity of the transmitted data against external interfering while the printing unit remains connected (see also column 7, lines 8 to 10).

2.3. In the description of a particular embodiment of the invention, the combined signal is transmitted in the form of data strings comprising print data representing the dot pattern for a line to be printed by the print head and a security code (at a predetermined position within the string) which may, or may not, be printed as well (column 4, lines 7 to 31; column 5, lines 24 to 26 and 33 to 41). Comparison may be carried out in respect of data blocks corresponding to each line, or corresponding to alternate lines, of print data (column 6, lines 2 to 8). A "failure of the comparison" is detected if the comparison means does not find identity of the compared data. In response thereto, "further operation of the accounting means" is inhibited with the additional effect that no further print data signals are generated by the accounting circuits and printing would be terminated (column 5, lines 9 to 17). Claim 1 and the description are thus consistent with respect to printing before comparing, in that one line of the franking impression, or even a single complete franking impression (if all the print data were transmitted at once), may be printed before the comparison is carried out and "further operation" is inhibited.

2.4. Claim 1, construed in the context of the claimed combination and its significance in the contested patent specification as a whole, does not necessarily require absolute identity (in form and content) between the combined signal which is transmitted to the printing unit and its elements (print data signal and code signal) which are returned to the comparison means. But it does require that at least certain parts of both the print data signal and the code signal are checked to ensure the integrity of the transmitted data (cf point 2.2 above). In these circumstances, possible inconsistencies between description (eg patent specification, column 5, lines 45 to column 6, line 1) and claims as granted are to be disregarded as having no effect on the assessment of inventive step.

3. Inventive step

3.1. The parties agree that the closest prior art comprising the features of the preamble of claim 1 is disclosed in R8. Novelty of the claimed subject-matter is not disputed.

3.2. It is also commonly accepted that, in accordance with R8, print data defining a franking impression ("amount of postage") may form part of the "number signal" which is transmitted via the insecure connection (R8, page 10, lines 15 to 21) and that the signal which is returned from the accounting unit (14), the "reply signal", is not the returned number signal but it is the signal which is encrypted in the accounting unit. The comparison means (42) located in the printing unit (12) enables subsequent printing after the authenticity of an unpredictable encrypted signal has been verified in the printing unit, in that it compares the reply signal with the encrypted number signal (R8, claim 1; page 3, line 19 to page 4, line 12; page 7, line 23 to page 8, line 5). These measures ensure that postage printed is accounted for in a system with separable printing and accounting units where it is possible to gain access to an insecure connection and generate signals which would permit unauthorized printing of postage (R8, page 2, lines 12 to 16). In view of these objectives and in accordance with the teaching of R8, the code signal generation means (20) might be placed in either one of the printing or accounting units (R8, page 2, line 17 to page 3, line 11), but the comparison means has to be located in the printing unit because it verifies that authorization for printing has been granted by the accounting unit from the fact that the number signal is encrypted in the same way in the accounting unit as it is in the printing unit (R8, claim 1 and page 3, line 21 to page 4, line 5). In accordance with R8, it is essential that at least the reply signal be an unpredictable encryption of the number signal (R8, page 9, lines 3 to 13, and page 10, lines 1 to 10).

3.3. Locating the comparison means in the accounting unit would therefore be contrary to the teaching of R8 and cannot be considered as an obvious modification of the prior art disclosed in R8. Even if the person skilled in the art had found an obvious reason for modifying the machine disclosed in R8 to the effect that the print data signal were generated in the accounting unit and to place the code signal generation means in the accounting unit (cf R8, page 2, line 17 to page 3, line 11), the number signal (possibly combining the print data signal and the code signal) would still be unpredictably encrypted in accordance with the teaching of R8, before the information contained in the number signal is returned. Furthermore, there is no indication in R8 that, in this case, it would make sense to locate the comparison means in the accounting unit. In R8 (page 9, lines 5 to 9), it is assumed that both the printing unit and the accounting unit are contained in secure housings. Nothing is said in R8, how its teaching could be put into practice with an insecure printer housing.

3.4. The subject-matter of claim 1 of the contested patent is based on a different concept of (merely) checking the integrity of the data transmitted via an insecure connection line and relying on additional security measures. The concept thus covers, and actually prefers, identity of the data signals transmitted to and returned from the printing unit (see points 2.2 and 2.3. above). The subject-matter of claim 1 is thus not rendered obvious by the disclosure of R8.

3.5. R9 does not disclose separable printing and accounting units with an insecure connection. As convincingly argued by the respondent, R9 thus cannot suggest locating the comparison means in the accounting unit nor any solution to the problem of checking the integrity of data transmitted via the insecure connection.

3.6. For these reasons, the subject-matter of claim 1 and that of the dependent claims 2 to 12 of the contested patent is to be considered as involving an inventive step (Article 56 EPC).

4. The grounds on which the opposition was based thus do not prejudice the maintenance of the patent unamended (Article 102(2) EPC).

ORDER

For these reasons it is decided that:

The appeal is dismissed.