CosmoKey asserted U.S. Patent No. 9,246,903 against Duo in the U.S. District Court for the District of Delaware, alleging infringement.  The District Court found the patent's claims to be ineligible under 35 U.S.C. § 101 because they were directed to an abstract idea and lacked an inventive concept.  On review, the Federal Circuit reversed, and provided a small glimmer of clarity illuminating the ever-elusive contours of the "inventive concept."

The Claimed Invention

Two-factor authentication is the current state-of-the-art when it comes to providing secure remote access to information and software applications.  In short, a user first registers their mobile device with an authentication entity.  When the user remotely logs on to a secure site (e.g., with a userid and password), the authentication entity transmits a challenge to the registered mobile device.  The user then either responds to this challenge (e.g., with a second password or some other form of identity verification), or provides information from the challenge (e.g., a numeric code) into the secure site.  If the provided credentials are correct, the user gains access to the site.  Doing so allows the authentication entity and the secure site to verify the user's identity in two ways -- based on what they know (the userid and password) and the devices to which they have physical access.

The '903 patent purports to improve on these procedures by having the secure site maintain an authentication function that is normally inactive.  When a user attempts to log in, the authentication function is activated for a short period of time.  During this period of time, the user must cause their mobile device to transmit a message to the authentication entity.  Advantageously, this does not require the user to enter credentials.

According to the '903 patent, this "provides an authentication method that is easy to handle and can be carried out with mobile devices of low complexity [and] it is a particular advantage of the invention that the mobile device does not have to have any specific hardware for capturing or outputting information." 

Claim 1 of the '903 patent recites:

A method of authenticating a user to a transaction at a terminal, comprising the steps of:
    transmitting a user identification from the terminal to a transaction partner via a first communication channel,
    providing an authentication step in which an authentication device uses a second communication channel for checking an authentication function that is implemented in a mobile device of the user,
    as a criterion for deciding whether the authentication to the transaction shall be granted or denied, having the authentication device check whether a predetermined time relation exists between the transmission of the user identification and a response from the second communication channel,
    ensuring that the authentication function is normally inactive and is activated by the user only preliminarily for the transaction,
    ensuring that said response from the second communication channel includes information that the authentication function is active, and
    thereafter ensuring that the authentication function is automatically deactivated.

The Patent-Eligibility Test

In Alice Corp. v. CLS Bank Int'l, the Supreme Court set forth a two-part test to determine whether claims are directed to patent-eligible subject matter under § 101.  One must first decide whether the claim at hand involves a judicially-excluded law of nature, a natural phenomenon, or an abstract idea.  If so, then one must further decide whether any element or combination of elements in the claim is sufficient to ensure that the claim amounts to significantly more than the judicial exclusion.  But elements or combinations of elements that are well-understood, routine, and conventional will not lift the claim over the § 101 hurdle.  While this inquiry is generally carried out as a matter of law, factual issues can come into play when determining whether something is well-understood, routine, and conventional.

Last year, the Federal Circuit provided a major clue as to how to think about part two of Alice in practice.  In Dropbox Inc. v. Synchronoss Techs. Inc. the Court wrote that "an inventive concept exists when a claim recites a specific, discrete implementation of the abstract idea where the particular arrangement of elements is a technical improvement over the prior art."  This suggests that in order for a claim that is otherwise directed to an abstract idea to be successful under § 101, it should have three qualities: specificity, a technical solution that it provides, and some degree of novelty.  More particularly, there should be a nexus between these three qualities -- specificity, technical character, and novelty should appear in the same claim element or at least be explicitly linked in some fashion in the recitation of the claim.

District Court Proceedings

In the District Court, Duo moved for judgment on the pleadings under Rule 12(c), alleging that "the claims are directed to the abstract idea of authentication and do not recite any patent-eligible inventive concept."  The District Court granted the motion.

Applying part one of the Alice test, the District Court agreed with Duo, finding the claims focused on "the verification of identity to permit access to transactions."  Based on Federal Circuit precedent, the District Court concluded that authentication, in and of itself, was an abstract idea.

Applying part two, the District Court found that the claims and the specification merely taught generic computer functionality to carry out this abstract idea.  Particularly, the District Court wrote that "the detection of an authentication function's activity and the activation by users of an authentication function within a pre-determined time relation were well-understood and routine, conventional activities previously known in the authentication technology field."

Federal Circuit Majority Opinion

The Federal Circuit acknowledged that it had previously found claims directed to authentication to be abstract.  But the Court also noted that it had "held claims directed to specific verification methods that depart from earlier approaches and improve computer technology eligible under § 101."

Considering the District Court's part one analysis, the Federal Circuit disagreed with that body's characterization of the invention.  Instead, the Court opined that "the claims and written description suggest that the focus of the claimed advance is activation of the authentication function, communication of the activation within a predetermined time, and automatic deactivation of the authentication function, such that the invention provides enhanced security and low complexity with minimal user input."  However, the Court further noted that it need not resolve the tension between its view of the claims and that of the District Court, because the claims met the requirements of part two.

The Court centered its attention on the purported technical advance -- that the invention provides authentication using low-complexity processes and devices.  In view of this, the claims "recite a specific improvement to authentication that increases security, prevents unauthorized access by a third party, is easily implemented, and can advantageously be carried out with mobile devices of low complexity."  Moreover, the Court found that the invention solved a technical problem in the field of computer networks using steps that were not conventional -- notably, the last four steps of claim 1.

Thus, given the posture of the case -- a 12(c) motion for which all reasonable inferences are to be drawn in favor of CosmoKey -- the Court ruled that the claims as interpreted through the specification recite an inventive concept that goes beyond any alleged abstract idea therein.  Consequently, the Federal Circuit reversed the District Court's § 101 ruling.

Judge Reyna's Concurrence

Judge Reyna concurred with the majority's decision to reverse the District Court, but took issue with how the majority focused on part two of the Alice test without completing part one.  He believes that doing so violates the premises set forth in Alice.  In detail, he wrote:

Step two is rendered superfluous and unworkable without step one.  Without the benefit of a step-one analysis, we are hobbled at step two in reasonably determining whether additional elements transform the nature of the claim into a patent-eligible application of the abstract idea.  And by skipping step one, we create a risk that claims that are not directed to an abstract idea might be deemed to "fail" at step two.

This disagreement over whether step one is necessary or otherwise guides the exercise of step two is somewhat surprising.  As we have noted in a previous analysis, the Court actually looks for the same factors in both step one and step two -- novelty, specificity, and a technical character.  Thus, the Alice test is better thought of as a one-part affair with these three factors than having two distinct components.  In view of this, and in contrast to Judge Reyna's position, whether the eligibility evaluation takes place under part one or part two does not matter -- the outcome should be the same.

Judge Reyna's own Court is responsible for any confusion in the application of Alice.  It has had over seven years to interpret and set forth a clear set of guidelines for the § 101 inquiry.  But it has not.  Until this changes, arguments over what questions should be asked in each part of Alice are likely to continue.

In the mean time, this case reiterates the notion that a clearly established and specifically claimed technical improvement over the prior art is an inventive concept.

CosmoKey Solutions GmbH v. Duo Security LLC (Fed. Cir. 2021)
Panel: Circuit Judges O'Malley, Reyna, and Stoll
Opinion by Circuit Judge Stoll; concurring opinion by Circuit Judge Reyna