Imagine That IP Law Blog

It takes two to tango, and if you are like many of us still working remotely, you may use a two-step identification method for accessing a secure network, such as the Duo Security two-part authentication dance to log onto your remote platform. Well, you might be dancing to something different one day now that the Federal Circuit has upheld validity of a patent owned by Duo competitor CosmoKey. In CosmoKey Solutions, GMBH & Co. KG. v. Duo Security, LLC (Fed. Cir, Oct. 3, 2021), the appeals court reversed a Delaware District Court ruling that CosmoKey’s authentication patent U.S. 9,246,903 was invalid as ineligible subject matter under 35 U.S.C. § 101.

The decision came as Duo moved for a Rule 12(c) Motion for Judgment on the Pleadings to hold the ‘903 patent invalid under 35 U.S.C. § 101, after it was sued by CosmoKey for infringement of the subject patent. The District Court granted Duo’s motion in June of 2020. Under the Supreme Court’s Alice rubric, if a claim is directed to an abstract idea (Step one test), then it must teach, what many see as an ineffable, “something more” than the abstract idea itself. (Step two test). Alice Corp. v CLS Bank Int’l, 573 U.S. 208 (2014). The District Court found that CosmoKey’s claims were directed to an abstract idea and had nothing more than “well-understood and routine, conventional activities previously known in the authentication field.” As a reminder, the first part of the Alice test is to determine whether the claims are directed to an abstract idea, a law of nature or a natural phenomenon (i.e., a judicial exception). If the claims are directed to a judicial exception, the second part of the Alice test is to determine whether the claim recites additional elements that amount to significantly more than the judicial exception.

Now, if you are not a fan of that two-step Alice test, you may be thinking that it sounds at times like a 35 U.S.C. §103 obviousness analysis- not a patentable subject matter question. Certainly not Rule 12(c) dismissal fodder. Here’s claim 1 of the relevant patent. See what you think.

A method of authenticating a user to a transaction at a terminal, comprising the steps of:

• transmitting a user identification from the terminal to a transaction partner via a first communication channel,
• providing an authentication step in which an authentication device uses a second communication channel for checking an authentication function that is implemented in a mobile device of the user,
• as a criterion for deciding whether the authentication to the transaction shall be granted or denied, having the authentication device check whether a predetermined time relation exists between the transmission of the user identification and a response from the second communication channel,
• ensuring that the authentication function is normally inactive and is activated by the user only preliminarily for the transaction,
• ensuring that said response from the second communication channel includes information that the authentication function is active, and
• thereafter ensuring that the authentication function is automatically deactivated.

Here’s how the Federal Circuit majority ruled on the claim. They skipped Alice Step One altogether and decided instead that regardless of whether or not the claim is directed to an abstract idea, it passes Alice Step Two. In the words of the two-to-one majority: “The ‘903 patent claims and specification recite a specific improvement to authentication that increases security, prevents unauthorized access by a third party, is easily implemented, and can advantageously be carried out with mobile devices of low complexity.” The majority seemed to particularly like the “low complexity” language, repeating it multiple times, even though the simplest modern smart phone now has more computing power than the processors aboard the space shuttle. More critically, the court’s assessment that the claim is a “specific improvement” sufficient to pass the Alice rubric was based on what might be seen as self-serving language in the patent specification.” The specification emphasizes the inventive nature of [the claimed] steps.” This rationale is curious, since it is rather typical, after all, for patent drafters to refer to the invention at hand as novel and tout the features in glowing terms.

The dissenting opinion by Judge Jimmie V. Reyna pointed out that under Alice, one can’t just skip Step One, and assume a claim is directed to an abstract idea. “Once a claim is deemed not directed to an abstract idea, the Alice inquiry ends. We do not proceed to step two.” Citing Core Wireless Licensing S.A.R.L. v. LG Elecs., Inc., 880 F.3d 1356, 1361 (Fed. Cir. 2018). “I agree with my colleagues that ‘[t]he ’903 Patent claims and specification recite a specific improvement to authentication that increases security, prevents unauthorized access by a third party, is easily implemented, and can advantageously be carried out with mobile devices of low complexity.’ But this is a step-one rationale. “If a claim is directed to a specific technological solution to a technological problem, it is not directed to an abstract idea.” Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1336 (Fed. Cir. 2016).

It is clear that courts will be dancing the Alice two-step for some time to come. Whether the dance gets any more consistent for practitioners and litigants remains, however, to be seen.