Obviousness

US patent 11387982 describes a method, device, and system for authenticating a hash of a data packet derived from collected context data. The core of the invention lies in: collecting context data (specifically, a captured image represented as a fixed-length string of bits), forming a data packet, generating a hash using a predetermined hash type algorithm (such as a Locality Sensitive Hash (LSH) or fuzzy matching algorithm), sending this hash, and then generating a "hash distance" between the received hash and a predetermined reference hash to perform authentication.

Under 35 U.S.C. § 103, a patent claim is unpatentable if the differences between the claimed invention and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art (POSA). The motivation to combine prior art references often arises from identified problems in existing solutions or from a known design choice to achieve predictable results.

Combination of Prior Art for Obviousness of US11387982 (Claim 1):

A strong argument for obviousness of US11387982, particularly Claim 1, can be made by combining:

1. EP 2 924 603 A2 (Fmr Llc): "Method and system for user authentication based on biometrics, clothes wearing and surrounding scene".
2. US20150096023A1 (Fireeye, Inc.): "Fuzzy hash of behavioral results".

Explanation of Obviousness:

1. Teachings of EP 2 924 603 A2:
EP 2 924 603 A2 discloses a user authentication technique where a client device transmits a captured video signal to a server. This video signal includes "physical user characteristic(s) and a physical object(s)/element(s) in the user environment". The server then analyzes this captured video signal to determine values associated with the visual and audio elements (environment characteristics), computes a total score, and compares this score to a predetermined reference score to decide whether to authorize the user.

The US11387982 patent itself identifies significant drawbacks of EP 2 924 603 A2: it "requires a big bandwidth, namely several Mb, for an upload of the captured video signal" and "the uploaded captured video signal includes information that discloses the user environment and therefore private data".

2. Teachings of US20150096023A1:
US20150096023A1 explicitly teaches the concept and application of "fuzzy hashes" for analyzing "behavioral results". Fuzzy hashing is a known technique where similar, but not identical, inputs produce similar hash values. This allows for detecting variations or similarities between data without requiring exact matches, and importantly, it generates a compact, obfuscated representation of the original data.

3. Motivation to Combine:
A person of ordinary skill in the art (POSA) would be directly motivated to combine the teachings of EP 2 924 603 A2 with those of US20150096023A1 to overcome the acknowledged problems of EP 2 924 603 A2. The patent US11387982 explicitly states the need for an "alternative authentication solution while being more efficient and more secure" than the one described in EP 2 924 603 A2.

The motivation for a POSA would be multifaceted:

• Address Bandwidth Issues: Replacing the transmission of large raw video signals (as in EP 2 924 603 A2) with a compact fuzzy hash (as taught by US20150096023A1) would drastically reduce bandwidth requirements, making the authentication process more efficient.
• Enhance Privacy: Sending a non-plaintext fuzzy hash instead of raw video data would prevent the disclosure of sensitive user environment details, thereby improving data privacy and security.
• Improve Robustness to Minor Variations: Context-based authentication, especially involving images or video, is inherently subject to minor, legitimate variations (e.g., lighting changes, slight object repositioning). Fuzzy hashing (as disclosed in US20150096023A1) is specifically designed to handle such variations, producing similar hashes for similar inputs. This property makes it ideal for enabling "resilience to more or less small changes" in the context, a benefit explicitly highlighted by US11387982.

4. How the Combination Renders Claim 1 Obvious:

Claim 1 of US11387982 comprises the following steps:

• "collecting, based on a predetermined authentication policy, at least one context data element;": EP 2 924 603 A2 teaches collecting a "captured video signal" containing user and environmental characteristics. An "image" is a common form of visual context data and a subset of video data; thus, collecting a captured image (represented as a fixed-length string of bits) as the context data element would be an obvious design choice for a POSA for authentication purposes.
• "constituting a data packet, based on the at least one collected context data element;": The video signal in EP 2 924 603 A2 is inherently constituted into a data packet for transmission. Similarly, a captured image (string of bits) would be formed into a data packet for processing and transmission.
• "generating a hash, by using a predetermined hash type algorithm and the data packet, as input to the predetermined hash type algorithm": Motivated by the bandwidth and privacy problems of EP 2 924 603 A2, a POSA would replace the transmission of raw data with a hash. US20150096023A1 teaches using "fuzzy hashes" for similarity detection. Applying a fuzzy hash algorithm (which are capable of handling varying input sizes like image data and producing fixed-length outputs suitable for comparison) to the image data packet from EP 2 924 603 A2 would be an obvious design choice. The patent US11387982 itself lists various fuzzy hashing algorithms (e.g., LSH, nilsimsa, sdhash, ssdeep) as examples for its "predetermined hash type algorithm," further indicating their known applicability for similarity-based hashing. The concept of a "hash is a byte stream generated from said string of bits representing said captured image" is fundamental to how hash functions operate on digital data.
• "sending the generated hash;": Instead of sending the raw, bandwidth-intensive video signal of EP 2 924 603 A2, the POSA, having generated a fuzzy hash, would send this compact, privacy-preserving hash. This directly solves the identified problems of EP 2 924 603 A2.
• "generating, as a hash distance generation step, a hash distance between the generated hash and a predetermined reference hash;": US20150096023A1 (fuzzy hashes) inherently supports the calculation of a "hash distance" or similarity score between two hash values to determine the similarity of their original inputs. EP 2 924 603 A2 already performs a comparison of a "total score" to a "predetermined reference score" for authentication, so substituting this with a fuzzy hash distance comparison is a logical adaptation.
• "authenticating successfully or not based on the generated hash distance, as an authentication": EP 2 924 603 A2 authenticates based on its score comparison. Authenticating based on a hash distance (e.g., comparing it to a threshold, as further detailed in Claim 2 of US11387982 and conceptually present in EP 2 924 603 A2's score comparison) is the natural outcome of using fuzzy hashes for similarity-based authentication.

Obviousness of Dependent Claims:
If Claim 1 is rendered obvious, then the dependent claims (2-7) also become obvious as they describe either well-known variations or optional features that a POSA would implement as design choices:

• Claim 2 (LSH, score, threshold): EP 2 924 603 A2 already compares a score to a threshold. LSH is a known type of fuzzy hash for generating similarity scores, and comparing such a score to a predetermined threshold for authentication is a standard application of these algorithms.
• Claims 3-6 (sorting, weighting, grouping, ciphering data packet): These are standard data preprocessing and security techniques common in digital data handling. Sorting, weighting, or grouping context data elements (Claim 3, 4, 5) are known methods to normalize data or prioritize certain aspects before hashing to achieve consistent or desired hash outputs. Ciphering the data packet (Claim 6) is a fundamental security practice.
• Claim 7 (HMAC key): Using a Hash-based Message Authentication Code (HMAC) key derivation function for generating an encryption key is a standard cryptographic technique for secure key generation.

Obviousness of System/Device Claims:

• Claims 8, 9, and 10 define the first authentication device, second authentication device, and the authentication system, respectively. If the method itself (Claim 1) is deemed obvious, then the implementation of this method on generic computing hardware, such as a mobile phone (first device) and a remote server or secure element (second device), as described in US11387982, would also be obvious to a POSA. These claims simply recite the physical components configured to perform the obvious method steps.

In conclusion, the combination of EP 2 924 603 A2 and US20150096023A1, driven by the clear motivation to improve bandwidth efficiency, enhance privacy, and provide robustness to minor context changes, would render Claim 1 and its dependent claims of US11387982 obvious to a person having ordinary skill in the art.