CosmoKey v. Duo Security: Skipping Step One of the Alice Test

Have you ever used dual verification to sign into a device? If so, you might be familiar with Duo Security, a software company that specializes in multi-factor authentication. Recently, Duo Security made headlines in the intellectual property world when CosmoKey, a much smaller securities company, sued it for patent infringement. 

The patent in question claimed a method for multi-factor authentication. Usually, when you need to authenticate your identity, a code gets sent to your mobile phone, which you then enter to sign into your account. But the new CosmoKey method is allegedly easier. Instead of waiting for a code—or, in my case, impatiently requesting a new code when the old one doesn’t arrive quickly enough—the CosmoKey patent allows the user to go into an app on their mobile device and temporarily switch on the authentication feature when they want to sign in. No codes or waiting needed.

When accused of infringing the patent, Duo Security offered a simple defense of its actions: CosmoKey’s authentication method was patent-ineligible subject matter under the Alice test. Established by the Supreme Court, the Alice test is a two-step process to evaluate whether an invention has sufficiently transformed an abstract concept to become viable for a patent. In the first step of Alice, a court determines if an invention “is directed to a patent ineligible concept,” like a law of nature or abstract idea. For those patents focused on ineligible concepts, the court then moves on to step two, where it assesses whether the invention “amounts to significantly more” than a mere claim over that ineligible subject matter. Only those abstract concept-directed inventions that significantly transform the ineligible subject matter may receive patents. For example, the Alice test (and statutory law prior to Alice) would not permit Benjamin Franklin to obtain a patent on electricity, despite his daring kite venture, since electricity is a naturally occurring phenomenon. However, it would allow Thomas Edison to receive a patent on the light bulb because he used electricity to create a device that lights up a room. 

Of course, Benjamin Franklin and Thomas Edison’s encounters with electricity came long before the establishment of the Alice test. The Supreme Court made the Alice decision in 2014, and it has since disproportionately impacted software patents. Under Alice, courts tend to rule that if software is directed towards an abstract idea, converting that idea into computer code does not transform it enough to warrant a patent. This can present a challenge for a company in the software industry. After all, if small businesses cannot prevent competitors from infringing upon their software, what’s to stop a tech giant from putting hundreds of its programmers to work developing essentially the same ideas? 

In CosmoKey v. Duo Security, the district court delivered what has become a common post-Alice software ruling. The court found that CosmoKey’s patent covered ineligible subject matter; the invention was directed towards an abstract concept—authentication—and merely taught a computer to execute this task. Upon appeal, however, the Federal Circuit applied the Alice test differently. It was “not convinced” by the district court’s finding that CosmoKey’s patent centered around authentication, suggesting that the patent was instead directed towards “the activation of the authentication function.” The Federal Circuit panel could have next considered under Alice’s first step whether this activation process qualified as an abstract concept. But Judge Stoll, delivering the court’s opinion, wrote: “We need not answer this question…because…the claims satisfy Alice step two.” Since CosmoKey’s technique improves existing authentication methods through easy implementation and heightened security, the court viewed the patent as constituting significantly more than the idea of authentication or authentication processes. Therefore, the Federal Circuit overturned the initial ruling and determined that CosmoKey’s authentication method was patent-eligible.

The ruling in CosmoKey raises important questions for the intellectual property world. Will more courts follow the Federal Circuit’s example and avoid answering the first question in Alice? And, if so, what implications might that have for software patents? The future remains uncertain, but CosmoKey offers software developers a glimmer of hope.

If you have any questions, please contact us.