Prosecution Insights
Last updated: October 02, 2026
Application No. 18/862,104

MEDIUM ACCESS CONTROL LAYER SECURITY IN HANDOVERS

Non-Final OA §102§103
Filed
Oct 31, 2024
Priority
May 02, 2022 — nonprovisional of PCTIB2022054051
Examiner
DOUGLAS, MICHELE CAMILLE
Art Unit
Tech Center
Assignee
Telefonaktiebolaget LM Ericsson
OA Round
1 (Non-Final)
75%
Grant Probability
Favorable
1-2
OA Rounds
1y 1m
Est. Remaining
99%
With Interview

Examiner Intelligence

Grants 75% — above average
75%
Career Allowance Rate
9 granted / 12 resolved
+15.0% vs TC avg
Strong +43% interview lift
Without
With
+42.9%
Interview Lift
resolved cases with interview
Typical timeline
3y 0m
Avg Prosecution
14 currently pending
Career history
43
Total Applications
across all art units

Statute-Specific Performance

§101
3.7%
-36.3% vs TC avg
§103
67.0%
+27.0% vs TC avg
§102
24.8%
-15.2% vs TC avg
§112
2.8%
-37.2% vs TC avg
Black line = Tech Center average estimate • Based on career data from 12 resolved cases

Office Action

§102 §103
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Information Disclosure Statement The information disclosure statement submitted on 10/31/2024, has been considered by the examiner and made of record in the application file. Claim Rejections - 35 USC § 102 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. (a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention. Claims 1-4, 6-7, 12-14 and 17-23 are rejected under U.S.C. 102(a)(1) as being anticipated by Ulrike Meyer "Secure Roaming and Handover Procedures in Wireless Access Networks" (2005-12-20), hereinafter Meyer). Consider Claim 1, Meyer discloses a method of operating a user equipment (UE), comprising: receiving a handover command for a handover of the UE to a target network entity; and (section 3.2 page 87, after detecting a handover reason and generating an ordered list L of candidate destination networks, HN (anchor network) sends a handover request to the first candidate destination network DEST1. The handover request includes the identities of MD (UE), HN, and DEST1, as well as the security context S1 (see figure 3. 12)). in response to the handover command, performing one or more actions related to Medium Access Control (MAC) layer security for communication between the UE and the target network entity. (Section 3.2 page 88, upon receipt of the handover request, DEST1 decides whether to accept or refuse the handover request. During this decision process, DEST1 checks, e.g., whether it has the free capacity to serve MD (UE) or whether it is still in good standing with MD's HN. DEST1 answers HN with a positive or negative handover response. If the handover response of DEST1 is positive, HN and DEST1 enter the security-mechanism negotiation phase (2) (see figure 3.12). Section 1.2.2.7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer (see figure 1.6 i.e. (MD) attach to (NAP-EIPE) (access point)). Consider Claim 2, Meyer disclose the method of claim 1, wherein the one or more actions comprise at least one of the following: activation of encryption/ciphering of the MAC layer; deactivation of encryption/ciphering of the MAC layer; continuation of encryption/ciphering of the MAC layer in the target network entity without MAC security updates; continuation of encryption/ciphering of the MAC layer in the target network entity with MAC security updates; activation of integrity protection of the MAC layer; (section 1.2. 2. 7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer). deactivation of integrity protection of the MAC layer; continuation of integrity protection of the MAC layer in the target network entity without MAC security updates; and continuation of integrity protection of the MAC layer in target network entity with MAC security updates. Consider Claim 3, Meyer discloses the method of claim 1, wherein the handover command comprises a Radio Resource Control (RRC) message. (Section 7. 3. 2 . 3 page 191, the UMTS standard avoids this weakness in that the lifetime of the keys IK and CK is restricted by an HN-set threshold on how much data may at most be protected with the same key pair. This threshold is stored on USIM and checked every time a Radio Resource Connection (RRC) is released. If a new RRC is established and the threshold was reached during the last RRC, a new authentication and key agreement are initiated. For more details on this mechanism (See figure 8. 8 )). Consider Claim 4, Meyer discloses the method of claim 3, wherein the RRC message is an RRCReconfiguration message including an information element (IE) ReconfigurationWithSync. (Section 7.3 2. 4 page 191, on connection establishment, MD sends its security capabilities, i.e., a list of all encryptions (IE) and integrity-protection mechanisms it supports to FN. After successful authentication of MD, FN's MSC decides which mechanisms MD and RNC are allowed to use and sends a list of allowed mechanism pairs to RNC). Consider Claim 6, Meyer discloses the method of claim 1, wherein the handover command includes an indication of the one or more actions to be performed in response to the handover command. (Section 5.1 page 148, the handover-command message is integrity-protected with the integrity-protection key IK o and the integrity-protection mechanism imo (see R-8). Upon receipt of a handover command message MD checks whether the current lifetime of the initial security context T exceeds Tr Mo. If this is the case, MD drops the connection). Consider Claim 7, Meyer discloses the method of claim 6, wherein the indication comprises one or more of a UE configuration, an information element, and a parameter for the one or more actions. (Section 5.1 page 149, if Nego2 consists of more than one element, MD and HN may negotiate which of them to use after handover in the security-mechanism negotiation phase (3). MD may then inform DEST of their negotiation result in the security-mechanism negotiation phase (4) during the association). Consider Claim 12, Meyer discloses a method of operating a target network node for a handover of a user equipment (UE) from a source network entity associated with a source network node to a target network entity associated with the target network node, the method comprising: (Section 9. 4. 3 page 224, a new authentication is performed whenever a subscriber enters a UMTS cell that is a border cell to a GSM part of the network. If the newly generated keys are UMTS keys, MD and the 3G MSC convert them into a GSM key Kc using c3. The MD and the serving 3G MSC store this key until the actual handover to GSM takes place. Upon handover to GSM, the source MSC transfers the key to the destination MSC, which in turn forwards it to the base station). receiving a handover request from the source network node, the handover request comprising Medium Access Control (MAC) layer security information; and (section 3.2 page 87, after detecting a handover reason and generating an ordered list L of candidate destination networks, HN (anchor network) sends a handover request to the first candidate destination network DEST1. The handover request includes the identities of MD (UE), HN, and DEST1, as well as the security context S1 (see figure 3.1. 2)). in response to the handover request, determining an indication to be transmitted to the UE in the handover command, the indication indicating one or more actions to be performed by the UE for MAC layer security; and (Section 3.2 page 88, upon receipt of the handover request, DEST1 decides whether to accept or refuse the handover request. During this decision process, DEST1 checks, e.g., whether it has the free capacity to serve MD (UE) or whether it is still in good standing with MD's HN. DEST1 answers HN with a positive or negative handover response. If the handover response of DEST1 is positive, HN and DEST1 enter the security-mechanism negotiation phase (2) (see figure 3.12). Section 1.2.2.7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer (see figure 1.6 i.e. (MD) attach to (NAP-EIPE) (access point)). transmitting a handover command to the UE, the handover command comprising the indication. (Section page 88, if the negotiation with a destination network DEST2 was successful, HN finally selects DEST2 as the destination network for the first-order handover (DEST2= DEST) and sends a handover command to MD commanding handover to DEST). Consider Claim 13, Meyer discloses the method of claim 12, wherein the one or more actions comprise at least one of the following: activation of encryption/ciphering of the MAC layer; deactivation of encryption/ciphering of the MAC layer; continuation of encryption/ciphering of the MAC layer in the target network entity without MAC security updates; continuation of encryption/ciphering of the MAC layer in the target network entity with MAC security updates; activation of integrity protection of the MAC layer; deactivation of integrity protection of the MAC layer; continuation of integrity protection of the MAC layer in the target network entity without MAC security updates; and continuation of integrity protection of the MAC layer in target network entity with MAC security updates. (Section 1.2. 2. 7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer). Consider Claim 14, Meyer discloses the method of claim 12, wherein the handover request comprises an XnAP Handover Request message. (Section 3.2 page 88, MD derives K1 from Ko by means of the key-derivation function kdo, while DEST receives K1 as part of the security context S1 included in the handover request. After successful association and key establishment, DEST sends the handover complete message (XnAP) to HN). Consider Claim 17, Meyer discloses the method of claim 12, wherein the source network entity comprises a source cell associated with a source network node, and wherein the target network entity comprises a target cell associated with a target network node. (Section 9 4. 3 page 224, a new authentication is performed whenever a subscriber enters a UMTS cell that is a border cell to a GSM part of the network. If the newly generated keys are UMTS keys, MD and the 3G MSC convert them into a GSM key Kc using c3. The MD and the serving 3G MSC store this key until the actual handover to GSM takes place. Upon handover to GSM, the source MSC transfers the key to the destination MSC, which in turn forwards it to the base station). Consider Claim 18, Meyer disclose the method of claim 12, further comprising: in response to the handover command, receiving from the UE transmitting a random access (RA) preamble, and in response to the RA preamble, transmitting a Random-Access Response (RAR) to the UE; and (section 6.1 page 170, Upon inter-system handover, MD changes the access technology when switching from one network access point to another. MD is equipped with several wireless interfaces and switches from sending and receiving user traffic over one interface to sending and receiving data traffic over another interface. An inter-system handover can take place between different networks of one network provider or between different network providers). in response to the RAR, receiving a MAC layer msg3 including a handover complete message from the UE. (Chapter 3 page 65, during a handover procedure the mobile device of the user switches from a (MAC layer) connection with one NAP (the source NAP) to another one (the destination NAP). The source and the destination NAP belong to the same wireless access network and are connected to the same backbone. Section 3. 1. 1. 1 page 72, in a hard handover procedure, HN typically keeps resources (for example, a channel) allocated for MD until it receives a handover complete message from the destination network, indicating successful handover. MD can fall back to its old NAP in HN if it is still in its range. As soon as MD is successfully associated with DEST, DEST sends a complete handover message to HN). Consider Claim 19, Meyer discloses the method of claim 18, wherein the RAR comprises a MAC Control Element (CE) that is integrity protected and/or encrypted. (Chapter 5 page 144, in our network-initiated handover procedures, the handover-command message sent from HCN to MD is integrity-protected and in our mobile-initiated handover procedures, the handover-indication message is integrity-protected (R*-8). The security-context transfer from HCN to DESTk is sent over an encrypted and authenticated channel (R*-7). In the case of SCT with key derivation, the key-derivation functions used fully meet R*-2 and meet R*-3 in part). Consider Claim 20, Meyer discloses the method of claim 18, wherein the MAC layer msg3 is integrity protected and/or encrypted. (Section 2. 1. 2 page 42, MD and EIPEFN use a key-establishment process key (see Def. 1.2.9) to derive the data-protection keys (EK, I K) from the master key K. MD and EIPEFN subsequently use these keys as input to an encryption mechanism em (Def. 1.2.4) or an integrity-protection mechanism im (Def. 1.2.7) to protect their MAC layer connection). Consider Claim 21, Meyer discloses the method of claim 18, further comprising: in response to the MAC layer msg3, receiving a contention resolution MAC control element (CE) that is integrity protected and/or encrypted. (Section 2. 1. 2 page 42, MD and EIPEFN use a key-establishment process key (see Def. 1.2.9) to derive the data-protection keys (EK, I K) from the master key K. MD and EIPEFN subsequently use these keys as input to an encryption mechanism em (Def. 1.2.4) or an integrity-protection mechanism im (Def. 1.2.7) to protect their MAC layer connection. During connection establishment upon roaming, MD and FN have to negotiate the roaming authentication protocol ra, the roaming key-agreement protocol rka, and the cipher suite (ke, em, im) to use). Consider Claim 22, Meyer discloses a method of operating a source network node for a handover of a user equipment (UE) from a source network entity associated with the source network node to a target network entity associated with a target network node, the method comprising: (Section 9. 4. 3 page 224, a new authentication is performed whenever a subscriber enters a UMTS cell that is a border cell to a GSM part of the network. If the newly generated keys are UMTS keys, MD and the 3G MSC convert them into a GSM key Kc using c3. The MD and the serving 3G MSC store this key until the actual handover to GSM takes place. Upon handover to GSM, the source MSC transfers the key to the destination MSC, which in turn forwards it to the base station). transmitting a handover request to the target network node, the handover request comprising Medium Access Control (MAC) security layer that enables the target network node to determine one or more actions to be performed by the UE for MAC layer security. (Section 3.2 page 88, upon receipt of the handover request, DEST1 decides whether to accept or refuse the handover request. During this decision process, DEST1 checks, e.g., whether it has the free capacity to serve MD (UE) or whether it is still in good standing with MD's HN. DEST1 answers HN with a positive or negative handover response. If the handover response of DEST1 is positive, HN and DEST1 enter the security-mechanism negotiation phase (2) (see figure 3.12). Section 1.2.2.7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer (see figure 1.6 i.e.(MD) attach to (NAP-EIPE) (access point)). Consider Claim 23, Meyer discloses the method of claim 22, wherein the one or more actions comprise at least one of the following: activation of encryption/ciphering of the MAC layer; deactivation of encryption/ciphering of the MAC layer; continuation of encryption/ciphering of the MAC layer in the target network entity without MAC security updates; continuation of encryption/ciphering of the MAC layer in the target network entity with MAC security updates; activation of integrity protection of the MAC layer; deactivation of integrity protection of the MAC layer; continuation of integrity protection of the MAC layer in the target network entity without MAC security updates; and continuation of integrity protection of the MAC layer in target network entity with MAC security updates. (Section 1.2. 2. 7 page 24, if the EIPE coincides with the NAP, the key establishment, encryption, and integrity protection are implemented on the MAC layer. In the other case, the encryption and integrity protection have to be implemented above the MAC layer). Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or non-obviousness. This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention. Claims 8 and 11 are rejected under U.S.C. 103 as being unpatentable by Ulrike Meyer ("Secure Roaming and Handover Procedures in Wireless Access Networks" (2005-12-20), hereinafter Meyer) in view of HE et al. (US 20220167399 A1, hereinafter HE). Consider Claim 8, Meyer disclose the method of claim 1, further comprising: in response to the handover command, initiating a random-access (RA) procedure with the target network entity according to a RA configuration included in the handover command (section 6.1 page 170, Upon inter-system handover, MD changes the access technology when switching from one network access point to another. MD is equipped with several wireless interfaces and switches from sending and receiving user traffic over one interface to sending and receiving data traffic over another interface. An inter-system handover can take place between different networks of one network provider or between different network providers). upon reception of the RAR generating a MAC layer msg3 including a handover complete message and transmitting the msg3 to the target network node. (Chapter 3 page 65, during a handover procedure the mobile device of the user switches from a (MAC layer) connection with one NAP (the source NAP) to another one (the destination NAP). The source and the destination NAP belong to the same wireless access network and are connected to the same backbone. Section 3. 1. 1. 1 page 72, in a hard handover procedure, HN typically keeps resources (for example, a channel) allocated for MD until it receives a handover complete message from the destination network, indicating successful handover. MD can fall back to its old NAP in HN if it is still in its range. As soon as MD is successfully associated with DEST, DEST sends a complete handover message to HN). Meyer disclose the claimed invention but fail to teach wherein the RA procedure comprises the UE transmitting to the target network entity a RA preamble, starting a timer, and while the timer is running receiving a Random-Access Response (RAR) from the target network node; and. However, HE teaches, wherein the RA procedure comprises the UE transmitting to the target network entity a RA preamble (526), starting a timer (RAR timer), and while the timer is running receiving a Random-Access Response (RAR) (528) from the target network node (base station 502); and (paragraph 0107, reads on the base station 502 may receive the preamble message 526 and, in response, may begin an RAR timer, which may be associated with the first RAR window 510 and/or the second RAR window 512. Paragraph 0109 reads the base station 502 may generate and send a response message 528 (also known as an “RAR”) in the first RAR window 510, e.g., according to the RAR timer that the base station 502 started upon receiving the preamble message 526. The response message 528 may be a response from the base station 502 to the preamble message 526 transmitted by the UE 504). Therefore, it would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which said subject matter pertains, to modify Claim 8, by incorporating the roaming and handover procedures dissertation of Meyer with the method used in wireless communication by a user equipment (UE) involves generating a payload of a preamble message associated with a random access channel procedure of HE. The motivation to do so would be develop a method that provides reduced latency of a higher-priority RACH procedure relative to a lower-priority RACH procedure. In addition, to exploring multiple access technologies that have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate on a municipal, national, regional, and even global level as it relates to a communication systems, and more particularly, to random access procedures in wireless communications networks. Consider Claim 11, Meyer disclose the method of claim 8, further comprising: in response to the MAC layer msg3, receiving a contention resolution MAC control element (CE) that is integrity protected and/or encrypted. (Section 2. 1. 2 page 42, MD and EIPEFN use a key-establishment process key (see Def. 1.2.9) to derive the data-protection keys (EK, I K) from the master key K. MD and EIPEFN subsequently use these keys as input to an encryption mechanism em (Def. 1.2.4) or an integrity-protection mechanism im (Def. 1.2.7) to protect their MAC layer connection. During connection establishment upon roaming, MD and FN have to negotiate the roaming authentication protocol ra, the roaming key-agreement protocol rka, and the cipher suite (ke, em, im) to use). Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHELE CAMILLE DOUGLAS whose telephone number is (571)270-0458. The examiner can normally be reached Monday - Friday 6:30 am - 5:00 pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeanette J Parker can be reached at 571-270-3647. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /MICHELE C DOUGLAS/Examiner, Art Unit 2646 /JEANETTE J PARKER/Supervisory Patent Examiner, Art Unit 2646
Read full office action

Prosecution Timeline

Oct 31, 2024
Application Filed
Sep 09, 2026
Non-Final Rejection mailed — §102, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12750766
CHANNEL RASTER AND SYNCHRONIZATION SIGNAL RASTER FOR OPERATING IN THE 57 GHZ TO 71 GHZ BAND
2y 10m to grant Granted Sep 29, 2026
Patent 12652348
CALLEE AND CALLER COMMUNICATION AND COMMUNICATION SERVICING METHODS
3y 4m to grant Granted Jun 09, 2026
Patent 12634400
SELECTIVELY MERGING SUBSCRIPTIONS TO PERFORMANCE INDICATOR INFORMATION
2y 7m to grant Granted May 19, 2026
Patent 12621651
Decentralized Network Reward Data Usage Tracking
3y 5m to grant Granted May 05, 2026
Patent 12615518
INTERFERENCE CONTROL SYSTEM, INTERFERENCE CONTROL METHOD, LINK-UP DEVICE AND PROGRAM FOR INTERFERENCE CONTROL FOR WIRELESS COMMUNICATIONS
2y 8m to grant Granted Apr 28, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

1-2
Expected OA Rounds
75%
Grant Probability
99%
With Interview (+42.9%)
3y 0m (~1y 1m remaining)
Median Time to Grant
Low
PTA Risk
Based on 12 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month