Prosecution Insights
Last updated: July 17, 2026
Application No. 19/094,071

PRE-ASSOCIATION SECURITY NEGOTIATION (PASN) TUNNELING FOR PROTECTED UNAUTHENTICATED EXCHANGES

Non-Final OA §103
Filed
Mar 28, 2025
Priority
May 17, 2024 — provisional 63/649,111
Examiner
LESNIEWSKI, VICTOR D
Art Unit
Tech Center
Assignee
Cisco Technology Inc.
OA Round
1 (Non-Final)
59%
Grant Probability
Moderate
1-2
OA Rounds
2y 0m
Est. Remaining
99%
With Interview

Examiner Intelligence

Grants 59% of resolved cases
59%
Career Allowance Rate
286 granted / 488 resolved
-1.4% vs TC avg
Strong +55% interview lift
Without
With
+55.1%
Interview Lift
resolved cases with interview
Typical timeline
3y 3m
Avg Prosecution
19 currently pending
Career history
510
Total Applications
across all art units

Statute-Specific Performance

§101
0.3%
-39.7% vs TC avg
§103
87.0%
+47.0% vs TC avg
§102
9.0%
-31.0% vs TC avg
§112
0.8%
-39.2% vs TC avg
Black line = Tech Center average estimate • Based on career data from 488 resolved cases

Office Action

§103
DETAILED ACTION The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Claims 1-20 are presented for examination. The IDS filed 3/28/2025 has been considered. Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1, 2, 5, 6, 9-12, 14-18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Tang (U.S. Patent Application Publication Number 2007/0197190) in view of Beg et al. (U.S. Patent Application Publication Number 2025/0176019), hereinafter referred to as Beg. Tang disclosed techniques for identifying communicable statuses of access points. In an analogous art, Beg disclosed techniques for managing connections between stations and access points. Both systems are directed toward association between stations and access points. Regarding claim 1, Tang discloses a method comprising: establishing a first session between a client device and a first access point (AP) (paragraph 16, station and first access point have PSK); transmitting, by the client device via the first session, a first frame to the first AP that includes a key of the client device, an indication that the first AP is to send elements of the first frame to a second AP, and an identifier of the client device that the client device is to use for wireless communications with the second AP (paragraph 16, station communicates with first access point and can roam to second access point); and obtaining, by the client device from the first AP via the first session, a second frame that includes a key of the second AP for establishing a second session between the client device and the second AP (paragraph 58, informs station of PSK state via frame). Tang does not explicitly state that the first and second sessions are Pre-Association Security Negotiation (PASN) sessions, that the first and second frames are PASN frames, and that the PASN second frame includes a message integrity code (MIC) associated with the second AP and a timeout value. However, implementing the PASN protocol in such a fashion was well known in the art as evidenced by Beg. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Tang by adding the ability that the first and second sessions are Pre-Association Security Negotiation (PASN) sessions, that the first and second frames are PASN frames, and that the PASN second frame includes a message integrity code (MIC) associated with the second AP and a timeout value as provided by Beg (see paragraph 185, PASN allows pre-association encrypted exchange between station and AP, and paragraph 176, AP sends EAPOL-Key to station including MIC and key lifetime). One of ordinary skill in the art would have recognized the benefit that providing transition management procedures in this way would assist in managing AP association decisions (see Beg, paragraph 191). Regarding claim 2, the combination of Tang and Beg discloses within a time interval indicated by the timeout value, transmitting, by the client device a PASN third frame to the second AP to establish the second PASN session with the second AP, wherein the PASN third frame includes a MIC associated with the client device, in which a transmit address for transmitting the PASN first frame is set to the identifier of the client device that was included in the PASN first frame (Beg, paragraph 169, station associates with new AP, and paragraph 176, station sends EAPOL-Key including MIC). Regarding claim 5, the combination of Tang and Beg discloses wherein the first PASN session established between the client device and the first AP utilizes a first key of the client device and the key of the client device included in PASN first frame is a second key that is different than the first key (Beg, paragraph 187, PMK and PTK). Regarding claim 6, the combination of Tang and Beg discloses wherein the indication that the first AP is to send the elements of the PASN first frame to the second AP and the identifier of the client device that the client device is to use for wireless communications with the second AP are included in a data element for the PASN first frame (Beg, paragraph 248, data element). Regarding claim 9, the combination of Tang and Beg discloses encrypting the PASN first frame by the client device using a key of the client device provided to the first AP through establishing the first PASN session between the client device and the first AP (Beg, paragraph 187, handshake results in keys to encrypt traffic). Regarding claim 10, the combination of Tang and Beg discloses wherein the PASN second frame obtained by the client device is encrypted using a key of the first AP provided to the client device through establishing the first PASN session between the client device and the first AP (Beg, paragraph 187, handshake results in keys to encrypt traffic). Regarding claim 11, Tang discloses a method comprising: establishing a first session between a first access point (AP) and a client device (paragraph 16, station and first access point have PSK); obtaining, by the first AP via the first session, a first frame from the client device, the first frame comprising first frame elements including a key of the client device, an indication that the first AP is to send the first frame elements to a second AP, and an identifier of the client device that the client device is to use for wireless communications with the second AP (paragraph 16, station communicates with first access point and can roam to second access point); transmitting, by the first AP, the first frame elements to the second AP based on the indication included in the first frame (paragraph 45, first access point transmits frames to second access point); obtaining, by the first AP from the second AP, second frame elements including a key of the second AP and a message integrity code (MIC) associated with the second AP (paragraph 52, first access point receives key frame with MIC value); and transmitting a second frame to the client device for establishing a second session between the client device and the second AP (paragraph 58, informs station of PSK state via frame). Tang does not explicitly state that the first and second sessions are Pre-Association Security Negotiation (PASN) sessions, that the first and second frames are PASN frames, that the first and second frame elements are PASN frame elements, the PASN second frame elements including a timeout value, and the PASN second frame including the PASN second frame elements. However, implementing the PASN protocol in such a fashion was well known in the art as evidenced by Beg. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Tang by adding the ability that the first and second sessions are Pre-Association Security Negotiation (PASN) sessions, that the first and second frames are PASN frames, that the first and second frame elements are PASN frame elements, the PASN second frame elements including a timeout value, and the PASN second frame including the PASN second frame elements as provided by Beg (see paragraph 185, PASN allows pre-association encrypted exchange between station and AP, and paragraph 176, AP sends EAPOL-Key to station including MIC and key lifetime). One of ordinary skill in the art would have recognized the benefit that providing transition management procedures in this way would assist in managing AP association decisions (see Beg, paragraph 191). Regarding claim 12, the combination of Tang and Beg discloses wherein the indication that the first AP is to send the PASN first frame elements to the second AP and the identifier of the client device that the client device is to use for wireless communications with the second AP are included in a data element for the PASN first frame (Beg, paragraph 248, data element). Regarding claim 14, the combination of Tang and Beg discloses encrypting, by the first AP, the PASN second frame using a key of the first AP provided to the client device through establishing the first PASN session between the first AP and the client device (Beg, paragraph 187, handshake results in keys to encrypt traffic). Regarding claim 15, Tang discloses a method comprising: establishing a first session between a client device and a first access point (AP) through initial communications exchanged between the client device and the first AP (paragraph 16, station and first access point have PSK); and performing subsequent communications between the client device and at least one other AP that are facilitated through the first session established between the client device and the first AP to enable at least one subsequent session to be established between the client device and the at least one other AP (paragraph 16, station communicates with first access point and can roam to second access point, and paragraph 58, informs station of PSK state via frame). Tang does not explicitly state that the first and subsequent sessions are Pre-Association Security Negotiation (PASN) sessions and that the initial and subsequent communications are PASN communications. However, implementing the PASN protocol in such a fashion was well known in the art as evidenced by Beg. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Tang by adding the ability that the first and subsequent sessions are Pre-Association Security Negotiation (PASN) sessions and that the initial and subsequent communications are PASN communications as provided by Beg (see paragraph 185, PASN allows pre-association encrypted exchange between station and AP). One of ordinary skill in the art would have recognized the benefit that providing transition management procedures in this way would assist in managing AP association decisions (see Beg, paragraph 191). Regarding claim 16, the combination of Tang and Beg discloses wherein performing the subsequent PASN communications includes obtaining, by the first AP, a first PASN frame that includes an indication that causes the first AP to identify the at least one other AP that is to be involved in the subsequent PASN communications (Tang, paragraph 16, station communicates with first access point and can roam to second access point). Regarding claim 17, the combination of Tang and Beg discloses wherein the indication is a Basic Service Set Identifier (BSSID) of the at least one other AP that is identified in the PASN first frame (Beg, paragraph 170, BSS transition candidate). Regarding claim 18, the combination of Tang and Beg discloses wherein the PASN first frame obtained by the first AP from the client device further includes an identifier of the client device that the client device is to use for wireless communications with the at least one other AP (Tang, paragraph 16, station communicates with first access point and can roam to second access point). Regarding claim 20, the combination of Tang and Beg discloses wherein performing the subsequent PASN communications includes communicating a PASN second frame to the client device from the first AP that includes an ephemeral public key of the at least one other AP, a Message Integrity Code (MIC) associated with the at least one other AP, and a timeout value (Beg, paragraph 176, AP sends EAPOL-Key to station including MIC and key lifetime). Claims 3, 4, 7, 8, 13, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Tang in view of Beg, further in view of Yuan (U.S. Patent Application Publication Number 2026/0025872). The combination of Tang and Beg disclosed techniques for identifying communicable statuses of access points. In an analogous art, Yuan disclosed techniques for communications utilizing a multi-link terminal device. Both systems are directed toward managing connections between stations and access points. Regarding claim 3, the combination of Tang and Beg does not explicitly state wherein the identifier of the client device is a media access control (MAC) address of the client device. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the identifier of the client device is a media access control (MAC) address of the client device as provided by Yuan (see paragraph 60, MAC address of another link). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Regarding claim 4, the combination of Tang and Beg does not explicitly state wherein the client device utilizes a first media access control (MAC) address for establishing the first PASN session between the client device and the first AP and the identifier of the client device is a second MAC address of the client device that is different than the first MAC address. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the client device utilizes a first media access control (MAC) address for establishing the first PASN session between the client device and the first AP and the identifier of the client device is a second MAC address of the client device that is different than the first MAC address as provided by Yuan (see paragraph 60, MAC address of current link and MAC address of another link). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Regarding claim 7, the combination of Tang and Beg discloses wherein the indication that the first AP is to send the elements of the PASN first frame to the second AP is a Basic Service Set Identifier (BSSID) of the second AP that is identified in the data element (Beg, paragraph 170, BSS transition candidate). The combination of Tang and Beg does not explicitly state that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address identified in the data element. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address identified in the data element as provided by Yuan (see paragraph 60, MAC address of another link). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Regarding claim 8, the combination of Tang and Beg discloses wherein the indication that the first AP is to send the elements of the PASN first frame to the second AP is a Basic Service Set Identifier (BSSID) of the second AP that is identified in 6 octets of the data element (Beg, paragraph 170, BSS transition candidate, and figure 23, BSSID). The combination of Tang and Beg does not explicitly state that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address is identified in another 6 octets of the data element. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address is identified in another 6 octets of the data element as provided by Yuan (see paragraph 60, MAC address of another link, and paragraph 104, 6 octets). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Regarding claim 13, the combination of Tang and Beg discloses wherein the indication that the first AP is to send the PASN first frame elements to the second AP is a Basic Service Set Identifier (BSSID) of the second AP that is identified in the data element (Beg, paragraph 170, BSS transition candidate). The combination of Tang and Beg does not explicitly state that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address identified in the data element. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the identifier of the client device that the client device is to use for wireless communications with the second AP is a media access control (MAC) address that the client device is to use for wireless communications with the second AP in which the MAC address identified in the data element as provided by Yuan (see paragraph 60, MAC address of another link). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Regarding claim 19, the combination of Tang and Beg does not explicitly state wherein the identifier of the client device that the client device is to use for wireless communications with the at least one other AP is a Media Access Control (MAC) address that the client device is to use for wireless communications with the at least one other AP. However, utilizing MAC addresses in such a fashion was well known in the art as evidenced by Yuan. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Tang and Beg by adding the ability that the identifier of the client device that the client device is to use for wireless communications with the at least one other AP is a Media Access Control (MAC) address that the client device is to use for wireless communications with the at least one other AP as provided by Yuan (see paragraph 60, MAC address of another link). One of ordinary skill in the art would have recognized the benefit that providing multi-link management in this way would assist in maintaining device MAC address-related functionality while improving communication security (see Yuan, paragraphs 4 and 10). Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Huang et al. (U.S. Patent Application Publication Number 2025/0119733) disclosed techniques for managing encrypted 802.11 associations. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Victor Lesniewski whose telephone number is (571)272-2812. The examiner can normally be reached Monday thru Friday, 9am to 5pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /Victor Lesniewski/Primary Examiner, Art Unit 2493
Read full office action

Prosecution Timeline

Mar 28, 2025
Application Filed
Jun 26, 2026
Non-Final Rejection mailed — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12683976
SYSTEM AND METHOD FOR CONTINUOUS MONITORING AND REVOCATION OF DEVICE ACCESS AUTHORIZATION
2y 5m to grant Granted Jul 14, 2026
Patent 12671997
ELEVATED SECURITY EXECUTION MODE FOR NETWORK-ACCESSIBLE DEVICES
2y 5m to grant Granted Jun 30, 2026
Patent 12665764
VERIFICATION SYSTEM FOR OMNICHANNEL END-USER VERIFICATION
2y 4m to grant Granted Jun 23, 2026
Patent 12665902
PINNING DEVICE IDENTIFIERS TO CRYPTOGRAPHIC KEY PAIRS
2y 1m to grant Granted Jun 23, 2026
Patent 12659316
MEDIA USAGE MONITORING AND CONTROL
7y 0m to grant Granted Jun 16, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

1-2
Expected OA Rounds
59%
Grant Probability
99%
With Interview (+55.1%)
3y 3m (~2y 0m remaining)
Median Time to Grant
Low
PTA Risk
Based on 488 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month