DISH Network LLC v. Eleven Software Inc

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: DISH Network L.L.C. (Colorado)
  • Defendant: Eleven Software Inc. (Delaware)
  • Plaintiff's Counsel: Kaempfer Crowell
• Case Identification: DISH Network L.L.C. v. Eleven Software Inc., 2:26-cv-01845, D. Nev., 06/17/2026
• Venue Allegations: Venue is alleged to be proper based on the defendant having a regular and established place of business in the District of Nevada and having committed acts of infringement within the district.
• Core Dispute: Plaintiff alleges that Defendant's cloud-based Wi-Fi management software infringes two patents related to methods for securely provisioning wireless network access using centrally managed, unique pre-shared keys.
• Technical Context: The technology addresses security and management challenges in large-scale Wi-Fi deployments (e.g., hotels, apartment complexes) by replacing a single, shared network password with unique, user-specific credentials that are validated by a cloud system rather than by the local access point.
• Key Procedural History: The complaint alleges that the Defendant had pre-suit knowledge of the patented technology based on receiving a copy of a provisional application to which the patents-in-suit claim priority, and later receiving a formal notice of infringement letter from the Plaintiff.

Case Timeline

Date	Event
2019-09-30	Earliest Priority Date for '285 and '884 Patents
2020-04-30	Defendant allegedly receives a copy of a priority provisional application
2021-07-20	Alleged first offer for sale of Accused Product
2022-04-26	'285 Patent issues
2025-02-18	'884 Patent issues
2025-06-13	Plaintiff sends notice letter to Defendant
2026-06-17	Complaint filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 11,317,285 - Wireless Network Provisioning Using a Pre-shared Key

• Patent Identification: U.S. Patent No. 11,317,285, "Wireless Network Provisioning Using a Pre-shared Key," issued April 26, 2022 (the "'285 Patent").

The Invention Explained

• Problem Addressed: The patent's background section describes the security vulnerabilities and management burdens of using a single pre-shared key (PSK) for multiple users in environments like hotels, where a compromised key could allow one user to intercept another's data Compl. ¶15 '285 Patent, col. 1:44-51 It also notes the difficulty of revoking access for individual users, which often requires cumbersome manual blacklisting of device MAC addresses '285 Patent, col. 1:51-58
• The Patented Solution: The invention proposes a system where a "cloud-based provisioning system," architecturally distinct from the local Wi-Fi access point (AP), manages a database of unique PSKs and associated user profiles Compl. ¶16 '285 Patent, abstract When a device attempts to connect, the AP forwards a value derived from the user's PSK to the cloud system for validation. If a match is found, the cloud system provides a pairwise master key (PMK) back to the AP, which then establishes a secure, encrypted session with the device. This process avoids ever transmitting the actual PSK over the air to the AP '285 Patent, col. 7:6-14 '285 Patent, Fig. 1
• Technical Importance: This approach centralizes authentication and access control, allowing for scalable and secure management of many unique users across multiple locations without modifying the standard Wi-Fi connection behavior on the user's device Compl. ¶18 '285 Patent, col. 8:52-57

Key Claims at a Glance

• The complaint asserts at least independent claim 1 Compl. ¶34
• The essential elements of independent claim 1 include:
  • At a cloud-based provisioning system distinct from the access points, creating a plurality of wireless network access profiles that indicate PSKs, bandwidth restrictions, and time periods for access.
  • An access point receiving from a wireless device a "first value" based on the PSK.
  • The access point transmitting this first value to the cloud-based system.
  • The cloud system creating a plurality of values based on its stored PSKs and identifying a "second value" that matches the first value.
  • The cloud system providing a pairwise master key (PMK) to the access point based on the matching profile.
  • The access point providing network access to the device using the PMK, subject to the time and bandwidth restrictions in the profile Compl. ¶39
• The complaint does not explicitly reserve the right to assert dependent claims.

U.S. Patent No. 12,231,884 - Wireless Network Provisioning Using a Pre-shared Key

• Patent Identification: U.S. Patent No. 12,231,884, "Wireless Network Provisioning Using a Pre-shared Key," issued February 18, 2025 (the "'884 Patent").

The Invention Explained

• Problem Addressed: As a continuation of the application leading to the '285 Patent, the '884 Patent addresses the same fundamental problem of scalable and secure management of PSK-based Wi-Fi networks Compl. ¶15 '884 Patent, col. 1:20-24
• The Patented Solution: The '884 Patent claims a specific method for implementing the cloud-based authentication. The method involves the exchange of specific cryptographic values: a Message Integrity Code (MIC) and a station announcement message (SNonce), which are created by the wireless device using its PSK '884 Patent, abstract The AP transmits these values, along with its own access point announcement message (ANonce), to the remote cloud system. The cloud system then iteratively calculates expected MICs for its stored PSKs and, upon finding a match, transmits a PMK to the AP to grant access '884 Patent, col. 14:1-35 '884 Patent, Fig. 4B
• Technical Importance: This method provides a more detailed cryptographic protocol for the off-loaded authentication process, grounding the high-level system of the '285 Patent in specific data exchanges common in Wi-Fi security protocols Compl. ¶22

Key Claims at a Glance

• The complaint asserts at least independent claim 1 Compl. ¶76
• The essential elements of independent claim 1 include:
  • A cloud-based system storing profiles with a PSK and SSID.
  • An access point receiving a MIC and SNonce from a wireless device.
  • The access point determining to transmit the MIC and SNonce to the cloud system.
  • The access point transmitting the MIC, SNonce, and an ANonce to the remote cloud system.
  • The cloud system receiving these values.
  • The cloud system calculating MICs for its stored profiles and determining that one matches the received MIC.
  • The cloud system transmitting a PMK for the matching profile to the access point.
  • The access point receiving the PMK, establishing an encrypted session, and granting network access Compl. ¶81
• The complaint does not explicitly reserve the right to assert dependent claims.

III. The Accused Instrumentality

Product Identification

The accused instrumentality is Defendant's "ElevenOS" cloud-based system, specifically including its "Personal Pass Key" and "Enterprise Device Manager" functionalities Compl. ¶23

Functionality and Market Context

• ElevenOS is described as "enterprise-grade Wi-Fi management software" for markets such as hotels and multifamily housing Compl. ¶24 Compl. ¶42 The "Personal Pass Key" feature provides each user or resident with a "unique Wi-Fi pass key" Compl. ¶48
• The system relies on a cloud-based "Eleven Key Matching Service (EKMS)" which "stores all keys enabled for an SSID and checks that the key entered by a user... is a valid one" Compl. ¶26 Compl. ¶53 When a device attempts to connect, the on-premise hardware sends an "encrypted key to Eleven's cloud-native... Key Matching Service (EKMS) which checks the key against a list of authorized keys" Compl. ¶44
• The system allows property managers to control access by scheduling users in a web-based application, which can define attributes like credentials and bandwidth speeds Compl. ¶25 Compl. ¶27 Access is automatically terminated when an "access end date passes" Compl. ¶45 The complaint includes a marketing graphic from the Defendant illustrating the "Magic of Key Matching" which highlights benefits such as being "hardware-agnostic" and "turnkey SaaS" Compl. ¶133

IV. Analysis of Infringement Allegations

'285 Patent Infringement Allegations

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
[1a] creating, at a cloud-based provisioning system, a plurality of wireless network access profiles that indicate: 1) a plurality of PSKs; 2) a plurality of bandwidth restrictions; and 3) a plurality of time periods for which network access is permitted, wherein the cloud-based provisioning system is an internet-connected server system distinct from a plurality of access points...	Defendant's ElevenOS allows administrators to create user profiles with unique pass keys, defined bandwidth speeds, and access end dates via a cloud-based application. This system is described as a cloud service (EKMS) separate from on-premise hardware.	¶43; ¶45; ¶46	col. 6:51-60
[1b] receiving, by an access point of the plurality of access points, from a wireless device, a first value that is based at least in part on the PSK;	When a resident's device connects, it provides a unique Wi-Fi pass key (PSK). The on-premise hardware receives a value derived from this key.	¶47; ¶48	col. 9:64-10:2
[1c] transmitting, by the access point, the first value to the cloud-based provisioning system via the Internet;	The on-premise hardware sends the "encrypted key to Eleven's cloud-native... Key Matching Service (EKMS)" for validation.	¶49; ¶50	col. 10:7-10
[1d] creating, by the cloud-based provisioning system, a plurality of values based on the plurality of PSKs of the plurality of wireless network access profiles;	Defendant's EKMS is a "purpose-built service that stores all keys" and its own '407 patent allegedly describes generating a MIC for each PSK to match against.	¶51; ¶52	col. 10:11-15
[1e] identifying, by the cloud-based provisioning system a second value of the plurality of values that matches the transmitted first value;	The cloud-based EKMS "checks the key against a list of authorized keys" to find a match. Defendant's '407 patent allegedly describes matching a generated MIC to a set of valid keys.	¶54; ¶56	col. 10:35-40
[1f] providing, by the cloud-based provisioning system to the access point via the Internet, a pairwise master key (PMK) based on the PSK of the wireless network access profile... that matches the transmitted first value;	Defendant's marketing asserts "ElevenOS manages a pool of WPA-2 keys" and its '407 patent allegedly describes generating a PMK based on the PSK. The complaint alleges this PMK is provided to the AP after a match.	¶57; ¶58; ¶59	col. 10:46-49
[1g] providing, by the access point, network access to the wireless device using the PMK... for a time period indicated by the... profile... in accordance with a bandwidth restriction...	Defendant's marketing materials state that residents are "gracefully off-boarded and their key is disabled when their access end date passes" and that administrators can define "bandwidth speeds, and more."	¶61; ¶63; ¶64	col. 10:49-61

'884 Patent Infringement Allegations

The complaint reproduces a diagram from the Defendant's own '407 Patent, which depicts an "Off-Loaded EAPOL Frame 2 Key Matching" process, to support its infringement theory for the '884 patent Compl. ¶89

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
[1a] storing, by a cloud-based provisioning system, a plurality of wireless network access profiles, wherein each... comprises: a pre-shared key (PSK); and an SSID of a wireless network;	Defendant's ElevenOS is a cloud-based service that enables operators to scale. It provides new residents with an SSID and a unique "Personal Pass Key" (PSK).	¶84; ¶85; ¶87	col. 14:62-67
[1b] receiving, by an access point, from a wireless device, a message integrity code (MIC) and a station announcement message (SNonce)...	The complaint alleges this occurs by pointing to a figure in Defendant's own '407 patent that shows the transmission of "Frame 2: SNonce, MIC, etc." from a client to an access point.	¶88; ¶89	col. 14:1-5
[1c] determining, by the access point, that the MIC and the SNonce is to be transmitted to the cloud-based provisioning system...	The complaint alleges that because the on-premise hardware sends the "encrypted key" to the cloud for checking, it inherently determines that this data must be transmitted.	¶90; ¶91	col. 14:6-10
[1d] transmitting, by the access point, the MIC, the SNonce, and an access point announcement message (ANonce) to the cloud-based provisioning system...	Defendant's '407 patent allegedly shows the AP delegating matching by sending ANonce and "Frame 2" information to a key matching service. The complaint alleges this service is the accused cloud system.	¶92; ¶94	col. 14:11-19
[1e] receiving, by the cloud-based provisioning system, the MIC, the SNonce, and the ANonce;	Defendant's '407 patent allegedly discloses that the key matching service receives the ANonce and SNonce values as part of a match request from the AP.	¶95; ¶96	col. 14:20-22
[1f] calculating, by the cloud-based provisioning system, calculated MICs for multiple wireless network access profiles...	Defendant's '407 patent allegedly states "The key matching service 106 may use this information to generate the MIC for each PMK and/or PSK and match the generated MIC."	¶98; ¶100	col. 14:23-31
[1g] & [1h] determining... that a first calculated MIC... does not match... [and] that a second calculated MIC... matches the received MIC;	The complaint alleges this is the necessary outcome of the matching process, where the cloud-based EKMS "checks the key against a list of authorized keys, granting access only when a match is found."	¶101; ¶102; ¶103; ¶104	col. 14:23-31
[1i] transmitting, by the cloud-based provisioning system, a pairwise master key (PMK)... to the access point in response to determining that the... MIC... matches...	Defendant's '407 patent allegedly discloses that the key matching service may send a "match result" that includes the PMK back to the access point.	¶105; ¶106	col. 14:32-35
[1j] receiving, by the access point, the PMK from the cloud-based provisioning system;	This step is alleged to be the necessary counterpart to the transmission in the preceding step, pointing to the same disclosure in Defendant's '407 patent.	¶107; ¶108	col. 14:36-37
[1k] establishing, by the access point, an encrypted communication session with the wireless device using the PMK;	Defendant's marketing material states that with its system, "network traffic is encrypted separately" for each user.	¶109; ¶110	col. 14:38-41
[1l] granting, by the access point, network access to the wireless device based on the PMK.	Defendant's marketing asserts that its system "securely connect[s]" users to their SSID, which the complaint equates to granting network access.	¶112; ¶113	col. 14:42-44

Identified Points of Contention

• Reliance on External Evidence: The infringement allegations for both patents, and particularly the '884 Patent, rely heavily on disclosures from Defendant's own patent ('407 patent) and marketing materials, rather than direct analysis of the accused product's operation Compl. ¶¶52, 89 A central question will be whether the Accused Product actually operates as described in those materials and whether that operation aligns precisely with the asserted claims.
• Scope Questions: The infringement theory for the '285 Patent hinges on whether the "encrypted key" that the complaint alleges is transmitted Compl. ¶50 constitutes the claimed "first value that is based at least in part on the PSK." For the '884 patent, a key question will be whether that same "encrypted key" can be shown to contain the specifically claimed "message integrity code (MIC) and a station announcement message (SNonce)." The defense may argue the plaintiff is improperly conflating a generic encrypted value with the specific cryptographic components required by the claims.

V. Key Claim Terms for Construction

• The Term: "cloud-based provisioning system ... distinct from a plurality of access points" '285 Patent, cl. 1a '884 Patent, cl. 1d

• Context and Importance: This term defines the core architecture of the invention-offloading authentication from the local AP to a remote system. The viability of the infringement case depends on establishing that Defendant's "Eleven Key Matching Service (EKMS)" is architecturally "distinct" from the on-premise APs it works with. Practitioners may focus on this term because the defense could argue that the EKMS and APs form a single, functionally integrated system, not a "distinct" one as claimed.

• Intrinsic Evidence for Interpretation:

  • Evidence for a Broader Interpretation: The specification describes the system as "remotely located" and communicating with the AP "via the Internet" '285 Patent, col. 8:25-27, which may support an interpretation requiring only physical and network separation.
  • Evidence for a Narrower Interpretation: The detailed descriptions and figures show a tight, protocol-driven coupling between the AP and the cloud system (e.g.,'285 Patent, Fig. 1). The defense might use this to argue that "distinct" implies a higher degree of functional independence than is present in the accused system.

• The Term: "a first value that is based at least in part on the PSK" '285 Patent, cl. 1b

• Context and Importance: The complaint alleges that an "encrypted key" transmitted by the accused system meets this limitation Compl. ¶50 The definition of "based at least in part on" will be critical. The dispute will likely center on whether any value derived from a process involving the PSK qualifies, or if the term implies a more specific cryptographic relationship in the context of the patent.

• Intrinsic Evidence for Interpretation:

  • Evidence for a Broader Interpretation: The plain language "based at least in part on" is inherently broad. The specification states the wireless device "uses the unique PSK... to generate a value that is transmitted to the AP" '285 Patent, col. 9:64-10:2, which suggests any output from a function that takes the PSK as an input could suffice.
  • Evidence for a Narrower Interpretation: A defendant may argue that, when read in light of the overall disclosure, the "value" must be a specific type of cryptographic artifact, such as a message integrity code (MIC), which is described as an exemplary value '285 Patent, col. 6:1-3 The existence of the '884 Patent, which explicitly claims a MIC, could be used to argue that the '285 Patent's more general term "value" should be interpreted differently, though this could support either a broader or narrower construction.

VI. Other Allegations

• Indirect Infringement: The complaint alleges inducement of infringement under 35 U.S.C. § 271(b), stating that Defendant's website hosts a "Resource Center" with literature that details the Accused Product and instructs customers and end-users on its infringing use Compl. ¶36 Compl. ¶78 It also alleges contributory infringement under § 271(c), asserting the Accused Product has components especially made or adapted for infringement that are not staple articles of commerce Compl. ¶38 Compl. ¶80
• Willful Infringement: Willfulness is alleged based on both pre-suit knowledge and willful blindness. The complaint asserts Defendant had knowledge at least as early as April 30, 2020, from receiving a copy of a provisional application to which the patents claim priority, and also from a notice letter sent on June 13, 2025 Compl. ¶29 Compl. ¶30 Compl. ¶67 It further alleges Defendant was willfully blind because it "subjectively believed there was a high probability" of infringement but "took deliberate actions to avoid learning" Compl. ¶68 Compl. ¶118

VII. Analyst's Conclusion: Key Questions for the Case

1. An Architectural Question: Does the Defendant's "Eleven Key Matching Service" (EKMS) constitute a "cloud-based provisioning system ... distinct from" the on-premise access points, as required by the claims? The case may turn on whether the court construes "distinct" to mean merely physically remote, or if it requires a higher degree of functional independence that the defense may argue its integrated system does not possess.

2. An Evidentiary Question of Technical Equivalence: Do the data values transmitted within the accused ElevenOS system map directly onto the specific cryptographic components required by the patent claims? A central issue will be whether the Plaintiff can prove that the "encrypted key" allegedly used by the accused system is equivalent to the "first value based at least in part on the PSK" ('285 patent) and, more specifically, contains the "message integrity code (MIC)" and "SNonce" recited in the '884 patent, or if the infringement theory relies on an impermissible leap from marketing language to technical reality.

3. A Question of Proof: Given the complaint's significant reliance on the Defendant's own marketing materials and a separate patent ('407) to construct its infringement narrative, a key challenge for the Plaintiff will be to move from these indirect allegations to direct evidence showing the Accused Product's actual, real-world operation infringes the specific limitations of the asserted claims.