Application digital rights management (DRM) and portability using a mobile device for authentication

[0001] Not applicable.

[0002] Not applicable.

[0003] Although mobile devices have the ability to handle telephone calls, they are unique from telephones connected to wireline systems. Mobile devices contain unique identifiers which allow them to connect and be identified in wireless networks. Most telephones in a wireline system do not have these characteristics except for various voice over packet (VOP) telephones that use internet protocol (IP) addresses as unique identifiers. In the wireless environment, these unique identifiers provide service providers with a way to identify and control the mobile devices.

[0004] The unique identifiers vary according to the type of wireless technology that may be used and the service provider. The unique identifiers are used to identify a user that may want access to a wireless network. The unique identifier identifies the mobile device to the service provider and wireless network. The service provider can use the unique identifiers in a mobile device to verify information about the user or the device such as the level of service that is to be provided, if the user is allowed to originate telephone calls, the location of the mobile device, etc. The unique identifiers may include such items as a username and password embedded in the mobile device, an IP address, an ESN, or an IMEI. These unique identifiers are the more common ones that are associated with mobile devices, but there are others that can be used. As wireless technologies evolve, the number of unique identifiers will increase and evolve as well.

[0005] One of the challenges that users face today is having the ability to migrate information from one computing device to another computing device. Usually, a user has to install a computer software program onto a computing device in order to use the computing device. However, if the user is mobile and needs to use the computer software program on a second computing device, the user has to find a way to re-install the computer software program to operate at the second computing device since the computer software program is already stored on the first computing device.

[0006] The first challenge is for the user to operate the computer software program on the second computing device when the computer software program is already stored on the first computing device. The user may have to re-install the computer software program on the second computing device and go through a re-authentication process with the second installation. If the user does not have the authentication information, the user will be prevented from accessing the computer software program although the computer software program may have been installed properly.

[0007] Another challenge for the user, even after gaining access to the second computing device and having the computer software program installed, is to have access to the data files that were originally used and stored on the first computing device with the computer software program. One current solution for accessing such data files is to store the data files on a removable media device such as a floppy disk, a CD, a flash memory (such as a USB memory), or a removable disk drive. The user can store the data files on the removable media device and later use the removable media device with the computer software program (if the user has access). Unfortunately, the user has to maintain the most recent version of the data files either on the first computing device or on the removable media device. In addition, the user needs the authenticated version of the computer software program to access the data files. At some point, the first computing device and the removable media device may need to be synchronized to have the same data. Secondly, the user has to take care not to damage the removable media device. Thirdly, the removable media device has to be small enough to not distract the user when it is moved from place to place. If the removable media device is too bulky or cumbersome, the user may not find the removable media device practical and may lose interest in using such device. Fourthly, the user has to use an authenticated version of the computer software program with the data files.

[0008] For the reasons discussed above, a solution is needed that allows a user to use an authenticated version of a computer software program even when the user is using different types of computing devices. The solution needs to allow the user to access the user's data files and the computer software program without the need for a removable media device and without the need for prompting for a key or re-authentication information. The solution also needs to allow the user to access the Internet from the different types of computing devices while using the computer software program and data files.

[0009] The present invention is defined by the claims below. Embodiments of the present invention solve at least the above problems by providing a system, method, and media for, among other things, operating a computing device and a mobile device to access computer software with a secure access and to access a packet network, and for operating a computer software on a mobile device with different computing devices.

[0010] In a first aspect, a computer system having a processor and a memory for executing a method for operating a computing device and a mobile device to access computer software with a secure access is provided that includes communicating between the computing device and the mobile device over a connection. A set of information is accessed on the mobile device from the computing device for an authentication. A user is authenticated with the mobile device at the computing device to operate either or both a first computer software on the mobile device or a second computer software not on the mobile device. Either the first computer software or the second computer software is operated from the computing device.

[0011] In another aspect, a computer system having a processor and a memory for executing a method for operating a computing device and a mobile device to access computer software with a secure access and to access a packet network is provided that includes communicating between the computing device and the mobile device over a connection. A set of information is accessed on the mobile device from the computing device for an authentication. A user is authenticated with the mobile device at the computing device to operate either or both a first computer software on the mobile device or a second computer software not on the mobile device. Either the first computer software and the second computer software is operated from the computing device. From the computing device, the packet network is accessed through the mobile device.

[0012] In yet another aspect, computer-readable media containing thereon computer-readable code for causing a mobile device to perform a method for authenticating a user at a computing device is provided that includes receiving at the mobile device notifications that a user is attempting an access to a computer software. Data is received associated with the computer software. A determination of an authorization assigned to the user is facilitated to access the computer software from information stored on either the mobile device or another computing device. Other information is provided based on the authorization to the computing device to allow the access to the computer software.

[0013] In yet another aspect, a computer system having a processor and a memory for executing a method for operating a first computer software on a mobile device with different computing devices is provided that includes loading the first computer software onto the mobile device. A unique identifier is provided to associate with the first computer software. The unique identifier is stored with the first computer software or stored in the mobile device. The first computer software is configured to execute from the mobile device with the unique identifier. The mobile device is connected to a first computing device. The first computing device operates the first computer software.

[0023] Embodiments of the present invention provide systems, methods, and media for operating a computing device with a mobile device wherein the mobile device stores authentication information.

Acronyms and Shorthand Notations

[0024] Throughout the description of the present invention, several acronyms and shorthand notations are used to aid the understanding of certain concepts pertaining to the associated system and services. These acronyms and shorthand notations are solely intended for the purpose of providing an easy methodology of communicating the ideas expressed herein and are in no way meant to limit the scope of the present invention. The following is a list of these acronyms:

[0025]

AAA	Authentication, Authorization, and Accounting
BLUETOOTH	Technology for connecting devices using a short-
	ranged wireless connection.
CD	Compact Disk
CDMA	Code Division Multiple Access
DRM	Digital Rights Management
EDGE	Enhance Data Rates for GSM (and TDMA)
	Evolution
ESN	Electronic Serial Number
EV-DO	Evolution Data Only or Evolution Data Optimized
GPRS	General Packet Radio Services
GSM	Global System for Mobile Communications
IMEI	International Mobile Equipment Identity
IP	Internet Protocol
OS	Operating System
PDA	Personal Digital Assistant
UMTS	Universal Mobile Telephone System
USB	Universal Serial Bus
VOP	Voice Over Packet
W-CDMA	Wide Code Division Multiple Access
WiFi	Wireless Fidelity (802.11 network)
WiMAX	Worldwide Interoperability for Wireless Access
	(802.16 network)
ZIGBEE	Technology for connecting devices using a short-
	ranged wireless connection.

[0026] Further, various technical terms are used throughout this description. A definition of such terms can be found in Newton's Telecom Dictionary by H. Newton, 21^st Edition (2005). These definitions are intended to provide a clearer understanding of the ideas disclosed herein but are not intended to limit the scope of the present invention. The definitions and terms should be interpreted broadly and liberally to the extent allowed the meaning of the words offered in the above-cited reference.

[0027] As one skilled in the art will appreciate, embodiments of the present invention may be embodied as, among other things: a method, system, or computer-program product. Accordingly, the embodiments may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware. In one embodiment, the present invention takes the form of a computer-program product that includes computer-useable instructions embodied on one or more computer-readable media.

[0028] Computer-readable media include both volatile and nonvolatile media, removable and nonremovable media, and contemplates media readable by a database, a switch, and various other network devices. Network switches, routers, and related components are conventional in nature, as are means of communicating with the same. By way of example, and not limitation, computer-readable media comprise computer-storage media.

[0029] Computer-storage media, or machine-readable media, include media implemented in any method or technology for storing information. Examples of stored information include computer-useable instructions, data structures, program modules, and other data representations. Computer-storage media include, but are not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile discs (DVD), magnetic cassettes, magnetic tape, magnetic disk storage, and other magnetic storage devices. These memory components can store data momentarily, temporarily, or permanently.

Computing Software Access and Authentication with a Mobile Device

[0030] Embodiments of the present invention may be implemented to allow a user to operate computer software using authentication information on a mobile device. The computers software may be stored on the mobile device or on a computing device. The authentication information is associated with the computer software.

[0031] In FIG. 1, an exemplary operating environment 100 is shown with a computing device 110 connected to a mobile device 120 over a connection 115. The computing device 110 may be a computer, a workstation, a server, or a PDA. The mobile device 120 may be a mobile phone, a handheld computer, or a PDA. The connection 115 may be a USB connection, an Ethernet connection, a serial port connection, a parallel port connection, or a wireless connection. The wireless connection may include BLUETOOTH, infrared, WiFi, and WiMax to name a few. The types of computing devices, mobile device, and connections listed above are not exhaustive and may include others not mentioned in this specification.

[0032] Within mobile device 120, an authentication 125 may be stored in the memory of mobile device 120. Authentication 125 may be a set of unique identifiers associated with mobile device 120. The set of unique identifiers may include a username, a telephone number, a password, an IP address, an ESN, and an IMEI. It is well known in the arts that mobile devices such as mobile telephones have unique identifiers to identify them in a wireless network.

[0033] Mobile device 120 also includes a computer software 127 that may be pre-loaded. Computer software 127 may be an application or computer program that may be executed by a user. Mobile device 120 has a capacity in the gigabyte range to store various computer software. Computer software 127 may use authentication 125 to enable a user to access and execute computer software 127. The use of authentication 125 may be performed in several exemplary ways. First, upon an installation of computer software 127, the user may be required to provide authentication 125 which is stored in mobile device 120. Secondly, a computer program may automatically associate authentication 125 with computer software 127 when computer software 127 is stored in mobile device 120.

[0034] Signal 130 illustrates the wireless capability of mobile device 120. Although not shown here, mobile device 120 may communicate using a variety of wireless technologies including, but not limited to, CDMA, GPRS, GSM, EDGE, EV-DO, W-CDMA, UMTS, WiFi, and WiMax. The transmit and receive capabilities using these technologies will go through the exemplary signal 130.

[0035] Going back to computing device 110, computing device 110 includes computer software 112. Computer software 112 is similar to computer software 127. However, if a user installs computer software 112 in computing device 110, the user may be required to provide authentication information similar to providing a key when installing new computer software. As discussed above, the user may provide authentication information during the installation process at computing device 110 which matches authentication 125. Or, a computer program may automatically associate authentication 125 with computer software 127 when a connection is made between computing device 110 and mobile device 120.

[0036] Turning now to FIG. 2, an exemplary operating environment 200 is shown similar to FIG. 1. A computing device 210 is connected to a mobile device 220 over a connection 215. The computing device 210 represents the same computing device as computing device 110. The computer software 212 represents the same computer software as computer software 112. The connection 215 represents the same connection as connection 115. The mobile device 220 represents and includes the same functionality as mobile device 120 with an addition. Mobile device 220 includes a data access 229. Authentication 225 represents the same functions as authentication 125. Computer software 227 represents the same functions as computer software 127.

[0037] Data access 229 allows mobile device 220 to access the Internet 240 over a connection 235. Connection 235 represents the various devices and signals that are involved in order to allow mobile device 220 to connect to the Internet 240. The discussion of how mobile device 220 connects to the Internet 240 is beyond the scope of this invention and shall not be discussed here. However, one of ordinary skill in the art understands that in today's technologies, home agents, foreign agents, and AAA servers may be involved as part of connection 235 to provide data access 229 to the Internet 240.

[0038] Within the Internet 240, a server 245 may exist to communicate with mobile device 220 for authentication activities. Server 245 may be used for verification purposes when a user tries to access or operate a specific application or computer program. For example, when the user attempts to access an application or a computer program, identified as either computer software 212 or 227, mobile device 220 may send authentication 225 or a subset thereof to server 245 to verify authorization information. Server 245 may return a reply to mobile device 220 which sends information to computing device 210 to allow authorized use to computer software 212 or 227. This example can occur for subscription services allowing the user to use computer software, such as virus detection software, over a time period.

[0039] In FIG. 3, an exemplary computer software 300 is shown with a mobile device 320. Mobile device 320 includes an exemplary set of software identified by an operating component 330, a receiving component 333, a facilitating component 335, an validating component 337, an output component 339, and a data access component 340. Mobile device 320 is similar to mobile devices 120 and 220 discussed above.

[0040] It has already been stated above that mobile device 320 is capable of holding a significant amount of information in its memory. Mobile devices can contain storage capacities in the gigabyte range allowing a variety of software information to be stored. In FIG. 3, operating component 330 represents the software that runs the mobile device. Operating component 330 may also include storing computer software such as computer software 127 and 227. Receiving component 333 represents the software for collecting or monitoring for information that a user is attempting to access or operate computer software 112, 127, 212, or 227. Receiving component 333 also represents the software for receiving data about computer software 112, 127, 212, or 227. In order to know what authentication is required, receiving component 333 has to retrieve or receive information associated with the computer software.

[0041] When mobile device 320 has authentication 125 or 225 as discussed above along with information gathered by receiving component 333, facilitating component 335 operates to authorize a user to gain access to the computer software. Facilitating component 335 may attempt to respond to information received by other components when the user attempts to access computer software, or facilitating component 335 may interact with other computing devices such as server 245 to determine the authorization for the user.

[0042] Validating component 337 represents software for authentication 125 or 225. As discussed above, this information may include a set of unique identifiers associated with mobile device 320. The set of unique identifiers may include a username, a telephone number, a password, an IP address, an ESN, and an IMEI. It may include other unique information not mentioned here. Although validating component 337 may vary according to the implementation, this software represents the specific information that identifies the mobile device or identifies unique characteristics required for authentication purposes. Other components in mobile device 320 may retrieve information in validating component 337 to accomplish the authentication or authorization process.

[0043] Output component 339 represents the exemplary software to send information to computing devices authorizing or acknowledging an authorization for the user to use computer software 112, 127, 212, or 227. Output component 339 may include a key to be used by the computer software, a reply, or a subset of validating component 337. Depending on the implementation of an embodiment, information will be sent from mobile device 320 to a computing device giving access to the user at the computing device. The way in which this information will be delivered as well as what information will be delivered may vary especially when the computer software is stored on the mobile device versus the computing device. For example, if the computer software is stored on the mobile device, there may be little information delivered to the computing device regarding authorization. The user may receive an acknowledgement to access the computer software on mobile device 320. However, if the computer software is loaded in the computing device 110 or 210, a much more involved authentication process may occur with a set of information being delivered to the computing device from output component 339.

[0044] Another software that may be found in mobile device 320 is data access component 340. Data access component 340 represents the exemplary software to access the Internet 240. Data access component 340 is associated with data access 229 discussed above.

[0045] The various software components represent exemplary software that may be implemented in an embodiment of the present invention. In different embodiments, the software components may be represented differently. In some cases, various components may be combined. In other cases, some components may be removed. The idea here is to illustrate the possibilities in implementing various embodiments for the purposes of using mobile device 320 for authentication activities as well as for storing computer software to operate with a computing device.

[0046] With FIGS. 1-3, embodiments of the present invention may be implemented using the processes discussed below in FIGS. 4-8.

[0047] In FIG. 4, a process for operating a computing device using authentication information and computer software installed on a mobile device is provided in a method 400. In a step 410, computer software 127 is installed in mobile device 120. Authentication information such as authentication 125 is established in mobile device 120. Although not shown here, the installation of computer software 127 is similar to installing computer software on a computing device. Various techniques may be used to install computer software 127. Some of which may include the receipt of computer software 127 over a wireless connection.

[0048] In a step 420, computing device 110 is connected to mobile device 120 using the various connections (connection 115) discussed above in FIG. 1. This connection enables computing device 110 and mobile device 120 to communicate together.

[0049] After computer software 127 is installed in mobile device 120 in step 410, when a user attempts to access computer software 127 from computing device 110, the user is authenticated with authentication information on mobile device 120 in a step 430. In an embodiment of the present invention, mobile device 120 may appear as a letter drive when it is connected to computing device 110.

[0050] In a step 440, a user operates computing device 110 executing computer software 127 from mobile device 120. In this step, the user may run an application that has been stored on mobile device 440 after the authentication process completes. In other embodiments, an authentication process may not be required as the user may have pre-loaded authentication information with computer software 127 when it was initially installed.

[0051] Turning now to FIG. 5, a process for operating a computing device using authentication information and computer software installed on a mobile device and accessing the Internet through the mobile device is shown in a method 500. Method 500 is similar to method 400 with some additions. Method 500 includes an ability of mobile phone 120 to provide data access as shown in mobile phone 220.

[0052] In a step 550, a user operates computing device 210 to access the Internet 240 through mobile device 220. To facilitate this access, mobile phone 220 has data access 229 and connection 235 indicating the capability to access the Internet 240. Step 550 illustrates that mobile device 220 may provide computer software 227 to computing device 210 while at the same time providing internet access. Steps 510, 520, 530, and 540 are similar to steps 410, 420, 430, and 440, and are not discussed further.

[0053] In FIG. 6, a process for terminating an operation of a computing device with a mobile device and operating another computing device with the mobile device is shown in a method 600. Method 600 begins as a continuation of the steps in FIGS. 4 and 5.

[0054] After the user completes operating at either computing device 110 or 210, the user may disconnect the computing device from the mobile device in a step 610. As discussed above, the computer software is stored on the mobile device and some or all of the data files may be stored on the mobile device. Later, the user desires to use another computing device and connects the mobile device to this new computing device as shown in a step 620. The user operates the new computing device using the computer software on the mobile device in a step 640. In a step 670, the user accesses the Internet 240 while also operating computing device 110 or 210.

[0055] As shown in the steps 610-640, the user has reconnected to the new computing device illustrating that the functionality that the user had in methods 400 and 500 surrounding authentication, in respective FIGS. 4 and 5, may be used again in method 600. The mobile device acts as the storage device which may be connected to different computing devices. Method 600 illustrates that the user may use different computing devices but still have an ability use the same computer software and data files from the mobile device.

[0056] In FIG. 7, a process for operating exemplary computer software in a mobile device when implementing an embodiment of the present invention is shown in a method 700. Method 700 illustrates the actions of computer-readable media installed on a mobile device.

[0057] In a step 710, various computer software is loaded onto mobile device 120 or 220. In a step 720, mobile device 120 or 220 receive notifications that a user is attempting to access or operate computer software on mobile device 120 or 220, computing device 110 or 210, or over the Internet 240. The computer software is represented by computer software 112, 127, 212, or 227. In a step 730, data is received at mobile device 120 or 220 associated with the computer software. This data may be in the form of requests to determine the authorization or permitted access for the user. In a step 740, mobile device 120 or 220 operate to aid in determining the authorization for the user to access computer software 112, 127, 212, or 227. Mobile device 120 or 220 uses authentication information stored in the mobile device or at a server or both to aid in the determination of the authorization. As discussed above, in one case, an acknowledgement is provided based on the unique identifier information stored in the mobile device. In another case, a unique identifier is provided as a key. In yet another case, a unique identifier is provided to a server for verification such as for a subscription. In a step 750, information is provided from mobile device 120 or 220, based on the authorization, to computing device 110 or 210 to allow access to computer software 112, 127, 212, or 227.

[0058] Turning now to FIG. 8, a process for using unique identifiers in a mobile device for authenticating a user at a computing device is shown in a method 800. In a step 810, computer software is loaded onto either the mobile device or a first computing device. It was discussed above how the loading process could occur and shall not be discussed here. In a step 820, a unique identifier is provided associated with the computer software. In a step 830, the unique identifier is stored on the mobile device. In a step 840, the computer software is configured or compiled to execute from the mobile device with the unique identifier. In a step 850, the mobile device is connected to the first computing device. In a step 860, a user operates the computer software at the first computing device.

[0059] Steps 810-860 represent implementations of embodiments of the present invention whereby an authentication process occurs to allow access to computer software by the user. The remaining steps illustrate what happens when the mobile is disconnected from the first computing device.

[0060] In a step 870, the mobile device is disconnected from the first computing device and reconnected to a second computing device. Two situations may occur depending on whether the computer software is stored on the mobile device or stored on the first computing device. Where the computer software is stored on the mobile device, the user may operate the computer software from the second computing device. Authentication is probably not needed since the authentication information is provided during initial installation of the computer software on the mobile device where the authentication information resides. However, if the computer software is stored on the second computing device, an authentication process may occur when the mobile device is connected to the second computing device. The mobile device may connect to a server through the Internet to verify access at the second computing. The mobile device may directly provide authentication information to the second computing device to allow access by the user to the computer software stored on the second computing device.

[0061] In a step 880, because the first computing device was disconnected from the mobile device, the user can no longer execute the computer software at the first computing device even when the computer software is stored on the first computing device. The mobile device provides authentication information in the form of the unique identifiers which may be transmitted to the first computing device during the connection between the first computing device and the mobile device. However, if this connection is lost, the computer software at the first computing device cannot verify certain information in the mobile device to enable access. Therefore, access to the computer software is prohibited.

[0062] In a scenario about the present invention, a user owns a mobile phone such as mobile device 120 with a large storage capacity in the gigabyte range. The user loads the computer software such as applications onto the mobile phone. The user also provides unique information that identifies the user with the loaded computer software. A few weeks later, while traveling away from home, the user desires to use a computer located in a hotel business center. The user connects the mobile phone to the hotel's computer using a USB cable. The user turns on the computer and gains access to the mobile phone. The user chooses to execute the computer software that is loaded on the phone. Other software in the mobile phone uses the unique information to allow the user to operate the computer software from the hotel's computer. In this scenario, the user may have pre-loaded authentication information with the computer software when it was initially installed on the mobile phone removing any additional need for re-authentication when the phone is connected to the computer and the computer software is accessed. The scenario enables the user to use the computer software on the mobile phone with different computers.

[0063] Continuing with the scenario discussed above, while the user is operating the computer with computer software 227 in this case, the user may desire to access the Internet 240. The user may initialize a web browser program that is either stored on the computer or stored on the mobile phone as part of computer software 227. The mobile phone handles the connections to the Internet 240 and enables the web data to be transferred to the computer rather than on the display of the mobile phone. Therefore, the user may operate the computer while also accessing the Internet.

[0064] In another scenario, a user purchases an application designed to run from a mobile device. The user provide a unique identifier such as a phone umber or ESN. The computer program is compiled to only run from the mobile device with the unique identifier. The user plugs the mobile device into the computing device at his or her home and the computer program may be executed at the computing device in the home. Later, the user unplugs the mobile device from the computing device in the home and plugs the mobile device into a computing device at his or her office. The computing device in the home can no longer access or execute the computer program while the computing device in the office can execute the computer program.

[0065] In yet another scenario, a user purchases an application designed to run from a mobile device. The computer program uses the Internet to verify the user status for subscription by relaying unique identifiers such as the phone number or ESN. The user plugs the mobile device into the computing device at the user's home and the user may access and execute the application. As in the scenario above, the user unplugs the mobile device from the computing device in the home and plugs the mobile device into a computing device at his or her office. The computing device in the home can no longer access or execute the computer program while the computing device in the office can execute the computer program.

[0066] Although not discussed above, the computer software or application could be a game, a soft phone, or an application such as the MS OFFICE from the Microsoft Corporation of Redmond, Wash. For example, a person may go to work and need the VISIO application developed by the Microsoft Corporation of Redmond, Wash. The application may be loaded in the mobile phone along with data files. The person may run the application from the phone when connected to a computer. When the person is done, the person can unplug the phone keeping the application and data files stored on the phone. Later, the person may plug the phone into another computer have the functionality again.

[0067] The prior discussion is only for illustrative purposes to convey exemplary embodiments. The steps discussed in FIGS. 4-8 may be executed without regards to order. Some steps may be omitted and some steps may be executed at a different time than shown. For example, step 550 may be executed before step 540. Step 840 may be executed before step 830. The point here is to convey that the figures are merely exemplary for the embodiments of the present invention and that other embodiments may be implemented for the present invention.

[0068] Many different arrangements of the various components depicted, as well as components not shown, are possible without departing from the spirit and scope of the present invention. Embodiments of the present invention have been described with the intent to be illustrative rather than restrictive. Alternative embodiments will become apparent to those skilled in the art that do not depart from its scope. A skilled artisan may develop alternative means of implementing the aforementioned improvements without departing from the scope of the present invention.

[0069] It will be understood that certain features and subcombinations are of utility and may be employed without reference to other features and subcombinations and are contemplated within the scope of the claims. Not all steps listed in the various figures need be carried out in the specific order described.