Remote assistance

• US 20030065731A1
• Filed: 10/01/2001
• Published: 04/03/2003
• Est. Priority Date: 10/01/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Mohammed, Mazhar, Kwak, Justin, Bhattacharjee, Avronil
• Granted Patent: US 6,973,482 B2
• Time in Patent Office: Days
• US Class Current: 709/208
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Systems and methods for remote assistance. A user computer is able to generate a ticket that includes temporary credentials for a remote assistance account of the user computer. The ticket is escalated to an expert, who activates the ticket and requests a connection with the user using the encrypted credentials. The user can accept this request if the credentials are validated and provide the expert with a view of the user'"'"'s desktop. The expert, if necessary, can request control of the user computer and the user can either grant or deny this request. If granted, the user computer can unilaterally terminate the control that was provided to the expert. Because the credentials in the ticket are encrypted, the expert does not know the actual password to the remote assistance account and can only access the user computer interactively.

Claims

1. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a method for requesting support services from the expert that permits the expert to control the user computer such that the user receives support services from the expert, the method comprising:

a step for generating a ticket on the user computer, the ticket including credentials that permit the expert computer to login to the user computer;

a step for escalating the ticket to the expert computer;

a step for receiving a connection request from the expert computer indicating that the expert computer desires to connect with the user computer;

a step for accepting the connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer;

a step for receiving a control request from the expert computer to remotely control the user computer over the network; and

a step for providing control of the user computer to the expert computer such that the expert is able to control the user computer.

2. A method as defined in claim 1, wherein the step for generating a ticket on the user computer further comprises an act of encrypting a password to a remote assistance account that is on the user computer, wherein the encrypted password in included in the ticket and the unencrypted password is unknown to the expert computer.

3. A method as defined in claim 1, wherein the step for generating a ticket on the user computer further comprises an act of generating a key that is associated with a table that maintains outstanding remote assistance requests, wherein an encrypted version of the key is included in the ticket and wherein the unencrypted key is unknown to the expert computer.

4. A method as defined in claim 1, wherein the ticket comprises a hashed value of a public key of the user computer, wherein the expert validates the public key of the user to insure that the expert is assisting the user that generated the ticket.

5. A method as defined in claim 1, wherein the step for escalating, the ticket to the expert computer further comprises one or more of:

transmitting the ticket in an email to the expert;

transmitting the ticket to the expert over instant messaging; and

transmitting the ticket to the expert by saving the ticket to a file.

6. A method as defined in claim 1, wherein the step for escalating the ticket to the expert computer further comprises:

a step for receiving an unsolicited call from the expert; and

a step for determining that the expert is in a designated group maintained on the user computer.

7. A method as defined in claim 1, wherein the step for accepting the connection request further comprises an act of verifying the credentials provided by the expert computer.

8. A method as defined in claim 1, wherein the step for providing control of the user computer to the expert computer such that the expert is able to view and control the user computer further comprises a step for allowing the user to unilaterally terminate the control granted to the expert computer.

9. A method as defined in claim 1, wherein the step for accepting the connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer further comprises establishing a shadow session on the user computer, wherein the expert has limited privileges on the user computer.

10. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a computer program product for implementing a method for requesting support services from the expert that permits the expert to control the user computer such that the user receives support services from the expert, the computer program product comprising:

a computer readable medium having computer executable instructions for performing the method, the method comprising;

a step for generating a ticket on the user computer, the ticket including credentials that permit the expert computer to login to the user computer;

a step for escalating the ticket to the expert computer;

a step for receiving a connection request from the expert computer indicating that the expert computer desires to connect with the user computer;

a step for accepting the connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer;

a step for receiving a control request from the expert computer to remotely control the user computer over the network; and

a step for providing control of the user computer to the expert computer such that the expert is able to control the user computer.

11. A computer program product as defined in claim 10, wherein the step for generating a ticket on the user computer further comprises an act of encrypting a password to a remote assistance account that is on the user computer, wherein the encrypted password in included in the ticket and the unencrypted password is unknown to the expert computer.

12. A computer program product as defined in claim 10, wherein the step for generating a ticket on the user computer further comprises an act of generating a key that is associated with a table that maintains outstanding remote assistance requests, wherein an encrypted version of the key is included in the ticket and wherein the unencrypted key is unknown to the expert computer.

13. A computer program product as defined in claim 10, wherein the ticket comprises a hashed value of a public key of the user computer, wherein the expert validates the public key of the user to insure that the expert is assisting the user that generated the ticket.

14. A computer program product as defined in claim 10, wherein the step for escalating the ticket to the expert computer further comprises one or more of:

transmitting the ticket in an email to the expert;

transmitting the ticket to the expert over instant messaging; and

transmitting the ticket to the expert by saving the ticket to a file.

15. A computer program product as defined in claim 10, wherein the step for escalating the ticket to the expert computer further comprises:

a step for receiving an unsolicited call from the expert; and

a step for determining that the expert is in a designated group maintained on the user computer.

16. A computer program product as defined in claim 10, wherein the step for accepting the connection request further comprises an act of verifying the credentials provided by the expert computer.

17. A computer program product as defined in claim 10, wherein the step for providing control of the user computer to the expert computer such that the expert is able to view and control the user computer further comprises a step for allowing the user to unilaterally terminate the control granted to the expert computer.

18. A computer program product as defined in claim 10, wherein the step for accepting t he connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer further comprises establishing a shadow session on the user computer, wherein the expert has limited privileges on the user computer.

19. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a method for remotely controlling the user computer from the expert computer such that the expert is able to provide support services to the user, the method comprising:

a step for receiving a ticket from the user computer, wherein the ticket includes encrypted credentials;

a step for activating the ticket;

in response to activating the ticket, a step for requesting a connection with the user computer over the network using the credentials in the ticket, wherein an expert is able to view a desktop of the user computer if the connection request is granted by the user computer;

requesting control of the user computer; and

controlling the user computer from the expert computer over the connection such that the expert is able to provide support services to the user, wherein the expert is still able to view the desktop of the user computer even if the request to control the user computer is denied.

20. A method as defined in claim 19, wherein the step for receiving a ticket from the user computer further comprises one or more of:

receiving the ticket over email from the user;

receiving the ticket over an instant message from the user; and

retrieving the ticket from a file.

21. A method as defined in claim 19, wherein the step for requesting a connection with the user computer over the network using the credentials in the ticket further comprises an act of inserting a cryptographically random challenge in the response, wherein the cryptographically random challenge is related to a shared secret between the expert and the user.

22. A method as defined in claim 19, wherein the step for controlling the user computer from the expert computer further comprises an act of controlling a keyboard of the user and a mouse of the user, wherein the expert has access to data stored on the user computer.

23. A method as defined in claim 19, wherein the step for requesting a connection with the user computer over the network further comprises one or more of:

an act of establishing a terminal server behind a firewall of the expert, wherein the connection with the user goes through the terminal server such that the expert computer is not included in a domain of the user computer;

an act of initiating a connection with the user computer through a broker server if the user computer is behind a network address translation, wherein a expert ticket generated by the expert is sent to the broker server.

24. A method as defined in claims 19, further comprising a step for directing an unsolicited remote assistance call to the user computer before the step for receiving a ticket from the user computer.

25. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a computer program product for implementing a method for remotely controlling the user computer from the expert computer such that the expert is able to provide support services to the user, the computer program product comprising:

a computer readable medium having computer readable instructions for performing the method, the method comprising;

a step for receiving a ticket from the user computer, wherein the ticket includes encrypted credentials;

a step for activating the ticket;

in response to activating the ticket, a step for requesting a connection with the user computer over the network using the credentials in the ticket, wherein an expert is able to view a desktop of the user computer if the connection request is granted by the user computer;

requesting control of the user computer; and

controlling the user computer from the expert computer over the connection such that the expert is able to provide support services to the user, wherein the expert is still able to view the desktop of the user computer even if the request to control the user computer is denied.

26. A computer program product as defined in claim 25, wherein the step for receiving a ticket from the user computer further comprises one or more of:

receiving the ticket over email from the user;

receiving the ticket over an instant message from the user; and

retrieving the ticket from a file.

27. A computer program product as defined in claim 25, wherein the step for requesting a connection with the user computer over the network using the credentials in the ticket further comprises an act of inserting a cryptographically random challenge in the response, wherein the cryptographically random challenge is related to a shared secret between the expert and the user.

28. A computer program product as defined in claim 25, wherein the step for controlling the user computer from the expert computer further comprises an act of controlling a keyboard of the user and a mouse of the user, wherein the expert has access to data stored on the user computer.

29. A computer program product as defined in claim 25, wherein the step for requesting a connection with the user computer over the network further comprises one or more of:

an act of establishing a terminal server behind a firewall of the expert, wherein the connection with the user goes through the terminal server such that the expert computer is not included in a domain of the user computer;

an act of initiating a connection with the user computer through a broker server if the user computer is behind a network address translation, wherein a expert ticket generated by the expert is sent to the broker server.

30. A computer program product as defined in claims 25, further comprising a step for directing an unsolicited remote assistance call to the user computer before the step for receiving a ticket from the user computer.

31. In a system that includes a user computer connection with at least one expert computer over a network, wherein a user requires support services for the user computer and an expert is able to provide support services to the user computer, a method for requesting support services from an expert that enables the expert to view or control the user computer, the method comprising:

a step for creating a table to store outstanding remote assistance requests, wherein each row of the table corresponds to a particular ticket that was sent to an expert and wherein the table has an associated key;

an act of creating a new entry in the table when a new ticket is created, wherein each row of the table comprises a security identifier of the user, a session identifier and a timeout value;

a step for escalating a ticket to an expert; and

when a connection request is received from an expert that received a ticket, a step for verifying the credentials by decrypting the key and a password, wherein the connection request is granted if the key in the connection request is same as the key associated with the table and if the password in the connection request is the same as a remote assistance account password of the user computer.

32. A method as defined in claim 31, wherein the step for creating a new entry in the table further comprises a step for generating a ticket that is sent to an expert.

33. A method as defined in claim 32, wherein the step for generating a ticket further comprises:

inserting a hash of a public key of the user computer in the ticket;

encrypting the remote assistance account password and inserting the encrypted password to the remote assistance account in the ticket;

encrypting the key associated with the table and inserting the encrypted key in the ticket; and

inserting an address and one or more ports in the ticket.

34. A method as defined in claim 31, wherein the step for creating a table to manage outstanding remote assistance requests further comprises an act of changing the remote assistance account password associated with the table each time the number of remote assistance requests in the table goes to zero such that connection requests from experts having an old remote assistance account password are failed.

35. A method as defined in claim 31, wherein the step for escalating the ticket further comprises one of:

an act of transmitting the ticket to the expert over email;

an act of transmitting the ticket to the expert over instant messaging; and

an act of saving the ticket to a file.

36. A method as defined in claim 31, further comprising:

an act of prompting the user that the ticket has been activated and that the expert desires to establish a connection with the user;

an

an act of providing the expert with a view of a desktop of the user computer if the user accepts the connection request from the expert.

37. A method as defined in claim 35, further comprising:

an act of receiving a control request from the expert that would enable the expert to control the user computer; and

an act of accepting the control request such that the expert shares control of the user computer with the user, wherein the control of the user computer granted to the expert can be unilaterally terminated by the user.

38. In a system that includes a user computer connection with at least one expert computer over a network, wherein a user requires support services for the user computer and an expert is able to provide support services to the user computer that, a computer program product for implementing a method for requesting support services from an expert that enables the expert to view or control the user computer, the computer program product comprising:

a computer readable medium having computer executable instructions for performing the method, the method comprising;

a step for creating a table to store outstanding remote assistance requests, wherein each row of the table corresponds to a particular ticket that was sent to an expert and wherein the table has an associated key;

an act of creating a new entry in the table when a new ticket is created, wherein each row of the table comprises a security identifier of the user, a session identifier and a timeout value;

a step for escalating a ticket to an expert; and

when a connection request is received from an expert that received a ticket, a step for verifying the credentials by decrypting the key and a password, wherein the connection request is granted if the key in the connection request is same as the key associated with the table and if the password in the connection request is the same as a remote assistance account password of the user computer.

39. A computer program product as defined in claim 38, wherein the step for creating a new entry in the table further comprises a step for generating a ticket that is sent to an expert.

40. A computer program product as defined in claim 39, wherein the step for generating a ticket further comprises:

inserting a hash of a public key of the user computer in the ticket;

encrypting the remote assistance account password and inserting the encrypted password to the remote assistance account in the ticket;

encrypting the key associated with the table and inserting the encrypted key in the ticket; and

inserting an address and one or more ports in the ticket.

41. A computer program product as defined in claim 38, wherein the\a step for creating a table to manage outstanding remote assistance requests further comprises an act of changing the key associated with the table each time the number of remote assistance requests in the table goes to zero such that connection requests from experts having an old key are failed.

42. A computer program product as defined in claim 38, wherein the step for escalating the ticket further comprises one of:

an act of transmitting the ticket to the expert over email;

an act of transmitting the ticket to the expert over instant messaging; and

an act of saving the ticket to a file.

43. A computer program product as defined in claim 38, further comprising:

an act of prompting the user that the ticket has been activated and that the expert desires to establish a connection with the user;

an

an act of providing the expert with a view of a desktop of the user computer if the user accepts the connection request from the expert.

44. A computer program product as defined in claim 43, further comprising:

an act of receiving a control request from the expert that would enable the expert to control the user computer; and

an act of accepting the control request such that the expert shares control of the user computer with the user, wherein the control of the user computer granted to the expert can be unilaterally terminated by the user.

45. In a system including one or more user computers that are able to receive support from a support service, a method for providing support services to the one or more user computers by having the support service remotely view or control the one or more user computers, the method comprising:

a step for receiving a ticket from a user at a terminal server, wherein the terminal server is behind a firewall of the support service;

a step for logging in to the terminal server by the support service;

a step for activating the ticket at the terminal server such that a network of the support service is not included in a domain of the user computer;

a step for requesting a connection with the user computer, wherein a view of a desktop of the user computer is received if the connection request is granted by the user; and

a step for requesting control of the user computer, wherein the support service has control of the user computer if the control request is granted.

46. A method as defined in claim 45, wherein the step for requesting a connection with the user computer further comprises an act of providing credentials to the user computer, wherein the credentials are obtained from the ticket and are encrypted such that the support service does not have the actual credentials.

47. In a system that includes a user computer and an expert computer connected by a network, a method for accessing the user computer by the expert computer in a manner that permits the user computer to control the access that is granted to the expert computer, the method comprising:

generating a ticket that includes credentials that comprise an encrypted remote assistance account password and an encrypted key;

escalating the ticket to the expert computer, wherein the expert has possession of the ticket, wherein possession of the ticket is required to access the user computer and wherein the remote assistance account password and the key are unknown to the expert computer;

generating a connection request that includes the credentials, wherein the credentials are decrypted by the user computer; and

granting access to the expert computer if the decrypted remote assistance account password is validated and if the key is still valid and has not been changed.

48. A method as defined in claim 47, wherein generating a ticket further comprises inserting a hash of a public key of the user computer in the ticket.

49. A method as defined in claim 47, wherein the key is associated with a table of outstanding remote assistance requests, wherein each entry in the table is associated with a particular ticket.

50. A method as defined in claim 47, further comprising changing the key when the outstanding remote assistance requests go to zero.