Remote assistance

• US 6,973,482 B2
• Filed: 10/01/2001
• Issued: 12/06/2005
• Est. Priority Date: 10/01/2001
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kwak, Justin, Mohammed, Mazhar, Bhattacharjee, Avronil
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Hamza, Faruk
• Application Number:
  US09/968,382
• Publication Number:
  US 20030065731A1
• Time in Patent Office: 1,527 Days
• Field of Search: 709/223, 709/224, 709/204, 709208-211, 709202-203, 709/226, 713/150, 713/176, 713/182, 713/187, 713189-191, 713201-202
• US Class Current: 709/208
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Systems and methods for remote assistance. A user computer is able to generate a ticket that includes temporary credentials for a remote assistance account of the user computer. The ticket is escalated to an expert, who activates the ticket and requests a connection with the user using the encrypted credentials. The user can accept this request if the credentials are validated and provide the expert with a view of the user'"'"'s desktop. The expert, if necessary, can request control of the user computer and the user can either grant or deny this request. If granted, the user computer can unilaterally terminate the control that was provided to the expert. Because the credentials in the ticket are encrypted, the expert does not know the actual password to the remote assistance account and can only access the user computer interactively.

Claims

1. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a method for requesting support services from the expert that permits the expert to control the user computer such that the user receives support services from the expert, the method comprising:

a step for generating a ticket on the user computer, the ticket including credentials that permit the expert computer to login to the user computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password;

a step for escalating the ticket to the expert computer which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials;

in response to the user initiated request for remote assistance, a step for receiving a connection request from the expert computer indicating that the expert computer desires to connect with the user computer, the request to connect including the credentials;

a step for accepting the connection request upon verifying the credentials by at least decrypting the password, and wherein upon accepting the connection request the expert computer is able to view a desktop of the user computer without initially being able to control the user computer; and

upon subsequently receiving a control request from the expert computer to remotely control the user computer over the network, a step for selectively providing control of the user computer to the expert computer, such that the expert is able to control the user computer, but wherein the user is able to unilaterally terminate the selective control.

2. A method as defined in claim 1, wherein the step for generating a ticket on the user computer further comprises an act of generating a key that is associated with a table that maintains outstanding remote assistance requests, wherein an encrypted version of the key is included in the ticket and wherein the unencrypted key is unknown to the expert computer.

3. A method as defined in claim 1, wherein the ticket comprises a hashed value of a public key of the user computer, wherein the expert validates the public key of the user to insure that the expert is assisting the user that generated the ticket.

4. A method as defined in claim 1, wherein the step for escalating the ticket to the expert computer further comprises one or more of:

transmitting the ticket in an email to the expert;

transmitting the ticket to the expert over instant messaging; and

transmitting the ticket to the expert by saving the ticket to a file.

5. A method as defined in claim 1, wherein the step for escalating the ticket to the expert computer further comprises:

a step for receiving an unsolicited call from the expert; and

a step for determining that the expert is in a designated group maintained on the user computer.

6. A method as defined in claim 1, wherein the step for providing control of the user computer to the expert computer such that the expert is able to view and control the user computer further comprises a step for allowing the user to unilaterally terminate the control granted to the expert computer by selecting a predetermined key at the user computer.

7. A method as defined in claim 1, wherein the step for accepting the connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer further comprises establishing a shadow session on the user computer, wherein the expert has limited privileges on the user computer.

8. A method as recited in claim 1, wherein the method further includes having the expert computer and the user computer login to a terminal server to prevent the user computer from gaining access to the expert computer.

9. A method as recited in claim 1, wherein the credentials further include an encrypted key that is associated with a table of outstanding user requests for remote assistance that is stored at the user computer, and wherein the changes to a value of the key stored at the user computer makes the key included in the ticket invalid;

wherein the value of the encrypted key is unknown to the expert computer; and

wherein access to the user computer is granted to the expert computer only upon first determining that the key is still valid when the request from the expert computer is received.

10. A method as defined in claim 9, wherein generating a ticket further comprises inserting a hash of a public key of the user computer in the ticket.

11. A method as defined in claim 9, wherein the key is associated with a table of outstanding remote assistance requests, wherein each entry in the table is associated with a particular ticket.

12. A method as defined in claim 9, further comprising changing the key when the outstanding remote assistance requests go to zero.

13. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, one or more computer readable media for implementing a method for requesting support services from the expert that permits the expert to control the user computer such that the user receives support services from the expert, the computer readable media comprising:

a computer readable storage having computer executable instructions for performing the method, the method comprising;

a step for generating a ticket on the user computer, the ticket including credentials that permit the expert computer to login to the user computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password;

a step for escalating the ticket to the expert computer which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials;

in response to the user initiated request for remote assistance, a step for receiving a connection request from the expert computer indicating that the expert computer desires to connect with the user computer, the request to connect including the credentials;

a step for accepting the connection request upon verifying the credentials by at least decrypting the password, and wherein upon accepting the connection request the expert computer is able to view a desktop of the user computer without initially being able to control the user computer; and

upon subsequently receiving a control request from the expert computer to remotely control the user computer over the network, a step for selectively providing control of the user computer to the expert computer, such that the expert is able to control the user computer, but wherein the user is able to unilaterally terminate the selective control.

14. A computer readable media as defined in claim 13, wherein the step for generating a ticket on the user computer further comprises an act of generating a key that is associated with a table that maintains outstanding remote assistance requests, wherein an encrypted version of the key is included in the ticket and wherein the unencrypted key is unknown to the expert computer.

15. A computer readable media as defined in claim 13, wherein the ticket comprises a hashed value of a public key of the user computer, wherein the expert validates the public key of the user to insure that the expert is assisting the user that generated the ticket.

16. A computer readable media as defined in claim 13, wherein the step for escalating the ticket to the expert computer further comprises one or more of:

transmitting the ticket in an email to the expert;

transmitting the ticket to the expert over instant messaging; and

transmitting the ticket to the expert by saving the ticket to a file.

17. A computer readable media as defined in claim 13, wherein the step for escalating the ticket to the expert computer further comprises:

a step for receiving an unsolicited call from the expert; and

a step for determining that the expert is in a designated group maintained on the user computer.

18. A computer readable media as defined in claim 13, wherein the step for providing control of the user computer to the expert computer such that the expert is able to view and control the user computer further comprises a step for allowing the user to unilaterally terminate the control granted to the expert computer by selecting a predetermined key at the user computer.

19. A computer readable media as defined in claim 13, wherein the step for accepting the connection request such that the expert computer is able to view a desktop of the user computer but cannot control the user computer further comprises establishing a shadow session on the user computer, wherein the expert has limited privileges on the user computer.

20. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, a method for remotely controlling the user computer from the expert computer such that the expert is able to provide support services to the user, the method comprising:

a step for receiving a ticket from the user computer that indicates a user initiated request for support services from the expert computer, wherein the ticket includes encrypted credentials having at least an encrypted portion and at least an encrypted password;

a step for activating the ticket by at least decrypting the encrypted portion of the credentials, but wherein by decrypting the encrypted portion the expert computer is unable to decrypt the encrypted password;

in response to activating the ticket, a step for requesting a connection with the user computer over the network using the credentials in the ticket, wherein the connection request is granted by the user computer upon the user computer verifying the credentials by at least decrypting the password, and wherein the expert computer is initially only able to view a desktop of the user computer without being able to control the user computer when the connection request is granted by the user computer; and

subsequently, upon requesting control of the user computer, receiving selective control to the user computer such that the expert is able to provide the requested support services to the user, wherein the expert is still able to view the desktop of the user computer even if the request to control the user computer is denied, and wherein the user can unilaterally terminate the selective control.

21. A method as defined in claim 20, wherein the step for receiving a ticket from the user computer further comprises one or more of:

receiving the ticket over email from the user;

receiving the ticket over an instant message from the user; and

retrieving the ticket from a file.

22. A method as defined in claim 20, wherein the step for requesting a connection with the user computer over the network using the credentials in the ticket further comprises an act of inserting a cryptographically random challenge in the response, wherein the cryptographically random challenge is related to a shared secret between the expert and the user.

23. A method as defined in claim 20, wherein the step for controlling the user computer from the expert computer further comprises an act of controlling a keyboard of the user and a mouse of the user, wherein the expert has access to data stored on the user computer.

24. A method as defined in claim 20, wherein the step for requesting a connection with the user computer over the network further comprises one or more of:

an act of establishing a terminal server behind a firewall of the expert, wherein the connection with the user goes through the terminal server such that the expert computer is not included in a domain of the user computer;

an act of initiating a connection with the user computer through a broker server if the user computer is behind a network address translation, wherein a expert ticket generated by the expert is sent to the broker server.

25. A method as defined in claims 20, further comprising a step for directing an unsolicited remote assistance call to the user computer before the step for receiving a ticket from the user computer.

26. In a system that includes a user computer and an expert computer connected with a network, wherein a user requires support services for the user computer and the expert is able to provide support services to the user, one or more computer readable media for implementing a method for remotely controlling the user computer from the expert computer such that the expert is able to provide support services to the user, the computer readable media comprising:

a computer readable storage having computer readable instructions for performing the method, the method comprising;

a step for receiving a ticket from the user computer that indicates a user initiated request for support services from the expert computer, wherein the ticket includes encrypted credentials having at least an encrypted portion and at least an encrypted password;

a step for activating the ticket by at least decrypting the encrypted portion of the credentials, but wherein by decrypting the encrypted portion the expert computer is unable to decrypt the encrypted password;

in response to activating the ticket, a step for requesting a connection with the user computer over the network using the credentials in the ticket, wherein the connection request is granted by the user computer upon the user computer validating the credentials by at least decrypting the password, and wherein the expert computer is initially only able to view a desktop of the user computer without being able to control the user computer when the connection request is granted by the user computer; and

subsequently, upon requesting control of the user computer, receiving selective control to the user computer such that the expert is able to provide the requested support services to the user, wherein the expert is still able to view the desktop of the user computer even if the request to control the user computer is denied, and wherein the user can unilaterally terminate the selective control.

27. A computer readable media as defined in claim 26, wherein the step for receiving a ticket from the user computer further comprises one or more of:

receiving the ticket over email from the user;

receiving the ticket over an instant message from the user; and

retrieving the ticket from a file.

28. A computer readable media as defined in claim 26, wherein the step for requesting a connection with the user computer over the network using the credentials in the ticket further comprises an act of inserting a cryptographically random challenge in the response, wherein the cryptographically random challenge is related to a shared secret between the expert and the user.

29. A computer readable media as defined in claim 26, wherein the step for controlling the user computer from the expert computer further comprises an act of controlling a keyboard of the user and a mouse of the user, wherein the expert has access to data stored on the user computer.

30. A computer readable media as defined in claim 26, wherein the step for requesting a connection with the user computer over the network further comprises one or more of:

an act of establishing a terminal server behind a firewall of the expert, wherein the connection with the user goes through the terminal server such that the expert computer is not included in a domain of the user computer;

an act of initiating a connection with the user computer through a broker server if the user computer is behind a network address translation, wherein a expert ticket generated by the expert is sent to the broker server.

31. A computer readable media as defined in claim 26, further comprising a step for directing an unsolicited remote assistance call to the user computer before the step for receiving a ticket from the user computer.

32. In a system that includes a user computer connection with at least one expert computer over a network, wherein a user requires support services for the user computer and an expert is able to provide support services to the user computer, a method for requesting support services from an expert that enables the expert to view or control the user computer, the method comprising:

a step for creating a table to store outstanding remote assistance requests, wherein each row of the table corresponds to a particular ticket that was sent to an expert to initiate a remote assistance request, the ticket the ticket including credentials that permit the expert computer to login to the user computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password and a key that is associated with the table;

an act of creating a new entry in the table when a new ticket is created, wherein each row of the table comprises a security identifier of the user, a session identifier and a timeout value;

a step for escalating a ticket to an expert which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials; and

when a corresponding and subsequent connection request is received from an expert that received a ticket, the connection request including the credentials, a step for verifying the credentials by decrypting the key and a password, wherein the connection request is granted if the key in the connection request is same as the key associated with the table and if the password in the connection request is the same as a remote assistance account password of the user computer, and wherein granting the connection request enables the expert computer to view a desktop of the user computer without being able to control the user computer unless control to the user computer is subsequently granted by the user computer.

33. A method as defined in claim 32, wherein the step for creating a new entry in the table further comprises a step for generating a ticket that is sent to an expert.

34. A method as defined in claim 33, wherein the step for generating a ticket further comprises:

inserting a hash of a public key of the user computer in the ticket;

encrypting the remote assistance account password and inserting the encrypted password to the remote assistance account in the ticket;

encrypting the key associated with the table and inserting the encrypted key in the ticket; and

inserting an address and one or more ports in the ticket.

35. A method as defined in claim 32, wherein the step for creating a table to manage outstanding remote assistance requests further comprises an act of changing the remote assistance account password associated with the table each time the number of remote assistance requests in the table goes to zero such that connection requests from experts having an old remote assistance account password are failed.

36. A method as defined in claim 32, wherein the step for escalating the ticket further comprises one of:

an act of transmitting the ticket to the expert over email;

an act of transmitting the ticket to the expert over instant messaging; and

an act of saving the ticket to a file.

37. A method as defined in claim 32, further comprising:

an act of prompting the user that the ticket has been activated and that the expert desires to establish a connection with the user;

an

an act of providing the expert with a view of a desktop of the user computer if the user accepts the connection request from the expert.

38. A method as defined in claim 36, further comprising:

an act of receiving a control request from the expert that would enable the expert to control the user computer; and

an act of accepting the control request such that the expert shares control of the user computer with the user, wherein the control of the user computer granted to the expert can be unilaterally terminated by the user.

39. In a system that includes a user computer connection with at least one expert computer over a network, wherein a user requires support services for the user computer and an expert is able to provide support services to the user computer that, one or more computer readable media for implementing a method for requesting support services from an expert that enables the expert to view or control the user computer, the computer readable media comprising:

a computer readable storage having computer executable instructions for performing the method, the method comprising;

a step for creating a table to store outstanding remote assistance requests, wherein each row of the table corresponds to a particular ticket that was sent to an expert to initiate a remote assistance request, the ticket the ticket including credentials that permit the expert computer to login to the user computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password and a key that is associated with the table;

an act of creating a new entry in the table when a new ticket is created, wherein each row of the table comprises a security identifier of the user, a session identifier and a timeout value;

a step for escalating a ticket to an expert which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials; and

when a corresponding and subsequent connection request is received from an expert that received a ticket, the connection request including the credentials, a step for verifying the credentials by decrypting the key and a password, wherein the connection request is granted if the key in the connection request is same as the key associated with the table and if the password in the connection request is the same as a remote assistance account password of the user computer, and wherein granting the connection request enables the expert computer to view a desktop of the user computer without being able to control the user computer unless control to the user computer is subsequently granted by the user computer.

40. A computer readable media as defined in claim 39, wherein the step for creating a new entry in the table further comprises a step for generating a ticket that is sent to an expert.

41. A computer readable media as defined in claim 40, wherein the step for generating a ticket further comprises:

inserting a hash of a public key of the user computer in the ticket;

encrypting the remote assistance account password and inserting the encrypted password to the remote assistance account in the ticket;

encrypting the key associated with the table and inserting the encrypted key in the ticket; and

inserting an address and one or more ports in the ticket.

42. A computer readable media as defined in claim 39, wherein the step for creating a table to manage outstanding remote assistance requests further comprises an act of changing the key associated with the table each time the number of remote assistance requests in the table goes to zero such that connection requests from experts having an old key are failed.

43. A computer readable media as defined in claim 39, wherein the step for escalating the ticket further comprises one of:

an act of transmitting the ticket to the expert over email;

an act of transmitting the ticket to the expert over instant messaging; and

an act of saving the ticket to a file.

44. A computer readable media as defined in claim 39, further comprising:

an act of prompting the user that the ticket has been activated and that the expert desires to establish a connection with the user;

an

an act of providing the expert with a view of a desktop of the user computer if the user accepts the connection request from the expert.

45. A computer readable media as defined in claim 44, further comprising:

an act of receiving a control request from the expert that would enable the expert to control the user computer; and

an act of accepting the control request such that the expert shares control of the user computer with the user, wherein the control of the user computer granted to the expert can be unilaterally terminated by the user.