Remote assistance

• US 20050289226A1
• Filed: 08/30/2005
• Published: 12/29/2005
• Est. Priority Date: 10/01/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kwak, Justin, Mohammed, Mazhar, Bhattacharjee, Avronil
• Granted Patent: US 7,539,733 B2
• Time in Patent Office: Days
• US Class Current: 709/208
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5074 Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Systems and methods for remote assistance. A user computer is able to generate a ticket that includes temporary credentials for a remote assistance account of the user computer. The ticket is escalated to an expert, who activates the ticket and requests a connection with the user using the encrypted credentials. The user can accept this request if the credentials are validated and provide the expert with a view of the user'"'"'s desktop. The expert, if necessary, can request control of the user computer and the user can either grant or deny this request. If granted, the user computer can unilaterally terminate the control that was provided to the expert. Because the credentials in the ticket are encrypted, the expert does not know the actual password to the remote assistance account and can only access the user computer interactively.

Claims

1. A client computer in a system that includes the client computer and an expert computer connected with a network, wherein a user of the client computer requires support services for the client computer and the expert is able to provide support services to the user, the client computer comprising one or more computer readable storage media having computer-executable instructions for implementing a method for requesting support services from the expert that permits the expert to control the user computer and such that the user receives support services from the expert, wherein the method comprises:

a step for generating a ticket on the client computer, the ticket including credentials that permit the expert computer to login to the client computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password;

a step for escalating the ticket to the expert computer which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials;

in response to the user initiated request for remote assistance, a step for receiving a connection request from the expert computer indicating that the expert computer desires to connect with the user computer, the request to connect including the credentials;

a step for accepting the connection request upon verifying the credentials by at least decrypting the password, and wherein upon accepting the connection request the expert computer is able to view a desktop of the client computer without initially being able to control the client computer; and

upon subsequently receiving a control request from the expert computer to remotely control the user computer over the network, a step for selectively providing control of the client computer to the expert computer, such that the expert is able to control the client computer, but wherein the user is able to unilaterally terminate the selective control.

3. A client computer as defined in claim 1, wherein the step for generating a ticket on the user computer further comprises an act of generating a key that is associated:

with a table that maintains outstanding remote assistance requests, wherein an encrypted version of the key is included in the ticket and wherein the unencrypted key is unknown to the expert computer.

4. A client computer as defined in claim 1, wherein the ticket comprises a hashed value of a public key of the client computer, wherein the expert validates the public key of the user to insure that the expert is assisting the user that generated the ticket.

5. A client computer as defined in claim 1, wherein the step for escalating the ticket to the expert computer further comprises one or more of

transmitting the ticket in an email to the expert;

transmitting the ticket to the expert over instant messaging; and

transmitting the ticket to the expert by saving the ticket to a file.

6. A client computer as defined in claim 1, wherein the step for escalating the ticket to the expert computer further comprises:

a step for receiving an unsolicited call from the expert; and

a step for determining that the expert is in a designated group maintained on the client computer.

8. A client computer as defined in claim 1, wherein the step for providing control of the client computer to the expert computer such that the expert is able to view and control the user computer further comprises a step for allowing the user to unilaterally terminate the control granted to the expert computer by selecting a predetermined key at the client computer.

9. A client computer as defined in claim 1, wherein the step for accepting the connection request such that the expert computer is able to view a desktop of the client computer but cannot control the client computer further comprises establishing a shadow session on the user computer, wherein the expert has limited privileges on the client computer.

10. An expert computer in a system that includes a user computer and an expert computer connected within a network, wherein a user requires support services for the user computer and the expert computer is able to provide support services to the user, the expert computer comprising one or more computer-readable storage media having computer-executable instructions for implementing a method for remotely controlling the user computer from the expert computer such that the expert computer is able to provide support services to the user, wherein the method comprises:

a step for receiving a ticket from the user computer that indicates a user initiated request for support services from the expert computer, wherein the ticket includes encrypted credentials having at least an encrypted portion and at least an encrypted password;

a step for activating the ticket by at least decrypting the encrypted portion of the credentials, but wherein by decrypting the encrypted portion the expert computer is unable to decrypt the encrypted password;

in response to activating the ticket, a step for requesting a connection with the user computer over the network using the credentials in the ticket, wherein the connection request is granted by the user computer upon the user computer verifying the credentials by at least decrypting the password, and wherein the expert computer is initially only able to view a desktop of the user computer without being able to control the user computer when the connection request is granted by the user computer; and

subsequently, upon requesting control of the user computer, receiving selective control to the user computer such that the expert is able to provide the requested support services to the user, wherein the expert computer is still able to view the desktop of the user computer even if the request to control the user computer is denied, and wherein the user can unilaterally terminate the selective control.

11. An expert computer as defined in claim 10, wherein the step for receiving a ticket from the user computer further comprises one or more of:

receiving the ticket over email from the user;

receiving the ticket over an instant message from the user; and

retrieving the ticket from a file.

12. An expert computer as defined in claim 10, wherein the step for requesting a connection with the user computer over the network using the credentials in the ticket further comprises an act of inserting a cryptographically random challenge in the response, wherein the cryptographically random challenge is related to a shared secret between the expert and the user.

13. An expert computer as defined in claim 10, wherein the step for controlling the user computer from the expert computer further comprises an act of controlling a keyboard of the user and a mouse of the user, wherein the expert has access to data stored on the user computer.

14. An expert computer as defined in claim 10, wherein the step for requesting a connection with the user computer over the network further comprises one or more of:

an act of establishing a terminal server behind a firewall of the expert, wherein the connection with the user goes through the terminal server such that the expert computer is not included in a domain of the user computer;

an act of initiating a connection with the user computer through a broker server if the user computer is behind a network address translation, wherein a expert ticket generated by the expert is sent to the broker server.

15. An expert computer as defined in claim 10, wherein the method further comprises a step for directing an unsolicited remote assistance call to the user computer before the step for receiving a ticket from the user computer.

16. A user computer in a system that includes the user computer and at least one expert computer connected over a network, wherein a user requires support services for the user computer and an expert is able to provide support services to the user computer, the user computer comprising one or more computer-readable storage media having computer executable instructions for implementing a method for requesting support services from an expert that enables the expert to view or control the user computer, and wherein the method comprises:

a step for creating a table to store outstanding remote assistance requests, wherein each row of the table corresponds to a particular ticket that was sent to an expert to initiate a remote assistance request, the ticket including credentials that permit the expert computer to login to the user computer at the user'"'"'s request, the credentials including at least an encrypted portion that includes at least an encrypted password and a key that is associated with the table;

an act of creating a new entry in the table when a new ticket is created, wherein each row of the table comprises a security identifier of the user, a session identifier and a timeout value;

a step for escalating a ticket to an expert which initiates a user request for remote assistance for support services from the expert computer, and wherein the expert computer is unable to decrypt the password even upon decrypting the encrypted portion of the credentials; and

when a corresponding and subsequent connection request is received from an expert that received a ticket, the connection request including the credentials, a step for verifying the credentials by decrypting the key and a password, wherein the connection request is granted if the key in the connection request is same as the key associated with the table and if the password in the connection request is the same as a remote assistance account password of the user computer, and wherein granting the connection request enables the expert computer to view a desktop of the user computer without being able to control the user computer unless control to the user computer is subsequently granted by the user computer.

17. A user computer as defined in claim 16, wherein the step for creating a new entry in the table further comprises a step for generating a ticket that is sent to an expert.

18. A user computer as defined in claim 17, wherein the step for generating a ticket further comprises:

inserting a hash of a public key of the user computer in the ticket;

encrypting the remote assistance account password and inserting the encrypted password to the remote assistance account in the ticket;

encrypting the key associated with the table and inserting the encrypted key in the ticket; and

inserting an address and one or more ports in the ticket.

19. A method as defined in claim 16, wherein the step for creating a table to manage outstanding remote assistance requests further comprises an act of changing the remote assistance account password associated with the table each time the number of remote assistance requests in the table goes to zero such that connection requests from experts having an old remote assistance account password are failed.

20. A method as defined in claim 16, wherein the step for escalating the ticket further comprises one of:

an act of transmitting the ticket to the expert over email;

an act of transmitting the ticket to the expert over instant messaging; and

an act of saving the ticket to a file; and

wherein the method further comprises;

an act of prompting the user that the ticket has been activated and that the expert desires to establish a connection with the user; and

an act of providing the expert with a view of a desktop of the user computer if the user accepts the connection request from the expert.