JP2005149301A - Remote support system, remote support method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To resolve the problem that a conventional PC remote support system utilizing the Internet doesn't provide the support center side with a means for confirming that a user to be supported is a reliable party, via the Internet and is not easily accepted by users in the aspect of security and using methods, though allowing a support operator in a support center to remotely operate a PC of a user to diagnose the PC. <P>SOLUTION: A remote support system is so configured that a support program for performing PKI technology and remote diagnosis utilizing a digital certificate is preliminarily delivered to a user in the form of support token with a portable medium like a USB or an IC card and is loaded to a PC being a diagnosis object when performing remote diagnosis from the support center. Thus a remote support service is provided which is easy for the user to utilize and is safe in the aspect of security. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to remote diagnosis by a support center of a PC owned by a user, and in particular, a medium such as an IC card storing a digital certificate and a support program mailed from the support center is mounted on a PC to be diagnosed. A remote support system, a remote support method for performing remote diagnosis processing by transmitting an electronic certificate to the support center to confirm the validity of the user and operating a support program on the PC from the support center Regarding the program.

  If a user who uses a conventional personal computer (hereinafter referred to as a PC) encounters a problem or wants to make an inquiry on the PC, he or she can use a telephone or fax to a support center or maintenance company that provides PC support services. I was inquiring. Users may not be able to explain what they really want to hear by voice or paper inquiries, or the answer content from the support center may be unclear, and it takes a lot of time to solve the problem. It was.

  If it is a remote support service using the Internet, the support operator of the support center can remotely operate and diagnose the user's PC, but from the support center side, there is no means for authenticating the supporting user via the Internet. There was a problem in realizing the remote support service.

  On the other hand, there is a PKI authentication technique using a public key in order to mutually confirm the legitimacy and reliability of a partner between a server and a user terminal that uses the server service function. Using that technology, for example, by recording the CA certificate on an IC card and distributing it in advance to the user who uses the server function, the user's side can be compared with the case of acquiring the CA certificate online. Patent Document 1 describes contents that eliminate the burden of CA certificate validity check and the like.

JP2003-46499 (FIG. 1, pages 10-15)

  In the present invention, not only an electronic certificate such as a CA certificate but also a remote diagnosis support program used when a remote diagnosis of a user PC is executed by a support center is provided to a user who writes in a portable medium. When a user receives a remote diagnosis of a PC from the support center via the Internet, the medium is loaded on the PC.

  The present invention provides a remote support system, a remote support method, and a program capable of performing user authentication using a digital certificate in a medium and diagnosis of a PC using a support program from a support center as described above. Is.

  A first remote support system of the present invention includes a medium storing an electronic certificate and a plurality of programs, and an electronic apparatus having a computer function used by a user that reads the electronic certificate of the medium and transmits it as authentication information. When the user authentication of the electronic device is performed successfully based on the electronic certificate received from the electronic device, the program is remotely operated on the electronic device to operate the electronic device, A center for collecting device information; and an Internet for connecting the electronic device and the center.

A second remote support system of the present invention includes a medium storing an electronic certificate and a plurality of support programs, and a personal computer (hereinafter referred to as a PC) used by a user who reads the electronic certificate of the medium and transmits it as authentication information. If the user authentication of the PC is successful based on the electronic certificate received from the PC and the authentication is successful, the support program is remotely operated on the PC to operate the PC, A support center that solves the problem of the PC by collecting the information of the PC, the Internet that connects the PC and the support center,
Is provided.

  According to a third remote support system of the present invention, in the first or second invention, the medium is a portable medium.

  According to a fourth remote support system of the present invention, in the second invention, the support program requests the authentication by transmitting the electronic certificate to the support center, and transmits the server certificate received from the support center. An authentication function for performing authentication, an operation of the PC from the support center, the PC diagnosis function, the PC information collection function, a conversation with a user, and a real-time message exchange function are provided.

  According to a fifth remote support system of the present invention, in the second invention, when the support center issues the electronic certificate, the user name, address, and telephone number that uniquely identify the user in the electronic certificate , Information including an encryption algorithm and an issuer, and an expiration date corresponding to a contract period for providing support between the user and the support center.

  According to a sixth remote support system of the present invention, in the fifth invention, the support center sets a serial number of an operating system of a user's PC in the electronic certificate when the electronic certificate is issued. Is provided.

A seventh remote support system according to the present invention is a remote support system including a support center that remotely operates a user's PC and performs support including diagnosis.
The support center provides an electronic certificate in which user information including a user name for uniquely identifying a user and an expiration date corresponding to a support contract period between the user and the support center are set. And issuing the electronic certificate and a support program operating on the PC according to an instruction from the support center on a portable medium and distributing it to the user.

An eighth remote support system of the present invention is a remote support system including a PC that receives a diagnosis by remote operation from a support center.
The PC reads an electronic certificate from a portable medium, transmits it to the support center, receives authentication, and if the authentication is successful, reads the program instructed from the support center from the medium and causes it to operate on the PC Prepare to receive support by.

According to a first remote support method of the present invention, a support center issues an electronic certificate to be used for authentication at the time of support to a PC held by a user with a support contract expiration date, and the electronic certificate A first step of recording a support program to be run on the PC at the time of support implementation on a portable medium and distributing it to users;
A second step of mounting the medium in the PC, reading the electronic certificate, transmitting it to the support center, requesting authentication by the support center, obtaining a server certificate from the support center, and performing mutual authentication When,
When the mutual authentication in the second step is successful, the support center operates the support program of the medium on the PC, operates the PC, and collects information of the PC; ,
Is provided.

  The second remote support method of the present invention is the first remote support method according to the first invention, wherein the first step uses the serial number of the operating system of the user's PC when the electronic certificate is issued by the support center. Including the step of setting the certificate.

According to the third remote support method of the present invention, a support center that provides support including diagnosis by remotely operating a user's PC performs user information including a user name that uniquely identifies the user, A first step of issuing an electronic certificate in which an expiration date corresponding to a support contract period between the support centers is set; and
A second step of creating the electronic certificate and a support program operating on the PC according to an instruction from the support center on a portable medium;
Is provided.

The fourth remote support method of the present invention includes a first step in which a PC receiving a diagnosis by a remote operation from a support center reads an electronic certificate from a portable medium and transmits it to the support center for authentication.
When the authentication is successful, the PC reads the program instructed from the support center from the medium, and receives support from the support center by operating on the PC;
Is provided.

A first program of the present invention is stored in a computer.
The support center issues a support contract expiration date to the user's PC and issues an electronic certificate to be used for authentication at the time of support execution, and the electronic certificate and a support program that operates on the PC at the time of support execution A first step of recording the information on a portable medium;
A second step of reading the electronic certificate of the medium and transmitting it to the support center to request authentication by the support center, obtaining a server certificate from the support center and performing mutual authentication;
When the mutual authentication in the second step is successful, the support center operates the support program of the medium on the PC, operates the PC, and collects information of the PC; ,
Is executed.

A second program of the present invention is stored in a computer.
A support center that provides support including diagnosis by remotely operating a user's PC matches the user information including the user name that uniquely identifies the user and the support contract period between the user and the support center. A first step of issuing an electronic certificate with an expiration date in the form of;
A second step of creating the electronic certificate and a support program operating on the PC according to an instruction from the support center on a portable medium;
Is executed.

A third program of the present invention is stored in a computer.
A PC that receives a diagnosis by remote operation from a support center, reads a digital certificate from a portable medium, sends the certificate to the support center, and receives a first step;
When the authentication is successful, the PC reads the program instructed from the support center from the medium and receives support from the support center by operating on the PC;
Is executed.

・ Using a digital certificate guarantees connection with a trusted party and provides a secure service.
-Use of the service is facilitated by storing the electronic certificate and the support program together in a distribution medium (support tokenization).
-It is possible to reduce the man-hours required for user management to use electronic certificates as service contracts.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  As shown in FIG. 1, the configuration of the first embodiment of the present invention includes a user system 10 in which a PC used by a user is installed, a support center 20 that provides a support service for the user's PC, and a support token. The medium 30 and the Internet 40 connecting the user system 10 and the support center 20 are configured.

  The user calls the support center 20 when a problem such as a failure occurs in the PC used by the user. The support center 20 has a content for connecting a user's PC to a PC used by the operator of the support center 20 and providing various support by the PC of the support center 20 to solve the problem that has occurred.

  The user system 10 is a user PC 120 which is a PC used by the user, and is connected to a support token reading device 121 for mounting the support token medium 30 and reading it.

  The support center 20 includes a reception server 220, a support PC 230, an authentication server 240, and a support token issuing terminal 250. The support center operates the support PC 230 and diagnoses the state of the user PC 120. There is an operator.

  The user PC 120 is connected to the Internet 40, and the reception server 220 is also a Web server that is connected to the Internet 40 and is open to the public. The user PC 120 and the reception server 220 can communicate via the Internet 40.

  The support PC 230, the authentication server 240, and the support token issuing terminal 250, which are PCs, are connected to an internal network such as a LAN of the support center 20, and cannot be directly connected from an external network including the Internet 40. .

  Although one support PC 230 is shown in the figure, a plurality of support PCs 230 can be arranged depending on the size of the support center 20, and a support operator is waiting for each.

  The support token is a core element of the present invention that stores the electronic certificate and the support program, and is stored in the portable support token medium 30. As a portable medium, for example, a USB token device or an IC card including a CD-ROM or a flexible medium is used.

  The user PC 120 is a general PC to which the support token reading device 121 is connected as shown in FIG. The support token reading device 121 uses a USB, IC card reader or the like as a hardware interface.

  The user PC 120 is a general PC used by a user, and is premised on being able to connect to the Internet 40, attach the support token medium 30 and capture the contents.

  As shown in FIG. 3, the reception server 220 includes a reception unit 221, a support PC status confirmation unit 222, a connection distribution unit 223, an encryption connection unit 224, and a storage device 226 such as a magnetic disk device, and stores it therein. Server certificate 225.

  The accepting unit 221 is a unit that accepts a connection of a support request from the user to the user PC 120 by accessing a home page established by the accepting server 220 from the user PC 120 and performs processing.

  The support PC status confirmation unit 222 is a unit that determines to which support PC 230 the diagnostic process should be assigned to the support request from the user after accepting the connection of the support request.

  The connection distribution unit 223 is a unit that transfers the connection of the support request to the support PC 230 that is determined to be free by the support PC status confirmation unit 222.

  The encryption connection unit 224 is a unit for encrypting communication between the user PC 120 and the reception server 220, and uses TLS / SSL as a technique used at that time. TLS / SSL (Transport Layer Security / Secure Sockets Layer) is a protocol that is defined in RFC (Request For Comments) 2246 and provides a secure communication environment between a client and a server.

  The server certificate 225 is a server certificate issued by the authentication server 240. The server certificate 225 is stored in the reception server 220 in advance, and authentication is performed using the server certificate 225 when the user PC 120 connects. The server certificate 225 is ISO / IEC X. 509 is an electronic certificate compliant with 509. ISO / IEC X. 509 is also defined as a standard for public key certificates.

  As shown in FIG. 4, the support PC 230 is a general PC in which a support program manager group 231 including a plurality of programs for diagnosing the user PC 120 is mounted. In response to a support request from the user PC 120. This is a PC for support operators to support.

  The authentication server 240 is assumed to use commercially available PKI (Public Key Infrastructure) server software, and has functions for issuing, revoking, and managing electronic certificates.

  As shown in FIG. 5, the support token issuing terminal 250 includes a certificate issuing program user interface 251, a storage device 255 such as a magnetic disk device, a support program group master library 252 stored therein, and a support token creating program 253. And a support token writing means 254 which is an interface for writing the support token to the support token medium 30.

  The certificate management program user interface 251 is a user interface for connecting to the electronic certificate management function of the authentication server 240. Although it depends on the PKI server software used in the authentication server 240, generally, a Web browser represented by Internet Explorer (registered trademark), which is a software product of Microsoft, is often used.

  The support program master library 252 stores a master program of a support program 320 described later.

  The support token creation program 253 is a program for creating the support token medium 30. A support token medium 30 to be distributed to users is created using this program.

  The support token writing device 254 has a mechanism in which the support token medium 30 is mounted and data can be written in the same manner as the support token reading device 121 described above.

  The support token medium 30 includes an electronic certificate 310 and a support program 320 as shown in FIG. As described above, the support token medium 30 uses a portable medium (USB token device, IC card, etc.), and stores the electronic certificate 310 and the support program 320 in the medium.

  The electronic certificate 310 is an ISO / IEC X. 509 is an electronic certificate compliant with 509.

  The support program 320 on the support token medium 30 is a program that operates on the user PC 120 in cooperation with the support program manager group 231 that operates on the support PC 230, and the user PC 120 when the user needs support of the PC. And used by the support operator when supporting the user PC 120. The support program 320 is composed of a plurality of programs, and is a set of programs having functions of authenticating a server certificate from the support center and transmitting failure information of the user PC 120 to the support center 20.

  Next, the operation of the best mode for carrying out the present invention will be described with reference to the drawings.

  Next, the operation of the present invention will be described in detail with reference to FIGS. 1, 2, 3, 4, 5, 6, and the flowchart of FIG. 7 showing the entire operation.

  As a precondition, it is assumed that a support contract between the user and the support center 20 providing the remote support service is concluded (step S1), and it is proved that the support center 20 issued by the authentication server 240 is true. It is assumed that the server certificate 225 to be stored is stored in the storage device 226 of the reception server 220.

  First, the support center 20 issues and distributes the support token medium 30 to the user as follows.

  The certificate management program user interface 251 of the support token issuing terminal 250 is used to connect to the authentication server 240.

In creating an electronic certificate, the authentication server 240 sets user information including a user name, an address, a telephone number, an encryption algorithm, an issuer, and the like that uniquely identify the user. Further, the certificate validity period is set in accordance with the contract period of the remote support service between the user and the support center 20, and the electronic certificate 310 is issued. (Step S2)
The support token creation program 253 stores the electronic certificate 310 issued by the authentication server 240 and the support program 320 of the support program master library 252 read from the storage device 255 in the support token medium 30.

The support center 20 distributes the completed support token medium 30 to the users by means such as mail. (Step S3)
In principle, since one electronic certificate 310 corresponds to one user PC 120, if a user wants to contract a plurality of user PCs 120 as targets of remote support service, It is necessary to set information for identifying the user PC 120 in the electronic certificate 310. As this identification information, for example, a serial number of a Windows (registered trademark) operating system (hereinafter referred to as OS) can be used.

  The user applies the Windows (registered trademark) serial number of each user PC 120 to the support center 20 as one piece of user information. When issuing the electronic certificate 310, the authentication server 240 sets this serial number in the extension field of the electronic certificate 310, and issues as many electronic certificates 310 as the number of requested user PCs 120. The support center 20 creates a support token medium 30 in which each electronic certificate 310 is stored.

  The above is the operation up to the distribution of the support token.

  Next, the operation when the user receives support will be described.

The user attaches the support token medium 30 to the support token reading device 121 of the user PC 120. When the support token medium 30 is loaded, an authentication program having an authentication function in the support program 320 is read, and the operation starts on the user PC 120. The authentication program of the user PC 120 automatically issues a connection request to the reception server 220. Thereafter, the TLS / SSL function operates until authentication and encrypted communication using an electronic certificate are performed. (Step S4)
When receiving the connection request, the accepting unit 221 requests the user PC 120 for the electronic certificate 310 provided to the user. At the same time, the authentication program on user PC 120 requests server certificate 225 from reception server 220.

  The accepting unit 221 transmits the server certificate 225 to the user PC 120. The authentication program of the user PC 120 transmits the electronic certificate 310 read from the support token medium 30 and the Windows (registered trademark) serial number read from the OS of the user PC 120 to the reception unit 221.

  The authentication program of the user PC 120 confirms the validity of the server certificate 225 obtained by decrypting the server certificate with its own public key (step S5).

  The accepting unit 221 confirms the validity of the electronic certificate 310 obtained in the same manner (step S5). At this time, the accepting unit 221 compares the Windows (registered trademark) serial number set in the electronic certificate 310 with that transmitted separately as part of the validity check. If they do not match, authentication fails.

  When both the user PC 120 and the support center 20 can recognize the validity, they can authenticate each other, and the user PC 120 confirms that the connection is to a reliable server. It is confirmed that the connection is to the user PC 120. If authentication of the other party fails, the process will be aborted.

  Since the subsequent communication is encrypted between the receiving server 220 and the user PC 120 by the encrypted connection program of the encrypted connection means 224 and the support program 320, the secret is kept (step S6).

  Subsequently, the support PC status confirmation unit 222 of the reception server 220 selects one currently available support PC 230, and the connection distribution unit 223 requests connection to the selected support PC 230. Note that the communication between the reception server 220 and the support PC 230 is not encrypted.

The support PC 230 and the user PC 120 selected at this time are in a one-to-one connection form. (Step S7)
Thereafter, the support operator remotely activates the necessary support program of the support token medium 30 from the support PC 230 onto the user PC 120 to support the user. The support program 320 allows the user PC 120 to be operated from the remote support PC 230, has a diagnosis function of the PC 120, and an information collection function, and includes a conversation with the user and a real-time message exchange function. (Step S8)
Next, the operation of the connection from the user PC 120 when the contract period with the user expires will be described.

  The user attaches the support token medium 30 to the support token reading device 121 of the user PC 120. When attached, it automatically requests connection to the reception server 220 in the same manner as described above.

  The accepting unit 221 of the accepting server 220 requests the electronic certificate 310 of the user 120 for the requested connection. At the same time, the user PC 120 requests the server certificate 225 of the reception server 220. The accepting unit 221 passes the server certificate 225 to the user PC 120, and the user PC 120 passes the electronic certificate 310 to the accepting unit 221.

  The user PC 120 confirms the validity of the obtained server certificate 225 (step S5). The accepting unit 221 confirms the validity of the obtained electronic certificate 310 (step S5), but the authentication is not established because the certificate has expired, and the process ends. This makes it impossible to connect and support is not available. With this function, the support center 20 does not need to check the expiration date of all contractors in daily operations.

  Further, when the user offers to cancel the contract (a situation such as loss of the support token) before the contract expiration date, the connection to the authentication server 240 is made using the certificate management program user interface 251 of the support token issuing terminal 250. All you have to do is revoke the certificate.

  Although the above description is directed to a PC, the object of the present invention is not particularly limited to a PC, and is a server device, a mobile phone, a PDA having an input function from a portable medium, It is obvious that the contents of the present invention can be applied to various electronic devices having an Internet connection function and a computer function capable of operating a program.

  It seems that it can be used for support work for remotely diagnosing various electronic devices including personal computers that can be connected to the Internet.

It is a block diagram explaining the structure of the Example of this invention. It is a block diagram of user PC of this invention. It is a block diagram of the reception server of this invention. It is a block diagram of the support PC of the Example of this invention. It is a block diagram of the support token issuing terminal of the Example of this invention. It is a block diagram of the support token medium of the Example of this invention. It is a flowchart explaining operation | movement of the Example of this invention.

Explanation of symbols

10 User system 120 User PC
121 Support Token Reading Device 20 Support Center 220 Reception Server 221 Reception Unit 222 Support PC Status Check Unit 223 Connection Distribution Unit 224 Encrypted Connection Unit 225 Server Certificate 226 Storage Device 230 Support PC
231 Support program manager group 240 Authentication server 250 Support token issuing terminal 251 Certificate management program user interface 252 Support program group master library 253 Support token creation program 254 Support token writing device 30 Support token medium 310 Electronic certificate 320 Support program

Claims (15)

A medium storing an electronic certificate and a plurality of programs, an electronic device having a computer function used by a user who reads the electronic certificate of the medium and transmits it as authentication information, and an electronic certificate received from the electronic device. When the user authentication of the electronic device is originally performed and the authentication is successful, the program is remotely operated on the electronic device, the electronic device is operated, and the electronic device information is collected, and the electronic device A remote support system comprising: an Internet connecting an apparatus and the center. A medium storing an electronic certificate and a plurality of support programs, a personal computer (hereinafter referred to as a PC) used by a user who reads the electronic certificate of the medium and transmits it as authentication information, and an electronic certificate received from the PC If the user authentication of the PC is successful based on the certificate and the authentication is successful, the problem of the PC is caused by operating the support program remotely on the PC and operating the PC or collecting the PC information. A support center for solving the problem, the Internet connecting the PC and the support center,
A remote support system comprising: The remote support system according to claim 1, wherein the medium is a portable medium. The support program sends an electronic certificate to the support center to request authentication, and performs an authentication function for authenticating a server certificate received from the support center, and an operation of the PC from the support center. The remote support system according to claim 2, further comprising: a PC diagnosis function, a PC information collection function, a conversation with a user, and a real-time message exchange function. The support center includes user information including a user name, an address, and a telephone number for uniquely identifying a user in the electronic certificate when the electronic certificate is issued, an encryption algorithm, and information including an issuer. 3. The remote support system according to claim 2, wherein an expiration date corresponding to a contract period for providing support between the user and the support center is set. 6. The remote support system according to claim 5, wherein the support center sets a serial number of an operating system of a user's PC in the electronic certificate when the electronic certificate is issued. In a remote support system equipped with a support center that remotely operates a user's PC and provides support including diagnosis,
The support center provides an electronic certificate in which user information including a user name for uniquely identifying a user and an expiration date corresponding to a support contract period between the user and the support center are set. A remote support system that issues the electronic certificate and a support program that operates on the PC in accordance with an instruction from the support center and distributes it to a user. In a remote support system with a PC that is diagnosed by remote operation from the support center,
The PC reads an electronic certificate from a portable medium, transmits it to the support center, receives authentication, and if the authentication is successful, reads the program instructed from the support center from the medium and causes it to operate on the PC Remote support system characterized by receiving support by. The support center issues a support contract expiration date to the user's PC and issues an electronic certificate to be used for authentication at the time of support execution, and the electronic certificate and a support program that operates on the PC at the time of support execution A first step of recording the information on a portable medium and distributing it to a user;
A second step of mounting the medium in the PC, reading the electronic certificate, transmitting it to the support center, requesting authentication by the support center, obtaining a server certificate from the support center, and performing mutual authentication When,
When the mutual authentication in the second step is successful, the support center operates the support program of the medium on the PC, operates the PC, and collects information of the PC; ,
A remote support method comprising: 10. The first step includes a step of setting a serial number of an operating system of a user's PC in the digital certificate when the digital certificate is issued by the support center. Remote support method. A support center that provides support including diagnosis by remotely operating a user's PC matches the user information including the user name that uniquely identifies the user and the support contract period between the user and the support center. A first step of issuing an electronic certificate with an expiration date in the form of;
A second step of creating the electronic certificate and a support program operating on the PC according to an instruction from the support center on a portable medium;
A remote support method comprising: A first step in which a PC receiving a diagnosis by remote operation from a support center reads an electronic certificate from a portable medium and sends it to the support center for authentication;
When the authentication is successful, the PC reads the program instructed from the support center from the medium, and receives support from the support center by operating on the PC;
A remote support method comprising: On the computer,
The support center issues a support contract expiration date to the user's PC and issues an electronic certificate to be used for authentication at the time of support execution, and the electronic certificate and a support program that operates on the PC at the time of support execution A first step of recording the information on a portable medium;
A second step of reading the electronic certificate of the medium and transmitting it to the support center to request authentication by the support center, obtaining a server certificate from the support center and performing mutual authentication;
When the mutual authentication in the second step is successful, the support center operates the support program of the medium on the PC, operates the PC, and collects information of the PC; ,
A program that executes On the computer,
A support center that provides support including diagnosis by remotely operating a user's PC matches the user information including the user name that uniquely identifies the user and the support contract period between the user and the support center. A first step of issuing an electronic certificate with an expiration date in the form of;
A second step of creating the electronic certificate and a support program operating on the PC according to an instruction from the support center on a portable medium;
A program that executes On the computer,
A PC that receives a diagnosis by remote operation from a support center, reads a digital certificate from a portable medium, sends the certificate to the support center, and receives a first step;
When the authentication is successful, the PC reads the program instructed from the support center from the medium and receives support from the support center by operating on the PC;
A program that executes

Images