# US 12,602,241 B2 · Secure networking engine for a technical support management system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,241 B2 - Document ID: US12602241B2 - Status: Granted - Kind: B2 - Application number: 17/984,943 - Filed: 2022-11-10 - Published: 2024-01-11 - Granted: 2026-04-14 - Earliest claimed: 2022-07-06 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Takashi Yomo - Web page: https://patentgrep.com/patent/US12602241B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 67/131: Protocols for games, networked simulations or virtual reality - H04L 67/1396: specially adapted for monitoring users' activity - H04L 67/52: specially adapted for the location of the user terminal - G06F 11/366: {using diagnostics (G06F11/0703 takes precedence)} - G06F 11/3698: Environments for analysis, debugging or testing of software - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer storage media for providing a virtual diagnostic system in a secure networking engine of a technical support management system. The virtual diagnostic system provides a secure networking connection and diagnostic and debugging services between a cloud provider computing environment and a customer computing environment. The virtual diagnostic system includes a virtual lab VM network, a private VPN service, and virtual diagnostic system machines. The virtual lab virtual machine network operates in an instance of the secure network engine at the secure networking engine site. In operation, a request to instantiate a secure networking engine is accessed. The request comprises location parameters of the diagnostic target. Based on the location parameters of the diagnostic target, a secure networking engine site for instantiating the secure networking engine is determined. The secure networking engine—associated with a cloud provider computing environment—is instantiated at the secure networking engine site. ## Claims ### Claim 1 A computerized system comprising: one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations, the operation comprising: accessing a request to instantiate a secure networking engine for providing technical support services of a cloud provider computing environment for a diagnostic target of a customer computing environment, wherein the request comprises location parameters of the diagnostic target; based on the location parameters, determining a secure networking engine site for instantiating the secure networking engine; instantiating the secure networking engine at the secure networking engine site, the secure networking engine comprising a virtual diagnostic system and a private virtual private network (VPN) service; and based on the private VPN, causing establishment of a secure networking connection, wherein the secure networking connection via the private VPN provides a VPN gateway between the cloud provider computing environment, the virtual diagnostic system, and the customer computing environment, wherein the VPN gateway is associated with a plurality of Internet Protocol (IP) address zones comprising a zone-1 private IP address space for the customer computing environment, a zone-2 private IP address space for the virtual diagnostic system, and a zone-3 private IP address space for the cloud provider computing environment. ### Claim 2 (depends on 1) The system of claim 1, wherein the location parameters are associated with a zone-1 private Internet Protocol (IP) address space, the virtual diagnostic system is associated with a zone-2 private IP address space, and technician terminals of the cloud provider computing environment are associated with a zone-3 cloud provider private support network address space. ### Claim 3 (depends on 1) The system of claim 1, the operations further comprising: receiving, at a debugger host machine, a first technical support instruction associated with a technician terminal of the cloud provider computing environment, wherein the virtual diagnostic system comprises a debugger host machine and a debugger proxy machine; processing the first technical support instruction via a virtual lab virtual machine subnet associated with the virtual diagnostic system; communicating a second technical support instruction based on the first technical instruction to the debugger proxy machine; and communicating, from the debugger proxy machine, the second technical support instruction to the customer computing environment via the secure networking connection, wherein the secure networking connection isolates the cloud provider computing environment from the customer computing environment based on communications via the virtual diagnostic system and the private VPN. ### Claim 4 (depends on 3) The system of claim 3, the operations further comprising: receiving, at the debugger proxy machine, a response to the second technical support instruction; communicating, from the debugger proxy machine, the response to the second technical support instruction to the debugger host machine; and communicating, from the debugger host machine, the response to the second technical support instruction to the technician terminal. ### Claim 5 (depends on 1) The system of claim 1, wherein determining the secure networking engine site is based on a network bandwidth score or cost score, wherein the secure networking engine site is selected based on at least one of the network bandwidth score or the cost score, wherein the network bandwidth score or the cost score supports ranking a plurality of candidate secure networking engine sites relative to each other such that the secure networking site is selected for instantiating the secure networking engine. ### Claim 6 (depends on 1) The system of claim 1, wherein the virtual diagnostic system comprises a private lab control machine, a debugger host machine, and a debugger proxy machine. ### Claim 7 (depends on 1) The system of claim 1, wherein the virtual diagnostic system is temporarily instantiated for a period of time associated with performing the technical support services. ### Claim 8 One or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising: receiving, at a debugger host machine of a virtual diagnostic system, a first technical support instruction associated with a technician terminal of a cloud provider computing environment, wherein the virtual diagnostic system comprises a debugger host machine and a debugger proxy machine; processing the first technical support instruction via a virtual lab virtual machine subnet associated with the virtual diagnostic system; communicating a second technical support instruction based on the first technical instruction to the debugger proxy machine; and communicating, from the debugger proxy machine, the second technical support instruction to a customer computing environment a secure networking connection associated with a private virtual private network (VPN) between the customer computing environment and the cloud, wherein the VPN gateway is associated with a plurality of Internet Protocol (IP) address zones comprising a zone-1 private IP address space for the customer computing environment, a zone-2 private IP address space for the virtual diagnostic system, and a zone-3 private IP address space for the cloud provider computing environment. ### Claim 9 (depends on 8) The media of claim 8, wherein the first technical support instruction is received at the debugger machine via a cloud provider VPN that is a secure networking connection between the cloud provider computing environment and a secure networking engine site comprising the virtual diagnostic system. ### Claim 10 (depends on 8) The media of claim 8, wherein the virtual diagnostic system is associated with a host machine in a host machine network, the host machine is connected via a cloud provider Application Programming Interface (API) to a resource performance management system of the cloud provider computing environment. ### Claim 11 (depends on 8) The media of claim 8, wherein a private lab control machine, the debugger host machine, and the debugger machine of the virtual diagnostic machine are associated with a virtual lab virtual machine subnet that isolates communications between the cloud provider computing environment and the customer computing environment. ### Claim 12 (depends on 8) The media of claim 8, the operations further comprising: receiving, at the debugger proxy machine, a response to the second technical support instruction; communicating, from the debugger proxy machine, the response to the second technical support instruction to the debugger host machine; and communicating, from the debugger host machine, the response to the second technical support instruction to the technician terminal. ### Claim 13 (depends on 8) The media of claim 8, wherein the virtual diagnostic system is associated with a security networking engine site that is identified selected from a plurality of candidate security networking engine sites associated with corresponding candidate security networking engine scores. ### Claim 14 (depends on 8) The media of claim 8, wherein the virtual diagnostic system is temporarily instantiated for a period of time associated with performing the technical support services. ### Claim 15 A computer-implemented method, the method comprising: accessing a request to instantiate a secure networking engine for providing technical support services of a cloud provider computing environment for a diagnostic target of a customer computing environment, wherein the request comprises location parameters of the diagnostic target; based on the location parameters, determining a secure networking engine site for instantiating the secure networking engine; instantiating the secure networking engine at the secure networking engine site, the secure networking engine comprising a virtual diagnostic system and a private virtual private network (VPN) service; and based on the private VPN, causing establishment of the secure networking connection, wherein the secure networking connection via the private VPN provides a VPN gateway between the cloud provider computing environment, the virtual diagnostic system, and the customer computing environment, wherein the VPN gateway is associated with a plurality of Internet Protocol (IP) address zones comprising a zone-1 private IP address space for the customer computing environment, a zone-2 private IP address space for the virtual diagnostic system, and a zone-3 private IP address space for the cloud provider computing environment. ### Claim 16 (depends on 15) The method of claim 15, the method further comprising: receiving, at a debugger host machine, a first technical support instruction associated with a technician terminal of the cloud provider computing environment, wherein the virtual diagnostic system comprises a debugger host machine and a debugger proxy machine; processing the first technical support instruction via a virtual lab virtual machine subnet associated with the virtual diagnostic system; communicating a second technical support instruction based on the first technical instruction to the debugger proxy machine; and communicating, from the debugger proxy machine, the second technical support instruction to the customer computing environment a secure networking connection associated with a private virtual private network (VPN) between the customer computing environment and the cloud, wherein the secure networking connection isolates the cloud provider computing environment from the customer computing environment based on communications via the virtual diagnostic system and the private VPN. ### Claim 17 (depends on 16) The method of claim 16, the method further comprising: receiving, at the debugger proxy machine, a response to the second technical support instruction; communicating, from the debugger proxy machine, the response to the second technical support instruction to the debugger host machine; and communicating, from the debugger host machine, the response to the second technical support instruction to the technician terminal. ### Claim 18 (depends on 15) The method of claim 15, wherein the response to the second technical support instruction is received at a customer guest computing device associated with a debugging target machine in a diagnostic target in the customer computing environment. ### Claim 19 (depends on 15) The method of claim 15, wherein the diagnostic target and the secure networking engine site are associated a network bandwidth score or cost score, wherein the secure networking engine site is selected for performing technical support instructions based on at least one of the network bandwidth score and the cost score. ### Claim 20 (depends on 15) The method of claim 15, wherein the communications via the secure networking connection are available for a temporary period of time, wherein the temporary period of time corresponds to a period of time for which the virtual diagnostic system is temporarily instantiated for performing the technical support services.