Systems and methods for distinguishing among human users and software robots

• US 10,127,373 B1
• Filed: 05/05/2017
• Issued: 11/13/2018
• Est. Priority Date: 05/05/2017
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: Mastercard Technologies Canada ULC (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Cunningham, Jonathan
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US15/588,124
• Publication Number:
  US 20180322270A1
• Time in Patent Office: 557 Days
• Field of Search: None
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A technique for distinguishing between a human user and a software robot. The technique includes: receiving a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image encoding the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image; transmitting the shuffled image and the decoding information to the device; receiving a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text.

Claims

1. A system, comprising:

at least one computer; and

at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one computer, cause the at least one computer to perform;

receiving, via at least one network, a first communication from a device different from the at least one computer;

identifying, from the first communication, a request to access a web resource;

generating a shuffled image that encodes a challenge text, the generating comprising;

generating an initial image representing the challenge text;

dividing the initial image into image portions; and

generating the shuffled image as a shuffled arrangement of the image portions;

generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image;

transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image;

receiving, via the at least one network, a second communication from the device;

identifying, from the second communication, a response text; and

providing the device with access to the web resource based on a comparison between the challenge text and the response text.

2. The system of claim 1, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device.

3. The system of claim 1, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform:

generating a webpage to include the software code and the shuffled image,

wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device.

4. The system of claim 1, wherein generating the decoding information comprises:

generating the table storing correspondences between locations in the initial image and locations in the shuffled image.

5. The system of claim 4, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises:

generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and

generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion.

6. The system of claim 1, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random.

7. The system of claim 1, wherein the processor-executable instructions when executed, further cause the at least one computer to perform:

identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated;

validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and

providing the device with access to the web resource based on results of validating the second communication.

8. A method, performed by at least one computer, the method comprising:

receiving, via at least one network, a first communication from a device different from the at least one computer;

identifying, from the first communication, a request to access a web resource;

generating a shuffled image that encodes a challenge text, the generating comprising;

generating an initial image representing the challenge text;

dividing the initial image into image portions; and

generating the shuffled image as a shuffled arrangement of the image portions;

generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image;

transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image;

receiving, via the at least one network, a second communication from the device;

identifying, from the second communication, a response text; and

providing the device with access to the web resource based on a comparison between the challenge text and the response text.

9. The method of claim 8, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device.

10. The method of claim 8, further comprising:

generating a webpage to include the software code and the shuffled image,

wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device.

11. The method of claim 8, wherein generating the decoding information comprises:

generating the table storing correspondences between locations in the initial image and locations in the shuffled image.

12. The method of claim 11, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises:

generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and

generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion.

13. The method of claim 8, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random.

14. The method of claim 8, further comprising:

identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated;

validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and

providing the device with access to the web resource based on results of validating the second communication.

15. At least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by at least one computer, cause the at least one computer to perform:

receiving, via at least one network, a first communication from a device different from the at least one computer;

identifying, from the first communication, a request to access a web resource;

generating a shuffled image that encodes a challenge text, the generating comprising;

generating an initial image representing the challenge text;

dividing the initial image into image portions; and

generating the shuffled image as a shuffled arrangement of the image portions;

generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image;

transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image;

receiving, via the at least one network, a second communication from the device;

identifying, from the second communication, a response text; and

providing the device with access to the web resource based on a comparison between the challenge text and the response text.

16. The at least one non-transitory computer-readable storage medium of claim 15, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device.

17. The at least one non-transitory computer-readable storage medium of claim 15, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform:

generating a webpage to include the software code and the shuffled image,

wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device.

18. The at least one non-transitory computer-readable storage medium of claim 15, wherein generating the decoding information comprises:

generating the table storing correspondences between locations in the initial image and locations in the shuffled image.

19. The at least one non-transitory computer-readable storage medium of claim 18, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises:

generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and

generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion.

20. The at least one non-transitory computer-readable storage medium of claim 15, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random.

21. The at least one non-transitory computer-readable storage medium of claim 15, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform:

identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated;

validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and

providing the device with access to the web resource based on results of validating the second communication.

22. A device, comprising:

at least one hardware processor; and

at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform;

transmitting, to at least one computer and via at least one network, a first communication comprising a request to access a web resource;

receiving, from the at least one computer and via the at least one network, a shuffled image that encodes a challenge text, decoding information, and software code, wherein;

the shuffled image comprises a shuffled arrangement of image portions of an unshuffled image,

the decoding information comprises a table storing correspondences between locations in the unshuffled image and locations in the shuffled image, and

the software code is configured to use the decoding information to recover the unshuffled image from the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement;

executing the software code, using the decoding information and the shuffled image, to generate the unshuffled image;

displaying, to a user of the device, the unshuffled image to reveal the challenge text;

receiving, from the user of the device, input specifying a response text; and

transmitting, to the at least one computer and via the at least one network, a second communication comprising the response text.

23. The device of claim 22, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device.

24. The device of claim 22, wherein the software code is further configured to cause the device to display the unshuffled image to reveal the challenge text, and the displaying comprises:

executing the software code using an Internet browser executing on the device to display the unshuffled image.

25. The device of claim 22, wherein the processor-executable instructions, when executed, further cause the at least one hardware processor to perform:

generating a challenge token, the challenge token including a timestamp indicating a time at which the challenge token was generated;

including the challenge token in the second communication; and

receiving access to the web resource responsive to generating the challenge token within a threshold time of the shuffled image and the decoding information being transmitted to the device.