System and method for non-interactive human answerable challenges
First Claim
11. A system for creating a non-interactive human proof, the system comprising:
- a general purpose computing device; and
a computer program comprising program modules executable by the computing device, wherein the computing device is directed by the program modules of the computer program to, generate a challenge for a computer user using said user'"'"'s computing device that includes a trusted computing device;
require a computer user to answer the challenge;
send the computer user'"'"'s answer to the challenge to a service provider with a request to access the computer user'"'"'s services.
2 Assignments
0 Petitions
Accused Products
Abstract
A system and method for automatically determining if a computer user is a human or an automated script. Human interactive proofs (HIPs) are currently used to deter automated registration for web services by automated computer scripts. Unfortunately, HIPs entail multiple steps (request service, receive challenge, respond to challenge) that can be burdensome. The system and method of the invention in one embodiment provides a “black-box” to potential users consisting of a challenge generator and a secret key. The challenge is generated for the user and the response can be provided as part of the service request, eliminating the need for a separate challenge from a service provider and response to the challenge.
-
Citations
41 Claims
-
11. A system for creating a non-interactive human proof, the system comprising:
-
a general purpose computing device; and
a computer program comprising program modules executable by the computing device, wherein the computing device is directed by the program modules of the computer program to, generate a challenge for a computer user using said user'"'"'s computing device that includes a trusted computing device;
require a computer user to answer the challenge;
send the computer user'"'"'s answer to the challenge to a service provider with a request to access the computer user'"'"'s services. - View Dependent Claims (12, 13, 14, 15)
-
-
16. A computer-implemented process for determining whether to allow a computer user access to a service provider'"'"'s services, comprising the process actions of:
-
generating a challenge at a user'"'"'s computing device for the user using the a trusted computing device resident on the user'"'"'s computing device;
the user answering the challenge;
sending a request for services including a digitally signed assertion that the challenge has been successfully answered;
said service provider evaluating said user'"'"'s request for services and digitally signed assertion; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said user'"'"'s request for services and digitally signed assertion. - View Dependent Claims (17, 18, 19, 20, 21, 22)
-
-
23. A computer-implemented process for determining whether to allow a computer user access to a service provider'"'"'s services, comprising the process actions of:
-
generating a challenge for a user at the user'"'"'s computing device using a trusted computing device resident on the user'"'"'s computing device by generating a cryptographic hash of information that is extracted from a message the user generates requesting services from a service provider;
the user answering the challenge;
the user receiving a digitally signed assertion;
the user sending a request for services including a digitally signed assertion that the challenge has been successfully answered;
said service provider evaluating said user'"'"'s request for services and digitally signed assertion; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said user'"'"'s request for services and digitally signed assertion. - View Dependent Claims (24, 25)
-
-
26. A computer-implemented process for determining whether to allow a computer user access to a service provider'"'"'s services, comprising the process actions of:
-
generating a challenge for a user that comprises a partial digital signature using a trusted computing device resident at a trusted third party;
the user answering the challenge to complete the digital signature;
the user sending a request for services including the complete digital signature;
said service provider evaluating said user'"'"'s request for services and digital signature; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said user'"'"'s request for services and digital signature. - View Dependent Claims (27)
-
-
28. A computer-implemented process for determining whether a computer user is a human or a computer program, comprising the process actions of:
-
generating a request for services of a service provider at a user;
generating a challenge at a trusted third party and providing it to said user;
the user answering the challenge;
said trusted third party evaluating said user'"'"'s answer to the challenge and attaching a digital signature thereto if said user'"'"'s answer is correct;
sending said request for services including said digital signature from the trusted third party to a service provider;
said service provider evaluating said user'"'"'s request for services and digital signature; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said digital signature.
-
-
29. A computer-implemented process for determining whether to allow a computer user access to a service provider'"'"'s services, comprising the process actions of:
-
a user generating a request for services of a service provider and sending said request to a third party;
said third party generating a challenge for the user;
the user answering the challenge and sending said answer to said third party;
sending the user'"'"'s request for services including a digital signature identifying the third party and the user'"'"'s answer to the service provider;
said service provider evaluating said user'"'"'s answer and digital signature; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said user'"'"'s answer and digital signature.
-
-
30. A computer-implemented process for determining whether to allow a computer user access to a service provider'"'"'s services, comprising the process actions of:
-
a user generating a request for services of a service provider and sending said request to a trusted third party;
said third party generating a challenge that requires said user to expend significant resources to answer the challenge and providing the challenge to the user;
the user answering the challenge and providing the answer to said trusted third party;
sending the request for services including a digitally signed assertion that the challenge has been successfully answered to a service provider;
evaluating said request for services and digitally signed assertion; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said digitally signed assertion. - View Dependent Claims (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 31, 32, 33, 34)
-
-
33-1. The computer-implemented process of claim 30 wherein said challenge is generated using information extracted from said user'"'"'s request for services.
-
35. A computer-readable medium having computer-executable instructions for determining whether a computer user is human or a computer program, comprising program modules for:
-
generating a request for services of a service provider at a user'"'"'s computing device;
generating a challenge at a user'"'"'s computing device;
the user answering the challenge;
said user'"'"'s computing device evaluating said user'"'"'s answer to the challenge and attaching a keyed hash thereto if said user'"'"'s answer is correct;
sending said request for services including said keyed hash from the user to a service provider;
said service provider evaluating said user'"'"'s request for services and keyed hash; and
said service provider determining whether to allow said user access to said service provider'"'"'s services based on said evaluation of said keyed hash. - View Dependent Claims (36, 37, 38, 39, 40, 41)
-
Specification