Human interactive proof sevice

• US 20060095578A1
• Filed: 10/29/2004
• Published: 05/04/2006
• Est. Priority Date: 10/29/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Paya, Ismail Cem, Benaloh, Josh D., Perumal, Raja P., Lester, Erren Dusan, Steinbok, Jeffrey, Chow, Trevin M., Couvreur, Julien D.
• Granted Patent: US 7,533,419 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links

Abstract

A human interactive proof (HIP) service is described. In response to a request from a web server, the HIP service generates a HIP challenge and an associated attestation. The web server can then embed the generated HIP challenge in a requested web page. The attestation is used to determine whether or not a user response to the HIP challenge is correct.

Claims

1. A human interactive proof (HIP) service comprising:

an interface for receiving HIP requests; and

a HIP challenge generator for generating a HIP challenge in response to receiving a HIP request.

2. The HIP service as recited in claim 1, further comprising an attestation generator for generating an attestation associated with the HIP challenge.

3. The HIP service as recited in claim 1, further comprising a HIP challenge store for maintaining a representation of a previously generated HIP challenge to prevent repeated attempts to solve a particular HIP challenge.

4. The HIP service as recited in claim 1, further comprising a HIP challenge store for maintaining a representation of a previously solved HIP challenge to prevent subsequent access to a particular resource based on the previously solved HIP challenge.

5. The HIP service as recited in claim 1, further comprising a HIP response evaluator for evaluating a response to the HIP challenge.

6. The HIP service as recited in claim 1 implemented as a web-based service that is available to a plurality of web server systems.

7. The HIP service as recited in claim 1 implemented as a software application that can be installed and executed on a computer system.

8. A method comprising:

receiving from a client system a request for a web page;

requesting that a human interactive proof (HIP) service generate a HIP challenge; and

generating the web page such that when the web page is rendered by the client system, the web page includes the HIP challenge that was generated.

9. The method as recited in claim 8 wherein the HIP service is implemented as a remote web-based service.

10. The method as recited in claim 8 wherein the requesting comprises directing the client system to request that the HIP service generate the HIP challenge.

11. The method as recited in claim 8 wherein the generating comprises:

receiving a particular HIP challenge from the HIP service; and

transmitting the web page, which includes the HIP challenge, to the client system.

12. The method as recited in claim 8 wherein the generating comprises generating a web page that includes a link to a particular HIP challenge maintained by the HIP service such that when the client system renders the web page, the client system is directed by the link to request the particular HIP challenge from the HIP service.

13. The method as recited in claim 8 wherein the generating comprises generating a web page that includes an I-frame that is populated when the web page is rendered with a particular HIP challenge maintained by the HIP service.

14. The method as recited in claim 8 further comprising:

receiving from the client system a user response to the HIP challenge; and

causing the user response to be evaluated.

15. The method as recited in claim 14 wherein the causing comprises:

receiving an attestation associated with the HIP challenge; and

using the attestation to evaluate the user response.

16. The method as recited in claim 14 wherein the causing comprises:

transmitting the user response to the HIP service; and

receiving an indication of whether the user response is correct.

17. A web server configured to implement the method as recited in claim 8.

18. A method comprising:

receiving a request for a HIP challenge;

generating a HIP challenge and an associated attestation based on the request; and

returning the HIP challenge.

19. The method as recited in claim 18 wherein the generating comprises generating a HIP challenge based at least in part on a context that uniquely identifies the request.

20. The method as recited in claim 18 wherein:

the request indicates a difficulty level to be associated with the HIP challenge; and

the generating comprises generating a HIP challenge that has the indicated difficulty level.

21. The method as recited in claim 18 wherein:

the request indicates a customization to be associated with the HIP challenge; and

the generating comprises generating a HIP challenge that is based, at least in part, on the customization.

22. The method as recited in claim 21 wherein the customization comprises at least one of a visual customization or an audio customization.

23. The method as recited in claim 18 wherein the returning comprises:

returning an identifier associated with the HIP challenge;

receiving a request that specifies the identifier; and

returning the HIP challenge in response to the request that specifies the identifier.

24. The method as recited in claim 18 further comprising encrypting the attestation.

25. The method as recited in claim 18 further comprising returning the attestation along with the HIP challenge.

26. The method as recited in claim 18 wherein the HIP challenge comprises at least one of an image, an audio object, or a video object.

27. A system comprising:

means for generating a human interactive proof challenge in response to a request; and

means for generating an attestation associated with the human interactive proof challenge, the attestation comprising data that enables a system to evaluate a response to the human interactive proof challenge.

28. The system as recited in claim 27 further comprising means for maintaining the human interactive proof such that the human interactive proof can be requested by another system.

29. The system as recited in claim 27 further comprising means for encrypting the attestation.

30. The system as recited in claim 27 further comprising means for transmitting an identifier associated with a human interactive proof challenge in response to a request.

31. The system as recited in claim 27 further comprising means for transmitting the human interactive proof challenge in response to a request.

32. The system as recited in claim 27 further comprising means for transmitting an attestation associated with a human interactive proof challenge in response to a request.

33. The system as recited in claim 27 further comprising means for evaluating a response to the human interactive proof challenge.

34. The system as recited in claim 27 implemented as a web-based service.

35. The system as recited in claim 27 implemented as a software application.

36. One or more computer-readable media comprising computer-readable instructions which, when executed, cause a computer system to:

receive a request to generate a HIP challenge;

in response to the request, generate a HIP challenge and an associated attestation; and

return the identifier and the attestation.

37. The one or more computer-readable media as recited in claim 36 further comprising computer-readable instructions which, when executed, cause the computer system to:

receive a response to the HIP challenge;

use the attestation to evaluate the response; and

return data that indicates whether the response is correct.

38. A web-based service comprising the one or more computer-readable media as recited in claim 36.

39. A software application installed on a web server, the software application comprising the one or more computer-readable media as recited in claim 36.