Human interactive proof with authentication

• US 20070101010A1
• Filed: 11/01/2005
• Published: 05/03/2007
• Est. Priority Date: 11/01/2005
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ellison, Carl, Murphy, Elissa
• Application Number:
  US11/264,369
• Publication Number:
  US 20070101010A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method and system for authenticating that a user responding to a HIP challenge is the user that was issued the challenge is provided. Upon receiving information from a sender purporting to be a particular user, the authentication system generates a HIP challenge requesting information based on the user'"'"'s identity. Upon receiving a response to the challenge, the authentication system compares the response with the correct response previously stored for that user. If the two responses match, the authentication system identifies the user as the true source of the information.

Claims

1. A method in a computer system for verifying the identity of a person, the method comprising:

receiving information purporting to be from the person;

sending a challenge to the person, wherein the challenge is in a form that is easier for a human to answer than a machine, and wherein the challenge requests knowledge that is based on the identity of the person;

receiving a response to the challenge;

comparing the received response to a correct response; and

if the received response matches the correct response, identifying the person as the source of the information.

2. The method of claim 1 wherein the information is an electronic mail message sent by the person.

3. The method of claim 2 including, upon identifying the person as the source of the electronic mail message, delivering the electronic mail message to the inbox folder of the recipient.

4. The method of claim 2 including if the received response does not match the correct response, delivering the electronic mail message to a junk mail folder of the recipient.

5. The method of claim 2 including if the received response does not match the correct response, discarding the electronic mail message.

6. The method of claim 1 wherein the form of the challenge is an image containing obscured text.

7. The method of claim 1 wherein the knowledge is personal information about the person.

8. The method of claim 1 wherein the knowledge is commonly known to others sharing an attribute with the person.

9. The method of claim 1 wherein the knowledge is a previously shared secret.

10. The method of claim 1 wherein the information requests access to a resource accessible to a group of users and the knowledge is information shared by the group with prospective members.

11. The method of claim 1 wherein the challenge contains context information based on the resource that is requested.

12. The method of claim 11 wherein the challenge requests a separate response if the person believes the challenge is being applied outside of its intended context.

13. The method of claim 1 wherein the knowledge is information shared between the person and a resource in a previous communication.

14. The method of claim 13 wherein the previous communication is an electronic mail message from the resource to the person.

15. The method of claim 1 wherein the information is access information for authenticating the person to access a web site.

16. The method of claim 1 wherein the correct response is automatically generated based on the response most commonly received.

17. A computer-readable medium containing instructions for verifying the identity of a person, by a method comprising:

receiving a request to access a resource, the request purporting to be from the person;

sending a challenge, wherein the challenge includes a human interactive proof challenge, and wherein the challenge requests external information that the person is more likely to know than people generally;

receiving a response to the challenge;

comparing the received response to a correct response; and

if the received response matches the correct response, identifying the person as the source of the request.

18. A system for verifying the identity of a person comprising:

a request receiving component;

a challenge generating component, wherein a challenge is in a form that includes human interactive proof, and wherein the challenge requests external information that the person is more likely to know than people generally; and

a response validating component.

19. The system of claim 18 wherein the external information is personal information about the person.

20. The system of claim 18 wherein the external information is information shared between the person and a resource in a previous communication.