Method for selectively restricting access to computer systems

• US 6,195,698 B1
• Filed: 04/13/1998
• Issued: 02/27/2001
• Est. Priority Date: 04/13/1998
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Abadi, Martin, Lillibridge, Mark D., Bharat, Krishna, Broder, Andrei Z.
• Primary Examiner(s): Maung, Zarni
• Assistant Examiner(s): Tran, Philip B.
• Application Number:
  US09/059,193
• Time in Patent Office: 1,051 Days
• Field of Search: 709/203, 709/225, 709/228, 713/155, 713/169, 713/183, 713/201, 713/202, 380/21, 380/25
• US Class Current: 709/225
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A computerized method selectively accepts access requests from a client computer connected to a server computer by a network. The server computer receives an access request from the client computer. In response, the server computer generates a predetermined number of random characters. The random characters are used to form a string in the server computer. The string is randomly modified either visually or audibly to form a riddle. The original string becomes the correct answer to the riddle. The server computer renders the riddle on an output device of the client computer. In response, the client computer sends an answer to the server. Hopefully, the answer is a user'"'"'s guess for the correct answer. The server determines if the guess is the correct answer, and if so, the access request is accepted. If the correct answer is not received within a predetermined amount of time, the connection between the client and server computer is terminated by the server on the assumption that an automated agent is operating in the client on behalf of the user.

Claims

1. A computerized method for selectively accepting access requests from a client computer connected to a server computer by a network, comprising:

receiving an access request in the server computer from the client computer via the network;

generating a predetermined number of random characters to form a string in the server computer in response to the access request;

modifying at least one perceptual attribute of the string of random characters to form a riddle configured to be easily answered by a human being with no advance knowledge of the riddle while being substantially difficult to answer by an automated agent unaided by human being, the string being a correct answer to the riddle;

rendering the riddle on an output device of the client computer;

receiving an answer to the riddle from the client computer;

determining if the answer to the riddle is correct; and

accepting the access request if the answer is correct and received within a predetermined time interval and otherwise denying the access request, wherein the access request is denied when the access request is received from the automated agent.

2. The method of claim 1 wherein at least one visual attribute of the string is randomly modified to form the riddle, and the riddle is rendered as an image on a display device of the client computer.

3. The method of claim 2 wherein the modifying includes assigning a respective multiplicity of fonts to the respective characters in the string so as to modify the at least one visual attribute of the string to form the riddle.

4. The method of claim 2 wherein the random characters of the string are rendered using randomly selected fonts.

5. The method of claim 2 wherein the random characters of the string are rendered using randomly selected sizes of the characters.

6. The method of claim 2 wherein the random characters of the string are rendered using random spacing between the random characters.

7. The method of claim 2 wherein the random characters of the string are rendered along a randomly selected path.

8. The method of claim 2 wherein the random characters of the string are randomly rotated about a randomly selected point.

9. The method of claim 2 wherein the random characters of the string are rendered using randomly selected colors.

10. The method of claim 2 wherein the random characters of the string are overlaid on a randomly selected background in the image.

11. The method of claim 10 wherein the background is a randomly generated maze.

12. The method of claim 1 wherein similarly appearing random characters are discarded before forming the string.

13. The method of claim 1 wherein the riddle is a natural language question rendered as text.

14. The method of claim 1 wherein at least one audio attribute of the string is randomly modified to form the riddle, and the riddle is rendered as an audio signal by a loudspeaker of the client computer.

15. The method of claim 1 wherein the audio signal is randomly distorted.

16. The method claim 15 wherein random noise is added to the audio signal.

17. The method of claim 1 further including:

sending a first message to the client computer in response to receiving the access request from the client computer, the first message including the random characters of the string in the modified form of the riddle, a current time supplied by the server computer, the access request, and further including a first encoded value of a combination of the string, the current time, the access request and a master secret possessed by the server computer.

18. The method of claim 17 wherein the encoded value is generated by applying a hash function on the combination of the string, the current time, the access request and the master secret.

19. The method of claim 18 further including receiving a second message from the client computer, the second message including the answer, the current time supplied by the server, the access request, and the encoded value.

20. The method of claim 19 further including comparing a second encoded value computed by applying the hash function to a combination of the answer, the current time, the access request, and the master secret with the first encoded value to determine if the answer is identical to the string.

21. The method of claim 20 further including terminating the connection between the client computer and the server computer after the predetermined time interval from the current time of the first message.

22. The method of claim 2 wherein the client computer and the server computer are connected by the Internet, and the string is rendered using a Web page.

23. The method of claim 1 further including:

sending a first message to the client computer in response to receiving the access request from the client computer, the first message including the random characters of the string in the modified riddle form, a current time supplied by the server computer, and further including a first encoded value of a combination of the string, the current time, and a master secret possessed by the server computer; and

storing the first encoded value in a memory of the client computer.

24. The method of claim 23 further including:

receiving a second message from the client computer, the second message including the answer, the current time supplied by the server, and the encoded value.

25. The method of claim 24 further including comparing a second encoded value computed by applying the hash function to a combination of the answer, the current time, and the master secret with the stored first encoded value to determine if the answer is identical to the string.

26. The method of claim 25 wherein the first encoded value is removed from the memory after a first predetermined time interval.

27. The method of claim 26 further including:

terminating the connection between the client computer and the server computer if another access request is from the client within a second predetermined time interval, the second predetermined time interval being substantially less than the first predetermined time interval.

28. The method of claim 1 further including:

sending a first message to the client computer in response to receiving the access request from the client computer, the first message including the random characters of the string in the modified riddle form, and a transaction identifier; and

storing the string and a current time of the server with an associated transaction identifier in a memory of the client computer.

29. The method of claim 28 further including:

receiving a second message from the client computer, the second message including the answer, the access request, and the transaction identifier.

30. The method of claim 29 further including comparing the answer with the stored string of the associated transaction identifier to determine if the answer is identical to the string.

31. The method of claim 30 wherein the access request and the associated transaction identifier are removed from the memory after a first predetermined time interval from the current time of the first message.

32. The method of claim 31 further including:

terminating the connection between the client computer and the server computer if another access request is from the client within a second predetermined time interval, the second predetermined time interval being substantially less than the first predetermined time interval.

33. The method of claim 1 further including:

sending a first message to the client computer in response to receiving the access request from the client computer, the first message including the random characters of the string in the modified riddle form, a current time supplied by the server computer, the access request, an address of the client computer, and further including a first encoded value of a combination of the string, the current time, the access request, the address, and a master secret possessed by the server computer.

34. The method of claim 32 wherein the encoded value is generated by applying a hash function on the combination of the string, the current time, the access request, the address and the master secret.

35. The method of claim 33 further including receiving a second message from the client computer, the second message including the answer, the current time supplied by the server, the access request, and the encoded value.

36. The method of claim 34 further including comparing a second encoded value computed by applying the hash function to a combination of the answer, the current time, the access request, the address, and the master secret with the first encoded value to determine if the answer is identical to the string.

37. The method of claim 35 wherein the access request is accepted if the second message including the correct answer is received within the predetermined time interval from the current time supplied by the server computer.

38. The method of claim 36 further including terminating the connection between the client computer and the server computer after the predetermined time interval from the current time of the first message.

39. The method of claim 1 further including:

accepting a predetermined number of access requests after the correct answer is received before rendering an additional riddle.

40. The method of claim 1 further including:

sending a password to the user if a predetermined number of access requests are accepted from the client; and

accepting additional access requests from the client if the additional access requests are received along with the password.

41. The method of claim 40 further including:

revoking the password if the rate at which the additional access requests are received is less than a predetermined threshold.

42. The method of claim 1 wherein the access request is an electronic mail message.

43. The method of claim 1 wherein the server computer is a search engine, and the access request is to add a Web page to an index of the server computer.

44. The method of claim 1 wherein the server computer stores information, and the access request is to read the information.

45. The method of claim 1 wherein the access request is a response from the client computer to a poll generated by the server computer.

46. The method of claim 1 wherein the access request is an entry for a contest operated by the server computer.

47. An apparatus for accepting access requests from a client computer connected to a server computer by a network, comprising:

means for receiving an access request in the server computer from the client computer via the network;

a random character generator generating a predetermined number of random characters to form a string in the server computer in response to the access request;

means for modifying at least one perceptual attribute of the string of random characters to form a riddle configured to be easily answer by a human being with no advance knowledge of the riddle while being substantially difficult to answer by an automated agent unaided by a human being, the string being a correct answer to the riddle;

means for rendering the riddle on an output device of the client computer, a correct answer to the riddle being the string;

means for receiving an answer to the riddle from the client computer;

means for determining if the answer to the riddle is correct; and

means for accepting the access request if the answer is correct and received within a predetermined time interval and otherwise denying the access request, wherein the access request is denied when the access request is received from the automated agent.

48. A computer program product for use in conjunction with a computer system, the computer program product comprising a computer readable storage medium and a computer program mechanism embedded therein, the computer program mechanism for selectively accepting access requests from a client computer connected to a server computer by a network, the computer program mechanism comprising:

instructions that receive an access request in the server computer from the client computer via the network;

instructions that generate a predetermined number of random characters to form a string in the server computer in response to the access request;

instructions that modify at least one perceptual attribute of the string of random characters to form a riddle configured to be easily answered by a human being with no advance knowledge of the riddle while being substantially difficult to answer by an automated agent unaided by a human being, the string being a correct answer to the riddle;

instructions that render the riddle on an output device of the client computer;

instructions that receive an answer to the riddle from the client computer;

instructions that determine if the answer to the riddle is correct;

instructions that accept the access request if the answer is correct and received within a predetermined time interval and that otherwise deny the access request, wherein the access request is denied when the access request is received from the automated agent.

49. The computer program product of claim 48 wherein the instructions that modify the string randomly modify at least one visual attribute of the string to form the riddle and the instructions that render the riddle render the riddle as an image on a display device of the client computer.

50. The computer program product of claim 49 wherein the instructions that modify the string assign a respective multiplicity of fonts to the respective characters in the string so as to modify the at least one visual attribute of the string to form the riddle.

51. The computer program product of claim 49 wherein the instructions render the random characters of the string using randomly selected fonts.

52. The computer program product of claim 49 wherein the instructions render the random characters of the string using randomly selected sizes of the characters.

53. The computer program product of claim 49 wherein the instructions render the random characters of the string using random spacing between the random characters.

54. The computer program product of claim 49 wherein the instructions render the random characters of the string along a randomly selected path.

55. The computer program product of claim 50 wherein the instructions render the random characters of the string rotated about a randomly selected point.

56. The computer program product of claim 50 wherein the instructions render the random characters of the string using randomly selected colors.

57. The computer program product of claim 50 wherein the instructions that render overlay the random characters of the string on a randomly selected background in the image.

58. The computer program product of claim 57 wherein the background is a randomly generated maze.

59. The computer program product of claim 48 further comprising instructions that discard similarly appearing random characters before forming the string.

60. The computer program product of claim 48 further comprising:

instructions that send a password to the user if a predetermined number of access requests are accepted from the client; and

instructions that accept additional access requests from the client if the additional access requests are received along with the password.

61. The computer program product of claim 60 further including instructions that revoke the password if the rate at which the additional access requests are received is less than a predetermined threshold.

62. A computer system for selectively accepting access requests from a client computer connected to a server computer by a network, comprising:

a memory; and

a processor to execute instructions stored in the memory, wherein the memory stores instructions that;

receive an access request in the server computer from the client computer via the network;

generate a predetermined number of random characters to form a string in the server computer in response to the access request;

modify at least one perceptual attribute of the string of random characters to form a riddle configured to be easily answered by a human being with no advance knowledge of the riddle while being substantially difficult to answer by an automated agent unaided by a human being, the string being a correct answer to the riddle;

render the riddle on an output device of the client computer;

receive an answer to the riddle from the client computer;

determine if the answer to the riddle is correct; and

accept the access request if the answer is correct and received within a predetermined time interval and otherwise deny the access request, wherein the access request is denied when the access request is received from the automated agent.

63. The computer system of claim 62, the memory further storing instructions that modify the string randomly modify at least one visual attribute of the string to form the riddle and the instructions that render the riddle render the riddle as an image on a display device of the client computer.

64. The computer system of claim 63, wherein the instructions that modify the string assign a respective multiplicity of fonts to the respective characters in the string so as to modify the at least one visual attribute of the string to form the riddle.

65. The computer system of claim 63, the memory further storing instructions that render the random characters of the string using randomly selected fonts.

66. The computer system of claim 64, the memory further storing instructions that render the random characters of the string using randomly selected sizes of the characters.

67. The computer system of claim 64, the memory further storing instructions that render the random characters of the string using random spacing between the random characters.

68. The computer system of claim 64, the memory further storing instructions that render the random characters of the string along a randomly selected path.

69. The computer system of claim 64, the memory further storing instructions that render the random characters of the string rotated about a randomly selected point.

70. The computer system of claim 64, the memory further storing instructions that render the random characters of the string using randomly selected colors.

71. The computer system of claim 64, the memory further storing instructions that overlay the random characters of the string on a randomly selected background in the image.

72. The computer system of claim 71 wherein the background is a randomly generated maze.

73. The computer system of claim 62, the memory further storing instructions that discard similarly appearing random characters before forming the string.

74. The computer system of claim 62, the memory further storing instructions that:

send a password to the user if a predetermined number of access requests are accepted from the client; and

accept additional access requests from the client if the additional access requests are received along with the password.

75. The computer system of claim 74, the memory further storing instructions that revoke the password if the rate at which the additional access requests are received is less than a predetermined threshold.