Familiar dynamic human challenge response test content

• US 9,485,253 B2
• Filed: 10/23/2015
• Issued: 11/01/2016
• Est. Priority Date: 12/20/2011
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Carlson, Mark, Mayor, Shalini
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Kaplan, Benjamin
• Application Number:
  US14/922,040
• Publication Number:
  US 20160057143A1
• Time in Patent Office: 375 Days
• Field of Search: 726/6, 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the invention are directed to human challenge response test delivery systems and methods. Specifically, embodiments of the present invention are directed to secure human challenge response test delivery services of configurable difficulty for user devices. One embodiment of the present invention is directed to methods and systems for implementing a familiar and dynamic human challenge response test challenge repository created from transaction data. The dynamic human challenge response test challenge repository may be created by a server computer receiving a plurality of transaction data. Challenge items may be extracted from the transaction data using an extraction algorithm. Furthermore, in some embodiments a challenge message may be sent to a requestor, a verification request may be received, and the verification request may be compared to the challenge message. Another embodiment may be directed at using user information in a human challenge response test to mutually authenticate a user and a service provider.

Claims

1. A method comprising:

receiving transaction data associated with a plurality of transactions at a server computer;

scrubbing the transaction data of personally identifiable information that can be used to identify a person or an account associated with the transaction data;

extracting, by the server computer, a plurality of challenge items from the scrubbed transaction data using an extraction algorithm, the extraction algorithm selecting the plurality of challenge items from data strings in the transaction data;

storing, by the server computer, the plurality of challenge items in a challenge repository, wherein the plurality of challenge items may be used to generate distorted challenge messages;

electronically providing, by the server computer to a user device over a communications network, a distorted challenge message comprising one or more of the plurality of challenge items from the challenge repository along with other distorted challenge items not derived from the received transaction data; and

receiving, by the server computer from the user device over the communications network, a selection of the one or more of the plurality of challenge items from the challenge repository from among the one or more challenge items and the other distorted challenge items.

2. The method of claim 1 further comprising:

receiving a challenge message request from a requestor;

determining a difficulty level for the challenge message request;

generating a challenge message comprising the one or more of the plurality of challenge items from the challenge repository;

distorting the challenge message to create the distorted challenge message;

sending the distorted challenge message to the requestor;

receiving a challenge verification request including a user input from the requestor;

determining whether the user input included in the challenge verification request matches the one or more of the plurality of challenge items included in the challenge message; and

sending a challenge verification response indicating whether the user input included in the challenge verification request matches the one or more of the plurality of the challenge items included in the challenge message, wherein the challenge verification response indicates that a user associated with the requestor is human where the challenge verification response indicates the user input matches the one or more of the plurality of the challenge items in the challenge message.

3. The method of claim 2 wherein determining the difficulty level for the challenge message request further comprises determining a security level based on requestor information, wherein the requestor information includes at least one of the identity of the requestor, a type of service provided by the requestor, or the location of the requestor.

4. The method of claim 2, wherein the one or more of the plurality of challenge items includes a number of challenge items determined by the difficulty level.

5. The method of claim 2, wherein the challenge message is distorted according to the difficulty level, wherein the distorted challenge message has a high amount of distortion if the difficulty level is high and a low amount of distortion if the difficulty level is low.

6. The method of claim 1 wherein extracting the plurality of challenge items from the transaction data further comprises:

determining a location of a user; and

extracting the plurality of challenge items from transaction data associated with transactions initiated near the location of the user.

7. The method of claim 1, wherein the plurality of challenge items are stored according to their level of complexity.

8. A server computer comprising:

a processor; and

a non-transitory computer readable medium coupled to the processor and comprising code executable by the processor to implement a method, the method comprising;

receiving transaction data associated with a plurality of transactions;

scrubbing the transaction data of personally identifiable information that can be used to identify a person or an account associated with the transaction data;

extracting a plurality of challenge items from the scrubbed transaction data using an extraction algorithm, the extraction algorithm selecting the plurality of challenge items from data strings in the transaction data;

storing the plurality of challenge items in a challenge repository, wherein the plurality of challenge items may be used to generate distorted challenge messages;

electronically providing, to a user device over a communications network, a distorted challenge message comprising one or more of the plurality of challenge items from the challenge repository; and

receiving, from the user device over the communications network, a selection of the one or more of the plurality of challenge items from the challenge repository from among the one or more challenge items and the other distorted challenge items.

9. The server computer of claim 8, wherein the method further comprises:

receiving a challenge message request from a requestor;

determining a difficulty level for the challenge message request;

generating a challenge message comprising the one or more of the plurality of challenge items from the challenge repository;

distorting the challenge message to create the distorted challenge message;

sending the distorted challenge message to the requestor;

receiving a challenge verification request including a user input from the requestor;

determining whether the user input included in the challenge verification request matches the one or more of the plurality of challenge items included in the challenge message; and

sending a challenge verification response indicating whether the user input included in the challenge verification request matches the one or more of the plurality of the challenge items included in the challenge message, wherein the challenge verification response indicates that a user associated with the requestor is human where the challenge verification response indicates the user input matches the one or more of the plurality of the challenge items in the challenge message.

10. The server computer of claim 9 wherein determining the difficulty level for the challenge message request further comprises determining a security level based on requestor information, wherein the requestor information includes at least one of the identity of the requestor, a type of service provided by the requestor, or the location of the requestor.

11. The server computer of claim 8 wherein extracting the plurality of challenge items from the transaction data further comprises:

determining a location of a user; and

extracting the plurality of challenge items from transaction data associated with transactions initiated near the location of the user.

12. The server computer of claim 8, wherein the plurality of challenge items are stored according to their level of complexity.

13. The server computer of claim 8, wherein a number of challenge items included in the challenge message is determined by the difficulty level.

14. The server computer of claim 8, wherein the challenge message is distorted according to the difficulty level, wherein the distorted challenge message has a high amount of distortion if the difficulty level is high and a low amount of distortion if the difficulty level is low.

15. A method comprising:

providing, by a user device operated by a user, a user identifier to a server computer via a communications network;

receiving, by the user device and from the server computer over the communications network, a plurality of distorted challenge items, wherein one or more of the distorted challenge items in the plurality of distorted challenge items is derived from transaction data relating to a transaction conducted by the user;

selecting, by the user device in response to input by the user, the one or more distorted challenge items derived from the transaction data from the plurality of distorted challenge items; and

providing, by the user device to the server computer over the communications network, the selection of the one or more distorted challenge items,

wherein the server computer thereafter verifies that the user is authentic and that the input was from a human and not a computer program after receiving the selection of the one or more distorted challenge items.

16. The method of claim 15, wherein one or more of the distorted challenge items in the plurality of distorted challenge items is derived from account information associated with the user identifier.

17. The method of claim 15, wherein one or more of the distorted challenge items in the plurality of distorted challenge items is derived from transaction information associated with the user identifier.

18. The method of claim 15, wherein a number of distorted challenges in the received plurality of distorted challenge items is determined based on a difficulty level associated with the user device and/or a request including the user identifier.

19. The method of claim 15, wherein the server computer derives one or more of the plurality of challenge items by determining a user information database associated with the user identifier, scrubbing the user information database of personally identifiable information that can be used to identify the user or an account associated with the user information database, and extracting a plurality of personal challenge items from the scrubbed transaction data using an extraction algorithm, the extraction algorithm selecting the plurality of personal challenge items from data strings in the scrubbed user information database.

20. The method of claim 15, wherein the distorted challenge items are distorted according to a difficulty level associated with user device and/or a request including the user identifier, wherein the distorted challenge items have a high amount of distortion if the difficulty level is high and a low amount of distortion if the difficulty level is low.