# US 2013/0160098 A1 · Familiar dynamic human challenge response test content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160098 A1 - Document ID: US20130160098A1 - Status: Published application - Kind: A1 - Application number: 13/721,647 - Filed: 2012-12-20 - Published: 2013-06-20 - Earliest claimed: 2011-12-20 - Assignees: Visa International Service Association - Inventors: Mark Carlson; Shalini Mayor - Web page: https://patentgrep.com/patent/US20130160098A1 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 21/31: User authentication - G06F 21/45: Structures or tools for the administration of authentication - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/2133: Verifying human interaction, e.g., Captcha - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments of the invention are directed to human challenge response test delivery systems and methods. Specifically, embodiments of the present invention are directed to secure human challenge response test delivery services of configurable difficulty for user devices. One embodiment of the present invention is directed to methods and systems for implementing a familiar and dynamic human challenge response test challenge repository created from transaction data. The dynamic human challenge response test challenge repository may be created by a server computer receiving a plurality of transaction data. Challenge items may be extracted from the transaction data using an extraction algorithm. Furthermore, in some embodiments a challenge message may be sent to a requestor, a verification request may be received, and the verification request may be compared to the challenge message. Another embodiment may be directed at using user information in a human challenge response test to mutually authenticate a user and a service provider. ## Claims ### Claim 1 A method comprising: receiving transaction data associated with a plurality of transactions; extracting, by a server computer, a plurality of challenge items from the transaction data using an extraction algorithm; storing the plurality of challenge items in a challenge repository, wherein the plurality of challenge items may be used to generate distorted challenge messages; and electronically providing a distorted challenge message comprising one or more of the plurality of challenge items from the challenge repository. ### Claim 2 (depends on 1) The method of claim 1 further comprising: receiving a challenge message request from a requestor; determining a difficulty level for the challenge message request; generating a challenge message comprising one or more of the plurality of challenge items from the challenge repository; distorting the challenge message to create the distorted challenge message; sending the distorted challenge message to the requestor; receiving a challenge verification request from the requestor; determining whether the challenge verification request matches the challenge message; and sending a challenge verification response indicating whether the challenge verification request matches the challenge message. ### Claim 3 (depends on 1) The method of claim 1 wherein extracting one or more challenge items from the transaction data further comprises: determining a location of a user; and extracting the one or more challenge items from transaction data associated with transactions initiated near the location of the user. ### Claim 4 (depends on 2) The method of claim 2 wherein determining the difficulty level for the challenge message request further comprises determining a security level based on requestor information, wherein the requestor information includes the identity of the requestor, a type of service provided by the requestor, or the location of the requestor. ### Claim 5 (depends on 1) The method of claim 1, wherein the plurality of challenge items are stored according to their level of complexity. ### Claim 6 (depends on 2) The method of claim 2, wherein the number of challenge items included in the challenge message is determined by the difficulty level. ### Claim 7 (depends on 2) The method of claim 2, wherein the challenge message is distorted according to the difficulty level, wherein the distorted challenge message has a high amount of distortion if the difficulty level is high and a low amount of distortion if the difficulty level is low. ### Claim 8 A server computer comprising: a processor; and a non-transitory computer readable medium coupled to the processor and comprising code executable by the processor to implement a method, the method comprising: receiving transaction data associated with a plurality of transactions; extracting a plurality of challenge items from the transaction data using an extraction algorithm; storing the plurality of challenge items in a challenge repository, wherein the plurality of challenge items may be used to generate distorted challenge messages; and providing a distorted challenge message comprising one or more of the plurality of challenge items from the challenge repository. ### Claim 9 (depends on 8) The server computer of claim 8, wherein the method further comprises: receiving a challenge message request from a requestor; determining a difficulty level for the challenge message request; generating a challenge message comprising one or more of the plurality of challenge items from the challenge repository; distorting the challenge message to create the distorted challenge message; sending the distorted challenge message to the requestor; receiving a challenge verification request from the requestor; determining whether the challenge verification request matches the challenge message; and sending a challenge verification response indicating whether the challenge verification request matches the challenge message. ### Claim 10 (depends on 8) The server computer of claim 8 wherein extracting one or more challenge items from the transaction data further comprises: determining a location of a user; and extracting the one or more challenge items from transaction data associated with transactions initiated near the location of the user. ### Claim 11 (depends on 9) The server computer of claim 9 wherein determining the difficulty level for the challenge message request further comprises determining a security level based on requestor information, wherein the requestor information includes the identity of the requestor, a type of service provided by the requestor, or the location of the requestor. ### Claim 12 A method comprising: receiving a user identifier; determining a challenge repository associated with the user identifier; generating, by a server computer, a challenge message including a personal challenge item from the challenge repository and one or more false challenges, wherein the personal challenge item is associated with a challenge question and wherein the false challenges are associated with the challenge question; distorting the challenge message to create a distorted challenge message; and providing the distorted challenge message and the challenge question to a user, wherein the challenge question is associated with the personal challenge item. ### Claim 13 (depends on 12) The method of claim 12 further comprising: receiving a challenge response from the user; determining whether the challenge response matches the personal challenge item; and authenticating the user if the challenge response matches the personal challenge item, wherein the user authenticates the server computer if the user recognizes the personal challenge item. ### Claim 14 (depends on 12) The method of claim 12 wherein the challenge data comprises account information associated with the user identifier. ### Claim 15 (depends on 12) The method of claim 12 wherein the challenge data comprises transaction data associated with the user identifier. ### Claim 16 (depends on 12) The method of claim 12 further comprising determining a difficulty level for the challenge message, wherein the number of false challenges and the personal challenge item is determined by the difficulty level. ### Claim 17 A server computer comprising: a processor; and a non-transitory computer readable medium coupled to the processor and comprising code executable by the processor to implement a method, the method comprising: receiving a user identifier; determining challenge data associated with the user identifier; generating a challenge message including a personal challenge item from the challenge repository and one or more false challenges, wherein the personal challenge item is associated with a challenge question and wherein the false challenges are associated with the challenge question; distorting the challenge message to create a distorted challenge message; and providing the distorted challenge message and the challenge question to a user. ### Claim 18 (depends on 17) The server computer of claim 17, wherein the method further comprises: receiving a challenge response from the user; determining whether the challenge response matches the personal challenge item; and authenticating the user if the challenge response matches the personal challenge item, wherein the user authenticates the server computer. ### Claim 19 (depends on 17) The method of claim 17 wherein the challenge data comprises account information associated with the user identifier. ### Claim 20 (depends on 17) The server computer of claim 17 wherein the challenge data comprises transaction data associated with the user identifier. ### Claim 21 (depends on 17) The server computer of claim 17 wherein the method further comprises determining a difficulty level for the challenge message, wherein the number of false challenges is determined by the difficulty level.