Method and system for distinguishing humans from machines and for controlling access to network services

A method for controlling access to network services, wherein the method is applicable on a trusted network having a trusted party, a user terminal, a decision point for distinguishing humans from computers, and a network server, the method comprising:

• receiving at the decision point from a plurality of user terminals a first request for network service access, the first request carrying a first identity certificate issued by the trusted party and signed by a signature containing a user identification (ID) tied to a trusted module ID identifying a trusted module embedded in and belonging to the plurality of user terminal;
• verifying, at the decision point, the user ID and the trusted module ID according to the first identity certificate;
• determining, at the decision point, whether the plurality of user terminals, having the user ID and the trusted module ID, requesting the network service access exceeds a threshold number by:
• counting a number of the plurality of user terminals, the number of the plurality of user terminals requesting network service access within a preset period of time, and
• comparing the counted number of the plurality of user terminals with the threshold number;
• deciding, at the decision point, whether the first request for network service access is made by a human user, based on whether the counted number exceeds the threshold number;
• and
• upon deciding the first request is made by a human user,
• transmitting, from the decision point to a first user terminal of the plurality of user terminal, a user terminal authorization credential encrypted with user terminal identity information, and
• transmitting, from the decision point to the network server, a network server authorization credential encrypted with network server identity information,
• wherein the first user terminal and network server authorization credentials are configured to enable the network server to verify the user terminal authorization credential against the network server authorization credential.

A computer-based apparatus for distinguishing humans from computers, the apparatus comprising:

• a computer having a processor, computer-readable memory and storage medium, and I/O devices, the computer being programmed to perform functions including:
• receiving from a plurality of user terminals a first request for network service access, the first request carrying a first identity certificate issued by the trusted party and signed by a signature containing a user identification (ID) tied to a trusted module ID identifying a trusted module embedded in and belonging to the plurality of user terminals;
• verifying the user ID and the trusted module ID according to the first identity certificate;
• determining whether the plurality of user terminals, having the user ID and the trusted module ID, requesting the network service access exceeds a threshold number by:
• counting a number of the plurality of user terminals, the number of the plurality of user terminals requesting network service access within a preset period of time, and
• comparing the counted number of the plurality of user terminals with the threshold number;
• deciding whether the first request for network service access is made by a human user based on whether the counted number exceeds the threshold number;
• and
• upon deciding the first request is made by a human user,
• transmitting, to a first user terminal of the plurality of user terminals, a user terminal authorization credential encrypted with user terminal identify information and a decision point identification certificate issued by the trusted party, and
• transmitting, to the network server, a network server authorization credential encrypted with network server identity information and the decision point identification certificate issued by the trusted party,
• wherein the first user terminal and network server authorization credentials are configured to enable the network server to verify the user terminal authorization credential against the network server authorization credential.