# US 2018/0322270 A1 · Systems and methods for distinguishing among human users and software robots > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0322270 A1 - Document ID: US20180322270A1 - Status: Published application - Kind: A1 - Application number: 15/588,124 - Filed: 2017-05-05 - Published: 2018-11-08 - Earliest claimed: 2017-05-05 - Assignees: Mastercard Technologies Canada Ulc - Applicants: Mastercard Technologies Canada ULC - Inventors: Christopher Everett Bailey; Randy Lukashuk; Jonathan Cunningham - Web page: https://patentgrep.com/patent/US20180322270A1 ## CPC - G06F 21/36: by graphic or iconic representation - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06F 2221/2133: Verifying human interaction, e.g., Captcha - H04L 2463/121: Timestamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A technique for distinguishing between a human user and a software robot. The technique includes: receiving a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image encoding the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image; transmitting the shuffled image and the decoding information to the device; receiving a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text. ## Claims ### Claim 1 A system, comprising: at least one computer; and at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one computer, cause the at least one computer to perform: receiving, via at least one network, a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image representing the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image; transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image; receiving, via the at least one network, a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text. ### Claim 2 (canceled) ### Claim 3 (depends on 1) The system of claim 1, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform: generating a webpage to include the software code and the shuffled image, wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device. ### Claim 5 (depends on 1) The system of claim 1, wherein generating the decoding information comprises: generating the table storing correspondences between locations in the initial image and locations in the shuffled image. ### Claim 6 (depends on 5) The system of claim 5, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises: generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion. ### Claim 7 (depends on 1) The system of claim 1, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform: identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated; validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and providing the device with access to the web resource based on results of validating the second communication. ### Claim 9 A method, performed by at least one computer, the method comprising: receiving, via at least one network, a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image representing the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image; transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image; receiving, via the at least one network, a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text. ### Claim 10 (canceled) ### Claim 11 (depends on 9) The method of claim 9, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device. ### Claim 12 (depends on 9) The method of claim 9, further comprising: generating a webpage to include the software code and the shuffled image, wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device. ### Claim 13 (depends on 9) The method of claim 9, wherein generating the decoding information comprises: generating the table storing correspondences between locations in the initial image and locations in the shuffled image. ### Claim 14 (depends on 13) The method of claim 13, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises: generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion. ### Claim 15 (depends on 9) The method of claim 9, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random. ### Claim 16 (depends on 9) The method of claim 9, further comprising: identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated; validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and providing the device with access to the web resource based on results of validating the second communication. ### Claim 17 At least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by at least one computer, cause the at least one computer to perform: receiving, via at least one network, a first communication from a device different from the at least one computer; identifying, from the first communication, a request to access a web resource; generating a shuffled image that encodes a challenge text, the generating comprising: generating an initial image representing the challenge text; dividing the initial image into image portions; and generating the shuffled image as a shuffled arrangement of the image portions; generating decoding information for revealing the challenge text encoded in the shuffled image, wherein the decoding information comprises a table storing correspondences between locations in the initial image and locations in the shuffled image; transmitting, to the device and via the at least one network, the shuffled image, the decoding information, and software code, wherein the software code, when executed by the device, uses the decoding information to facilitate revealing, by the device, of the challenge text encoded in the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement to recover the initial image; receiving, via the at least one network, a second communication from the device; identifying, from the second communication, a response text; and providing the device with access to the web resource based on a comparison between the challenge text and the response text. ### Claim 18 (canceled) ### Claim 19 (depends on 17) The at least one non-transitory computer-readable storage medium of claim 17, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device. ### Claim 20 (depends on 17) The at least one non-transitory computer-readable storage medium of claim 17, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform: generating a webpage to include the software code and the shuffled image, wherein transmitting the shuffled image and the decoding information to the device comprises transmitting the webpage to the device. ### Claim 21 (depends on 17) The at least one non-transitory computer-readable storage medium of claim 17, wherein generating the decoding information comprises: generating the table storing correspondences between locations in the initial image and locations in the shuffled image. ### Claim 22 (depends on 21) The at least one non-transitory computer-readable storage medium of claim 21, wherein generating the table storing correspondences between locations in the initial image and locations in the shuffled image comprises: generating first information specifying a first location in the initial image for a first image portion in the shuffled arrangement of image portions; and generating second information specifying a second location in the initial image for a second image portion in the shuffled arrangement of image portions, wherein the first location is different from the second location, and wherein the first image portion is different from the second image portion. ### Claim 23 (depends on 17) The at least one non-transitory computer-readable storage medium of claim 17, wherein generating the shuffled image as a shuffled arrangement of the image portions comprises rearranging the image portions at random. ### Claim 24 (depends on 17) The at least one non-transitory computer-readable storage medium of claim 17, wherein the processor-executable instructions, when executed, further cause the at least one computer to perform: identifying a challenge token from the second communication, the challenge token including a timestamp indicating a time at which the second communication was generated; validating the second communication using the challenge token by verifying that the second communication was generated within a threshold time of transmitting the shuffled image and the decoding information to the device; and providing the device with access to the web resource based on results of validating the second communication. ### Claim 25 A device, comprising: at least one hardware processor; and at least one non-transitory computer-readable storage medium storing processor-executable instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform: transmitting, to at least one computer and via at least one network, a first communication comprising a request to access a web resource; receiving, from the at least one computer and via the at least one network, a shuffled image that encodes a challenge text, decoding information, and software code, wherein: the shuffled image comprises a shuffled arrangement of image portions of an unshuffled image, the decoding information comprises a table storing correspondences between locations in the unshuffled image and locations in the shuffled image, and the software code is configured to use the decoding information to recover the unshuffled image from the shuffled image at least in part by using the correspondences stored in the table to rearrange the image portions in the shuffled arrangement; executing the software code, using the decoding information and the shuffled image, to generate the unshuffled image; displaying, to a user of the device, the unshuffled image to reveal the challenge text; receiving, from the user of the device, input specifying a response text; and transmitting, to the at least one computer and via the at least one network, a second communication comprising the response text. ### Claim 26 (canceled) ### Claim 27 (depends on 25) The device of claim 25, wherein the software code comprises JAVASCRIPT software code for execution by an Internet browser executing on the device. ### Claim 28 (depends on 25) The device of claim 25, wherein the software code is further configured to cause the device to display the unshuffled image to reveal the challenge text, and the displaying comprises: executing the software code using an Internet browser executing on the device to display the unshuffled image. ### Claim at position 29 29-30. (canceled) ### Claim 31 (depends on 25) The device of claim 25, wherein the processor-executable instructions, when executed, further cause the at least one hardware processor to perform: generating a challenge token, the challenge token including a timestamp indicating a time at which the challenge token was generated; including the challenge token in the second communication; and receiving access to the web resource responsive to generating the challenge token within a threshold time of the shuffled image and the decoding information being transmitted to the device.