Multi-step challenge-response test
AssigneeYahoo! Inc.
InventorSimon P. King
Life of this patent
Estimating the term…
Abstract
A method of obtaining access to an Internet service using a multi-step challenge response test is presented. The method calculates a threshold probability for access to the Internet service and generates a number of challenge-response tests. Each of the challenge-response tests is rendered on a display of a client device. An input corresponding to the response to one of the challenge-response tests is received and an authentication probability is calculated after each response. The authentication probability is evaluated after each response and if the authentication probability is higher than the threshold probability access to the Internet service is provided.
Claims18
A method of obtaining access to an Internet service using a multi-step challenge response test, comprising:
- calculating a threshold probability for access to the Internet service;
- generating a plurality of challenge response tests, such that each challenge response test is rendered on a display of a client device, wherein at least one of the plurality of challenge response tests is a single-character, motion-enabled challenge response test;
- receiving an input corresponding to a response to one of the challenge response tests;
- calculating an authentication probability after each response, the authentication probability depending at least in part on PMOC, where PMOC is a probability that an attacking system correctly solves a challenge response test and PMOC is higher than a probability corresponding to random guessing;
- evaluating after each response if the authentication probability is higher than the threshold probability;
- providing access to the Internet service if the authentication probability is higher than the threshold probability;
- and
- increasing a number of challenge response tests rendered on the display if the authentication probability is between the threshold probability and a lower threshold probability after the plurality of challenge response tests are completed the lower threshold probability indicating that a request for access to the Internet service is being made by an attacking system.
An authentication method based on monitored activity, comprising:
- receiving a request for an activity to be performed through an Internet service;
- displaying a plurality of challenge response tests on a display of a client system;
- calculating an authentication probability after a response to each challenge-response test, the authentication probability depending at least in part on PMOC, where PMOC is a probability that an attacking system correctly solves a challenge-response test and PMOC is higher than a probability corresponding to random guessing;
- if the authentication probability is below the threshold probability and above a lower threshold probability, generating at least one additional challenge-response test, the lower threshold probability indicating that the request for the activity to be performed through the Internet service is being made by an attacking system;
- and
- rendering the at least one additional challenge-response test on the display of the client system.
A computing system for obtaining access to an Internet service using a multi-step challenge response test, comprising:
- an assumptions database for generating assumptions based on activity data associated with the Internet service and of an account making a request for the Internet service;
- an input engine for generating the multi-step challenge-response test having a plurality of challenge-response tests;
- a calculator engine receiving responses to each challenge-response test and calculating an authentication probability based on assumptions transmitted by the assumptions engine and responses to each challenge-response test transmitted by the input engine, the authentication probability depending at least in part on PMOC, where PMOC is a probability that an attacking system correctly solves a challenge response test and PMOC is higher than a probability corresponding to random guessing;
- and
- a threshold engine comparing the authentication probability transmitted by the calculator engine to a threshold probability and a lower threshold probability associated with the Internet service, the lower threshold probability indicating that the request for the Internet service is being made by an attacking system, such that if the authentication probability is between the threshold probability and the lower threshold probability, the threshold engine indicates to the input engine to generate at least an additional challenge-response test.
Dependencies are inferred from the claim text.