Patent Application
20180052986
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) tests are commonly used to secure web applications and can be performed in a variety of ways. Common techniques include requiring the user to read distorted images of text and enter that text into an input field for submission and evaluation. Most commonly used CAPTCHA tests are vulnerable to circumvention strategies that include software implemented circumvention and brute force circumvention using human operators.
In summary, one aspect provides a method, comprising: providing, using a processor, a user challenge over a network, wherein the user challenge is associated with a predetermined gesture to be performed by a user; obtaining, using a processor, user image data; determining, using the user image data, that a user has performed the predetermined gesture; and thereafter providing the user access to information.
Another aspect provides a device, comprising: a network connection; a processor; and a memory that stores instructions executable by the processor to: provide a user challenge over a network, wherein the user challenge is associated with a predetermined gesture to be performed by a user; obtain user image data; determine, using the user image data, that a user has performed the predetermined gesture; and thereafter provide the user access to information.
A further aspect provides a program product, comprising: a computer readable storage device that stores code that is executable by a processor, the code comprising: code that provides a user challenge over a network, wherein the user challenge is associated with a predetermined gesture to be performed by a user; code that obtains user image data; code that determines, using the user image data, that a user has performed the predetermined gesture; and code that thereafter provides the user access to information.
The foregoing is a summary and thus may contain simplifications, generalizations, and omissions of detail; consequently, those skilled in the art will appreciate that the summary is illustrative only and is not intended to be in any way limiting.
For a better understanding of the embodiments, together with other and further features and advantages thereof, reference is made to the following description, taken in conjunction with the accompanying drawings. The scope of the invention will be pointed out in the appended claims.
It will be readily understood that the components of the embodiments, as generally described and illustrated in the figures herein, may be arranged and designed in a wide variety of different configurations in addition to the described example embodiments. Thus, the following more detailed description of the example embodiments, as represented in the figures, is not intended to limit the scope of the embodiments, as claimed, but is merely representative of example embodiments.
Reference throughout this specification to “one embodiment” or “an embodiment” (or the like) means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearance of the phrases “in one embodiment” or “in an embodiment” or the like in various places throughout this specification are not necessarily all referring to the same embodiment.
Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments. One skilled in the relevant art will recognize, however, that the various embodiments can be practiced without one or more of the specific details, or with other methods, components, materials, et cetera. In other instances, well known structures, materials, or operations are not shown or described in detail to avoid obfuscation.
CAPTCHA tests can be bypassed using machine learning based attacks, low cost human operators, or by finding flaws in the CAPTCHA test implementation that allow it to be circumvented.
An embodiment solves this problem using a camera (e.g., a standard camera or a three dimensional (3-D) camera) and gesture recognition techniques to confirm a user has performed a predetermined gesture as part of a CAPTCHA test. When the user is presented with the CAPTCHA test, e.g., at a web page, prior at accessing a restricted area, prior to accessing a desktop or mobile application or feature, etc., the user will be given a simple set of instructions to perform a recognizable gesture. Possible examples of such gestures include: raising a left hand and showing three fingers, touching thumbs together, etc. A very large dictionary of gestures/gestures descriptions can be used or gestures/gesture descriptions can be generated in an automated fashion (e.g., at random).
An embodiment observes the performance of the gesture(s) by the user with locally available hardware, e.g., a standard camera, a depth-sensing camera, a stereo camera, data gloves, or other similar devices. The image or gesture data is captured locally and sent to a CAPTCHA protected server environment for evaluation. If the user is confirmed to have performed the gesture correctly or adequately, based on the image or gesture data, then this will be acknowledged and the process allowed to proceed, e.g., by providing a further or subsequent web page.
As an additional defense, image data of the user performing the gestures (e.g., video data) is also captured. This image data is used for a variety of reasons, e.g., to verify that the user is the same person in the future as well as prevent one person from abusing the system by solving CAPTCHA tests for more than one user.
The illustrated example embodiments will be best understood by reference to the figures. The following description is intended only by way of example, and simply illustrates certain example embodiments.
While various other circuits, circuitry or components may be utilized in information handling devices, with regard to mobile device circuitry 100, an example illustrated in
There are power management chip(s) 130, e.g., a battery management unit, BMU, which manage power as supplied, for example, via a rechargeable battery 140, which may be recharged by a connection to a power source (not shown). In at least one design, a single chip, such as 110, is used to supply BIOS like functionality and DRAM memory.
System 100 typically includes one or more of a WWAN transceiver 150 and a WLAN transceiver 160 for connecting to various networks, such as telecommunications networks and wireless Internet devices, e.g., access points. Additionally, devices 120 are commonly included and may be added based on a particular design. For example, additional devices 120 may include a sensor or sensor(s), for example an optical sensor such as a camera, as well as short range wireless devices, e.g., BLUETOOTH wireless communication devices. System 100 often includes a touch screen 170 for data input and display/rendering. System 100 also typically includes various memory devices, for example flash memory 180 and SDRAM 190.
The example of
In
In
The system, upon power on, may be configured to execute boot code 290 for the BIOS 268, as stored within the SPI Flash 266, and thereafter processes data under the control of one or more operating systems and application software (for example, stored in system memory 240). An operating system may be stored in any of a variety of locations and accessed, for example, according to instructions of the BIOS 268. As described herein, a device may include fewer or more features than shown in the system of
Information handling device circuitry, as for example outlined in
Illustrated in
An embodiment observes the performance of the gesture(s) by the user by obtaining image data at 302, e.g., using locally available hardware such as a standard camera, a depth-sensing camera, a stereo camera, data gloves, or other similar devices. The image data is captured locally and sent to a CAPTCHA protected server environment for evaluation at 302. A gesture detection algorithm is applied to the image data to determine, at 303, if the user is confirmed to have performed the gesture correctly or adequately, based on the image or gesture data obtained at 302. If so, this confirmation will be acknowledged and the process allowed to proceed, e.g., by providing a further or subsequent web page at 304. Otherwise, the user may be presented with another CAPTCHA test, as illustrated in
In an embodiment, a gesture based CAPTCHA test is therefore provided, e.g., to secure a protected web page requiring human action to obtain. A wide variety of gesture data may be used in this process. For example, the gesture data obtained at 302 may include standard image data, three dimensional (3D) image data, audio data, or a combination thereof.
The web page provided at 301 may include a request that the user perform one predetermined gesture or a series of predetermined gestures. The series of gestures may have to be performed in a predetermined order. Each gesture in the series may be evaluated, at 303, individually, i.e., serially, or each may be evaluated in a batch mode, i.e., using a single evaluation step. Moreover, more than one web page having a gesture based CAPTCHA test may be provided, e.g., as a more secure mechanism or in an effort to confirm weakly matched (low confidence) gesture data.
In an embodiment, the gesture or image data of the user may be stored for later use, e.g., to confirm the same user is or is not performing subsequent gestures. That is, as an additional defense, image data of the user performing the gestures (e.g., video data) is also captured. This image data is stored and may be used for a variety of reasons, e.g., to verify that the user is the same person in the future as well as prevent one person from abusing the system by solving CAPTCHA tests for more than one user.
An embodiment therefore provides an improved CAPTCHA test that uses gesture data, e.g., image data, to confirm that a human is requesting a web page. Furthermore, an embodiment may utilize a series of gestures and/or store gesture data of a user to increase the performance of the CAPTCHA test.
As will be appreciated by one skilled in the art, various aspects may be embodied as a system, method or device program product. Accordingly, aspects may take the form of an entirely hardware embodiment or an embodiment including software that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects may take the form of a device program product embodied in one or more device readable medium(s) having device readable program code embodied therewith.
It should be noted that the various functions described herein may be implemented using instructions stored on a device readable storage medium such as a non-signal storage device that are executed by a processor. A storage device may be, for example, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a storage medium would include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a storage device is not a signal and “non-transitory” includes all media except signal media.
Program code embodied on a storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, et cetera, or any suitable combination of the foregoing.
Program code for carrying out operations may be written in any combination of one or more programming languages. The program code may execute entirely on a single device, partly on a single device, as a stand-alone software package, partly on single device and partly on another device, or entirely on the other device. In some cases, the devices may be connected through any type of connection or network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made through other devices (for example, through the Internet using an Internet Service Provider), through wireless connections, e.g., near-field communication, or through a hard wire connection, such as over a USB connection.
Example embodiments are described herein with reference to the figures, which illustrate example methods, devices and program products according to various example embodiments. It will be understood that the actions and functionality may be implemented at least in part by program instructions. These program instructions may be provided to a processor of a device, a special purpose information handling device, or other programmable data processing device to produce a machine, such that the instructions, which execute via a processor of the device implement the functions/acts specified.
It is worth noting that while specific blocks are used in the figures, and a particular ordering of blocks has been illustrated, these are non-limiting examples. In certain contexts, two or more blocks may be combined, a block may be split into two or more blocks, or certain blocks may be re-ordered or re-organized as appropriate, as the explicit illustrated examples are used only for descriptive purposes and are not to be construed as limiting.
As used herein, the singular “a” and “an” may be construed as including the plural “one or more” unless clearly indicated otherwise.
This disclosure has been presented for purposes of illustration and description but is not intended to be exhaustive or limiting. Many modifications and variations will be apparent to those of ordinary skill in the art. The example embodiments were chosen and described in order to explain principles and practical application, and to enable others of ordinary skill in the art to understand the disclosure for various embodiments with various modifications as are suited to the particular use contemplated.
Thus, although illustrative example embodiments have been described herein with reference to the accompanying figures, it is to be understood that this description is not limiting and that various other changes and modifications may be affected therein by one skilled in the art without departing from the scope or spirit of the disclosure.
