Browser Attestation Challenge System for Bot Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current online systems lack effective mechanisms to differentiate between human-generated and automated requests, making it difficult to protect online resources from bots and maintain user trust.

Innovation Solution

A computer-implemented method and system that verifies browser authenticity by generating challenges requiring browser tasks, such as executing JavaScript instructions or rendering Scalable Vector Graphics, without human input, and compares the responses to determine authorized browsers, thereby granting or denying access to online resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional authentication mechanisms are used, then user trust is maintained, but automated attacks from bots cannot be effectively blocked

Engineering Contradiction:
Improveauthentication reliabilityVSAvoidautomated attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary verification by executing browser challenges (JavaScript, rendering tasks, hash functions) before granting access to online resources. This preliminary action identifies and blocks bot traffic in advance, preventing automated attacks before they can compromise the system while maintaining trust through reliable authentication of legitimate users.

Inventive Principle:
Principle #10Preliminary action

2Object-affected harmful factors

If sophisticated authentication mechanisms are implemented to discern between human and bot requests, then protection from automated attacks is improved, but system complexity increases

Engineering Contradiction:
Improveautomated attack protectionVSAvoidauthentication system complexity
Core Design Contradiction:
Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The authentication system leverages the browser's inherent capabilities (JavaScript engine, rendering engine, hash functions) to perform verification tasks. Instead of requiring complex external authentication infrastructure, the system uses the client's own browser resources to execute challenges and generate responses, thereby providing robust bot detection without proportionally increasing system complexity.

Inventive Principle:
Principle #25Self-service

3Object-affected harmful factors

If browser verification challenges are implemented, then bot access is reduced, but user experience may be interrupted

Engineering Contradiction:
Improvebot accessVSAvoiduser experience
Core Design Contradiction:
Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The browser verification challenges are designed to execute automatically in the background without requiring user awareness or interaction. The system rushes through the verification process by leveraging the browser's automated execution of JavaScript and rendering tasks, completing the authentication flow so quickly that users experience minimal to no interruption while still effectively blocking bot access.

Inventive Principle:
Principle #21Skipping (Rushing through)

Data Source

PatentEP3335144B1Browser attestation challenge and response system
Publication Date: 2020.12.02 GOOGLE LLC
  • EP3335144B1 patent drawingFigure 1
  • EP3335144B1 patent drawingFigure 2
  • EP3335144B1 patent drawingFigure 3

AI summary

Systems and methods for screening unauthorized devices are provided. More particularly, a challenge that includes a first set of data can be generated. The challenge can require a browser of a requesting device to perform a browser task with respect to the first set of data to generate a second set of data. The challenge can be provided to the requesting device and a response to the challenge can be received. The response can include the second set of data generated by the browser of the requesting device through performance of the browser task. It can be determined whether the browser of the requesting device is an authorized browser based, at least in part, on the second set of data. Whether or not the requesting device is authorized to access a resource can be based, at least in part, on whether the browser is an authorized browser.