Modified CAPTCHA System for Secure User Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing CAPTCHA systems are ineffective in distinguishing between authorized human users and unauthorized users, as they cannot verify the authenticity of the human user beyond determining if the input is from a human or a computer.
Innovation Solution
A modified CAPTCHA system that generates a password for each user, which is displayed in a distorted form, allowing users to verify its correctness using a token or other medium, ensuring that only authorized users can proceed with authentication by matching the displayed password with their expected password, thereby preventing fraudulent activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional CAPTCHA is used to distinguish humans from computers, then human-computer distinction is achieved, but authorization verification is lost
Solution Approach 1:
The patent merges two separate authentication functions into a single integrated system: (1) human-computer distinction through CAPTCHA, and (2) authorization verification through token-based password generation. The site controller combines both verification mechanisms so that a user must simultaneously prove they are human and that they are an authorized user, resolving the contradiction between maintaining distinguishing capability while adding authorization verification.
Solution Approach 2:
The authentication system is designed to perform multiple functions through a unified process. The same password generation and verification mechanism serves both to confirm human input (by requiring interpretation of distorted text) and to verify user authorization (by checking against token-generated passwords). This multi-functional approach allows the system to maintain human-computer distinction while simultaneously providing authorization verification.
2Ease of operation
If password is displayed clearly for user verification, then user convenience is improved, but security against automated capture is reduced
Solution Approach 1:
The patent applies different quality characteristics to different parts of the password display. The password is distorted in specific ways (rotation, blurring, noise addition) that make it difficult for automated programs to capture and recognize, while still remaining legible to human users. This local differentiation of visual properties allows the system to maintain user convenience while protecting against automated capture attacks.
Solution Approach 2:
The system dynamically changes visual parameters of the displayed password, such as distortion level, rotation angle, and overlay patterns. These parameter changes create a version of the password that is optimized for human perception but resistant to automated image recognition and text extraction algorithms, thereby securing against capture while maintaining usability.
3Reliability
If multiple password verification steps are implemented, then security is improved, but authentication time increases
Solution Approach 1:
The user's token device continuously generates passwords in advance, maintaining a synchronized sequence with the site controller. This preliminary generation of passwords eliminates the need for time-consuming back-and-forth communication during authentication. The user simply needs to verify the displayed password against their token's current display and enter the next predicted password, significantly reducing authentication time while maintaining security through the multi-step verification process.
Data Source
AI summary
A method and system enables a user and/or an on-line site to be authenticated by comparing a received password with an expected password, transmitting a new password if the received and expected passwords match, and authenticating a communication if the new password matches what is expected by the on-line site. The initially received password may be distorted, such as with CAPTCHA.