Dynamic Turing Test Generation for Access Control

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current computer security systems, including antivirus programs and automated public Turing tests, are ineffective against targeted cyber attacks and can be bypassed by malicious programs, necessitating a more robust solution for authorized access to computer resources based on access rights.

Innovation Solution

A method and system that intercept function calls to determine the threat level of tasks performed on a computing device, generate a test based on this level, and authorize access rights after user verification, ensuring secure execution of critical tasks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If automated public Turing tests are used to determine user actions, then the system can block automated tasks, but the tests can be passed by malicious automation algorithms

Engineering Contradiction:
Improvesecurity protectionVSAvoidresistance to directed attacks
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic test generation where the complexity and type of Turing tests adapt based on the determined threat level of tasks. Different task categories trigger different test complexities, making the security system flexible and responsive to specific threats rather than using a static one-size-fits-approach

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The system changes the parameters of security tests based on the threat level assessment. Low-threat tasks receive simpler tests while high-threat tasks receive more complex tests, optimizing the balance between security and user convenience while preventing automation bypass

Inventive Principle:
Principle #35Parameter changes

2Reliability

If antivirus programs are used to protect against malicious programs, then basic threats are blocked, but targeted cyber attacks and advanced persistent threats bypass the protection

Engineering Contradiction:
Improveprotection against malicious programsVSAvoidvulnerability to targeted attacks
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary threat level determination before allowing task execution. The system assesses the threat level of intended tasks in advance and requires appropriate Turing tests to be passed before execution, preventing malicious programs from performing harmful actions even if they evade traditional antivirus detection

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary security layer between the task request and execution. The Turing test mechanism acts as a mediator that verifies user authenticity and intent, blocking malicious automated tasks while allowing legitimate ones to proceed

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If user expertise is utilized to supplement antivirus work, then security detection improves, but the system requires manual user intervention

Engineering Contradiction:
Improvesecurity detection capabilityVSAvoiduser intervention requirement
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent applies partial user intervention by requiring Turing tests only for tasks with high threat levels. Low-threat tasks execute automatically without user interaction, while only suspicious or high-risk tasks trigger the need for user verification, optimizing the balance between security and ease of operation

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP3716572B1System and method for performing a task on a computing device based on access rights
Publication Date: 2023.07.12 AO KASPERSKY LAB
  • EP3716572B1 patent drawingFigure 1
  • EP3716572B1 patent drawingFigure 2
  • EP3716572B1 patent drawingFigure 3

AI summary

Disclosed herein are systems and methods for performing a task on a computing device based on access rights. An exemplary method comprises, gathering data characterizing a task by intercepting function calls used to perform the task, and sending a request to an operating system of the computing device to temporarily interrupt the called functions until access rights are determined, determining a threat level of the task based on the gathered data and task templates, generating a test based on the threat level and test generating rules and presenting the test to the user, analyzing results of the test and determining access rights of the task based on the results, and performing the task based on the access rights.