Mechanism for Detecting Human Presence Using Authenticated Input Activity Timestamps

When a service request associated with an initiated online service transaction is received, an attestation identifying a human-input activity is requested. Upon receiving a signature attesting the human-input activity, the previously initiated service transaction is authenticated based at least in part on the signature.

DETAILED DESCRIPTION

As provided herein, methods, apparatuses, and systems enable authentication of service transactions based on activity timestamps and/or keystroke comparisons to ensure human presence during a service transaction. Service providers (e.g., Ticketmaster, Google and other advertisers, Craigslist, blogs, email providers, etc.) often desire to detect whether a human is present during an online service transaction. Some service providers (stock brokers, eCommerce, banks, online games, etc.) additionally desire to detect what the human actually typed. Capturing such information would allow service providers to detect click fraud, lessen SPAM email, mitigate pump-and-dump ‘viruses,’ detect cheating, etc.

A manageability engine on a hardware platform can record a timestamp to indicate when a user last pressed a key on the keyboard or clicked a button on the mouse. A timestamp, in this regard, is any monotonically increasing counter. It may correspond to the actual time of day, or it may simply indicate that user activity has occurred. Detecting the presence of a human user based on a hardware-recorded keyboard/mouse timestamp is more tamper-resistant than CAPTCHAs (which are software) and more user friendly than CAPTCHAs (e.g., simply click the mouse).

The manageability engine may also record keystrokes typed by a user to indicate what a user typed. Determining what a user is typing based on a hardware-recorded keystroke log provides additional and/or alternative tamper-resistance compared to hardware-recorded timestamps.

Described herein is a hardware platform with the ability to (1) timestamp or record the last human-input activity (e.g., keyboard click or mouse click) and (2) attest to the validity of these timestamps or keystroke recordings to detect human presence. These two platform capabilities are used to aid in the detection of automated forms of fraud as follows:After a user interacts with an online service provider, embodiments provide the attested activity timestamp and/or keystroke log to the service provider.The service provider determines whether the activity timestamp and/or keystroke log was correlated to the service request.

Active Management Technology (AMT) offered by Intel Corporation of Santa Clara, Calif. is a hardware-based technology that facilitates remote out-of-band (OOB) management of computers by use of a secondary processor located on the motherboard. This secondary processor located on the motherboard is called the Manageability Engine (ME). The AMT firmware, which runs on the ME, is stored in the same Serial Peripheral Interface (SPI) flash memory component used to store the BIOS and is generally updated along with the BIOS. By physically separating the hardware for the ME from the central processing unit, the ME is rendered inaccessible to users. In other words, the ME is secure and cannot be hacked, compromised or tampered with using traditional means.

Some embodiments described herein make use of a Manageability Engine (ME) such as the one described above.FIG. 1illustrates an example solution for authenticating online service transactions, according to various embodiments, using a Managability Engine (ME)124located on input/output (I/O) and/or Platform Controller Hub (ICH/PCH)120. When a user initiates an online service transaction, browser112requests attestation for a human-input activity. In various embodiments, attestation includes a signature from the Manageability Engine124confirming a human-input activity (such as a keystroke or mouse click from keyboard/mouse130). In some embodiments, the attestation includes a timestamp generated by Manageability Engine124. For example, when a user logs a keystroke or mouse click via keyboard/mouse130, the event triggers a signal to USB and/or legacy I/O controller122. Typically, keyboard/mouse events are communicated from I/O controller122to operating system114. However, in various embodiments, a dedicated hardware connection to Manageability Engine124allows Universal Serial Bus (USB) and/or legacy I/O controller122to communicate a notification of the keyboard/mouse event to Manageability Engine124. In some embodiments, ME124records the time at which the event notification was received, creating a timestamp. In other embodiments the ME124records the keystrokes for later comparison. In yet other embodiments, ME124records a combination of the time at which an event notification was received and the keystrokes. Thus, ME124is able to return a timestamp of the last keyboard/mouse activity and/or a log of the keystrokes received in response to receiving a request from browser112.

ME124has credentialing capabilities that can be used with a timestamp and/or keystroke log in response to a request from browser112. For example, various known cryptographic protocols may be used to generate a signature that verifies the authenticity of ME124. More specifically, ME124is capable of generating an anonymous signature using a protocol such as Direct Anonymous Attestation (DAA). An anonymous signature can be verified as originating from an authentic manageability engine without specifically identifying the particular manageability engine (e.g., ME124) that generated the signature. Alternatively, ME124is capable of generating a non-anonymous signature using a protocol such as Transport Layer Security (TLS). One of skill in the art will appreciate that other anonymous and non-anonymous protocols may be used in various embodiments without departing from the scope of the invention described herein.

Upon receiving an anonymously or non-anonymously signed timestamp of the last keyboard/mouse activity and/or keystroke comparison from ME124, browser112supplies the human-input activity indication and credentials (e.g., signature) to the service provider via Media Access Control (MAC)/Network Interface Card (NIC) interface126and network interface140. The service provider then uses the credentials to authenticate the online service transaction.

FIG. 2is a flow-diagram illustrating a process for detecting human presence during an online service transaction. An indication of a newly initiated service transaction is received210(e.g., a page load request, etc.). In response, a request for attestation of a human-input activity is generated and sent to a manageability engine220. In various embodiments, the request could be sent to other secure locations such as, for example, a trusted platform module, a secure partition, a secure container, etc.

In response to the request, an attestation of the last known keyboard/mouse activity is received230. The attestation includes a signed timestamp and/or keystroke comparison in various embodiments. For example, if a service provider simply desires to know if a human user is present during a service transaction, a signed timestamp can verify recent keyboard/mouse activity by a user. In some embodiments, the attestation could be a signature of the actual keyboard or mouse activity. For example, if a service provider desires to know if a particular string of characters was typed by a user, the manageability engine could verify the string was indeed typed by the user (based on a log of keystrokes from a USB and/or legacy I/O controller) and provide a signed, binary “matched or not matched” response to the service provider. If the manageability engine determines that a particular string of characters was not actually typed, the service provider may filter and/or cancel the initiated service transaction.

After receiving attestation, the service provider authenticates the service transaction based at least in part on the attestation240. For example, if a service provider desires to detect presence of an actual human user and receives an anonymously signed timestamp, the timestamp can be compared to a threshold to determine if the timestamp is temporally correlated to the initiation of the service request. If there is a correlation, then presence of a human user is determined to be authentic. Otherwise, the service transaction is determined to be fraudulent. If the service provider desires to know if a particular string of characters was typed by a human user, a received signature from the manageability engine verifies that the string of characters was typed. When the service provider receives a signature in response, then the service provider determines if the signature corresponds to a positive (“matched”) or negative (“not matched”) response and can take appropriate action based on that result.

The exemplary computer system300includes a processor302, a main memory304(e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory306(e.g., flash memory, static random access memory (SRAM), etc.), and a secondary memory318(e.g., a data storage device), which communicate with each other via a bus308.

Processor302represents one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. More particularly, the processor302may be a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, a processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processor302may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. Processor302is configured to execute the processing logic for performing the operations and steps discussed herein.

The computer system300may further include a network interface device316. The computer system300also may include a video display unit310(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device312(e.g., a keyboard), and a cursor control device314(e.g., a mouse).

The secondary memory318may include a machine-readable storage medium (or more specifically a computer-readable storage medium)324on which is stored one or more sets of instructions (e.g., software322) embodying any one or more of the methodologies or functions described herein. The software322may also reside, completely or at least partially, within the main memory304and/or within the processing device302during execution thereof by the computer system300, the main memory304and the processing device302also constituting machine-readable storage media. The software322may further be transmitted or received over a network320via the network interface device316.

Various operations or functions are described herein, which may be implemented or defined as software code or instructions. Such content may be directly executable (“object” or “executable” form), source code, or difference code. Software implementations of the embodiments described herein may be provided via an article of manufacture with the code or instructions stored thereon, or via a method of operating a communication interface to send data via the communication interface. A machine or computer readable storage medium may cause a machine to perform the functions or operations described, and includes any mechanism that stores information in a form accessible by a machine (e.g., computing device, electronic system, etc.), such as recordable/non-recordable media (e.g., read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, etc.). A communication interface includes any mechanism that interfaces to any of a hardwired, wireless, optical, etc., medium to communicate to another device, such as a memory bus interface, a processor bus interface, an Internet connection, a disk controller, etc. The communication interface can be configured by providing configuration parameters and/or sending signals to prepare the communication interface to provide a data signal describing the software content. The communication interface can be accessed via one or more commands or signals sent to the communication interface.

The methods and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct a more specialized system to perform the required operations of the method. Structure for a variety of these systems will appear as set forth in the description below. In addition, the present invention is not described with reference to any particular programming language or operating system. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein, and the teachings may be implemented within a variety of operating systems.

The operations and functions described herein can be implemented as software modules, hardware modules, special-purpose hardware (e.g., application specific hardware, application specific integrated circuits (ASICs), digital signal processors (DSPs), etc.), embedded controllers, hardwired circuitry, etc.