Download - 3D captcha
-
8/6/2019 3D captcha
1/15
3D CAPTCHACaptcha based on spa t ia l perspec t i ve and human im ag inat ion
Aut hor: Juraj Rolko , i l ina, Slovak ia (rolko@3dc apt c ha.net)
Date : 01/10/2010
ABSTRACT
This document describes a new type of CAPTCHA
technologybasedonspatialperspectiveandhuman
imagination.Thebasicideaisrotationofaspecial3D
model and finding the correct position of rotation.
3Dmodelcanbecreated fromany2D image.First,
the picture is divided into several parts,which are
then randomly projected into 3D space, subject to
certain rules. Parts projected spatially this way
generate together 3D models so that the model
looks like the original 2D image from a single
observation point. The meaning of 3D model
observed from any other observation point is
incomprehensible forhuman.The task forauser is
to rotate the model to find the right observation
point and solve the CAPTCHA successfully. The
technologyisbasedonthefactthatthemeaningof
the model is recognizable from the correct
observation point only by human. Automated
system would not be able to achieve the goal
withoutusingahighdegreeofartificial intelligence.
Thedocumentdescribes in detail the 3D CAPTCHA
technology principle, method of implementation,
examples, comparison of themain advantages and
shortcomingsand,ultimately, theanalysisofsafety
andsecurityrisks.
Generalterms
HumanFactors,Security,Experimentation
Keywords
CAPTCHA,security,3Dmodels,spatialperspective
Fig.01exampleof3Dcaptcha.Theusersgoalistorotate3D
model and find the correct position (position where the
meaningisunderstandableforhuman)
1
-
8/6/2019 3D captcha
2/15
1.INTRODUCTION
CAPTCHA (completelyautomatedpublicTuring test
totellcomputersandhumansapart)isacommonly
usedsecurityfeatureofwebsitesthatpreventsfrom
unwanted access to automated systems (so called
bots) to certain parts and functions of Internet
applications.Nowadaystherearemanyvariationsof
CAPTCHAsystem,suchas:
TextbasedCAPTCHA
TextbasedCAPTCHAwhichusesdynamic
elements
Imagebased CAPTCHA based on rotation
of images (whats up captcha, sketcha
[1],[3])
VideobasedCAPTCHA[4]
Theoneofthemostcommonlyusedvariationsisthe
textbased CAPTCHA, which uses principle of
description of randomly generated alphanumeric
characters. The task of a user, investigator of the
test, istorecognizethesecharactersandtorewrite
themininputboxonwebsite.
Fig.02textbasedCAPTCHAexample1
Fig.03textbasedCAPTCHAexample2
Fig.04textbasedCAPTCHAexample3
Characters tend to be deformed in general. They
also use different contrast backgrounds. The
disadvantage of the method is that the pattern
recognitiontechniquesareconstantlyimprovingand
overcoming such method of computer protection
systems isgettingeasier.Moreandmoredeformed
text strings with more and more complex
background is being used as a prevention from
breaking through, which makes the text to be
unreadable topeople. Inaddition to the textbased
CAPTCHA version, there are other alternative
modifications, such as different alternatives with
dynamic content changes, overlapping letters, and
also CAPTCHA based on rotation of images and
settingtheircorrecthorizontalposition.
The new 3D CAPTCHA system aims to used the
spatial perspective and human imagination and
ability to recognize real objects in the context of
random graphical information. It is based on a
simpleprinciple.First,anyseparatepartsarecreated
fromany2Dpicture.Theseare thenprojected into
3D space. These elements together generate a 3D
model in space. Elements are reflected into the
space randomly,butwith theaim for3Dmodel to
lookasanoriginal2Dpicturefromacertainangleof
visionorobservationpoint.Thetaskofauser,solver
oftheCAPTCHA,istorotatethemodelandfindthe
correct observation point. The right solution is
basicallyonlyguessedby theuser.Yet, theprocess
can easily come true thanks to experience, human
imagination and intelligence. The basic principle of
3Dcaptchasystemcloselyresemblesthetechniques
ofopticalillusions,whereagroupofseveralobjects
scattered in space does not make a meaningful
object as a whole from many observation points
(doesnotresemblearealobject),butitmakessense
from one particular observation and people can
easily tell that the observation point is an
appropriateone.
2
-
8/6/2019 3D captcha
3/15
Fig.05spatialopticalillusionexample1
Fig.06spatialopticalillusionexample2(penrosetriangle)
Identification of a correct object in such case is
extremely difficult for the machine, automated
computer system, as the objects can be virtually
anything.Furthermore,theobjectmayevenlackany
realisticproportions.Itmayevenbejustanabstract
reflection of a real object. Any picture used in
creation of a model be modified before the
transformation to a 3D model additionally, i.e.
changing the shape,applying variousgraphic filters
to change a colour, contrast and so on. Variety of
modifications can be made from one image.
Databaseofusablefilesisbasicallyinfinite.Theonly
waytosolvethe3Dcaptchatestistousethehuman
imagination.Iftherewasacomputersystemcapable
ofsuchadegreeofrecognitionandinterpretationof
graphic information, any other captcha based on
image perception would not have been applicable
anymore.
The main focus in crating the 3D CAPTCHA
technologywasputonaninnovative,brandnewand
different approach to solving task aimed at
distinguishinghuman from computersystem.Akey
task was to incorporate human abilities and
characteristics, which cannot be emulated by
computersystems,intothetechnology.Moreover,it
wasobvioustotake intoaccountassimpleandfast
as possiblemethod of solving the task in terms of
user,userinterfaceandcomfort.
In general, good captcha system must meet three
basicproperties[1]:
1.Easyformostpeopletosolve
2.Difficultforautomatedbotstosolve
3.Easytogenerateandevaluate
3D captcha systemmeets all the three conditions,
which is significant difference compared to other
imagebased captcha systems. They have great
problemsmeeting the third condition above all. In
that case it is verydifficult toensuregoodenough
quality database of source documents, or the
creation
of
the
database
is
very
expensive
and
inefficient.
Theexistingprototype3Dcaptchasystemalongwith
basicdescriptioncanbefoundat:
www.3dcaptcha.net
3
-
8/6/2019 3D captcha
4/15
2.3DCAPTCHA
Ithasbeenmentionedseveraltimesthat3Dcaptcha
is based on the space perspective of objects. The
main objective is to solve the captcha test by
rotationof3Dmodelinuserinterfaceandtofindor
guess the right position of the 3D model (right
rotationangleof3Dmodel).
Fig.07wrongandcorrect3Dcaptchasolution
Thewholeconceptofthetechnologycanbedivided
intotwoparts.Clientsectionandacaptchaprovider
section. The client part includes solution of the
captcha test itself by uses through the interface.
Provider ensures and provides a database of
prearranged source documents, models and
respectiveinterfaceforprogramminginterface.Web
applicationcreatorsmaythenintegratetheinterface
itself, clientpartof the3D captcha system in their
new or existing projects through using of API
interface. Thanks to the provider a database of
quality and proven sourcemodelswill be ensured.
API interface will be used to provide 3D models,
evaluationofthecaptchatestsuccessandtoprovide
anyotherfunctionsfortheproperfunctioningofthe
technology. The very simplified processof creating
3Dcaptchasystem,orakindofprototypesolutions
canbedescribedbythefollowingsixsteps:
STEP1:Selectionofanappropriatesource2D
image
STEP2:Applicationofadditionalfiltersto2D
image
STEP3:Divisionoftheimageintobasic
elements
STEP4:Projectionofallbasicelementsinthe
space
STEP5:Creationof3Dmodeloutofthe
projectedelements
STEP6:Integrationofthemodelinto3D
CAPTCHAclientapplication
4
-
8/6/2019 3D captcha
5/15
2.1Projectdesign(provider,website,clientpart)
IMAGES SOURCE
5CLIENT
WEBSITE
Page
request
CAPTCHArequired
CAPTCHAsolving
answervalidation
CAPTCHA
request
CAPTCHA
answer
Page
response
3DCAPTCHAPROVIDER
3DCAPTCHAAPI
Imagesand3D
modelsprocessingPreprepared
models
-
8/6/2019 3D captcha
6/15
2.23Dcaptchaprototypecreations
6
IMAGES SOURCE
Select2Dpicture
Applyadditional
graphicfilters
Splitimageinto
basicelements
Projectbasic
elementsinto3D
space
Create3Dmodel
sourceandstorein
database
Incorporate3D
modelintoclient
application
(usingAPI)
-
8/6/2019 3D captcha
7/15
2.3Interface
Theaiminsolving3Dcaptchasystemistorotate3D
model and to find the point where the model is
comprehensiblefortheuser,investigatorofthetest.
Itmeans thepointatwhich theuser recognizesan
object and evaluates this object as the correct
solution. The principle is implemented in the
prototype3D captcha systemasa flashapplication
thatusesPapervision3D technology [6].External file
with 3D model definition is loaded in the flash
application.Thismodelisthendisplayedintheflash
animation.Theusercanthenrotatethemodelusing
the slider. Through his imagination the user
evaluatesthemostappropriatesolutionthatactually
corresponds to a certain degree of rotation of the
model.Theestimatedsolutioniscomparedwiththe
correct solution, which is provided for the given
model by the 3D captcha system provider. In the
case of match the captcha test is evaluated as
successful,otherwiseitisevaluatedasunsuccessful.
Theprincipleofoperationisbasicallyidenticaltothe
principle onwhich text captcha systemswork. The
onlydifference isthat inthetextcaptchasystemsa
text string is sent to the provider for verification,
whilein3Dcaptchasystemanumericvalue/values,
whichrepresenttheangleofrotationofthemodel,
issent.Intheactualimplementationanynumberof
models can naturally be used.As a rule, themore
models are used, the less likely possibility of
breakingthetestcomputersystemexists.However,
the user demands for test increase and user
tolerancetotestdecreaseatthesametime.
Fig.083Dcaptchaclientinterfaceprinciple
2.4STEP1 selectionofsource2Dimage
Thefirststepintheprocessofcreating3DCAPTCHA
technology is the selection of a suitable graphic
materialforfurtherprocessing.Thebigadvantageis
that it ispossibletouseanycommon image,which
hassomeinformationrelevanttopeople.Ofcourse,
thatnot all types of images canbe used for these
purposes.
Fig.09unsuitablesourcepictureexample
Theaboveimageisimproperlychosen,sinceitisthe
graphic information with very low semantic value.
Fortunately, the percentage of these types is very
low.
7
-
8/6/2019 3D captcha
8/15
Fig.10suitablesourcepictureexample
Unlikepreviouspicturethefig.10issuitablychosen
type,asitsmeaningisclearforpeopleimmediately.
It is picture of a fourleaf clover. People can
recognizearealobjectdespitethefactthatitisonly
asimplified,abstractformofarealisticdisplayofan
existing object. By the selection of these types of
imagesadatabasewithplentyofsourcedatafor3D
CAPTCHAsystemiscreated.Animportantdifference
compared tootherCAPTCHA systemsbasedon the
useof imagesor3Dmodels is that in this case the
source images do not have to undergo such a in
depthscrutinyofthe fitnessforuse.Therefore,the
initial creation of the database, filling of the
databasewithappropriatepictures is incomparably
faster and more efficient. There is no need for
sophisticated image analysers of suitability for use
and the amount of manual human intervention in
selectionisminimised.
2.5STEP2 Additionalmodificationstothesource
image
Applicationofvariousgraphicfilterscanmodifythe
original imageandmanyotherusablecombinations
can be gained. The change of shape, colour,
contrast, resolution and so on can be applied. In
general, the smaller resolution of a picture or the
bigger simplification of a picture, the more
demandingrecognitionbysomeautomatedsystems
is.
2.6STEP3 Creationofbasicelements
A good graphical method creates from the source
image a set of basic elements. The image is "cut"
intosmallerpieces.Thesearethesmallestelements
tobeprojectedintospace.Thebasicelementsform
ashapeof triangle.Each triangle is thusdefinedby
itscoordinates(x,y)anditscolour.
Fig.11basicelement
Whenatriangleisprojected inthespacerandomly,
the size and shape of the original basic element
cannot be defined. Should rectangles are used
instead of triangles the attributes, such are shape
andsize,oforiginal2Delementscouldbeestimated
outofthegroupofseveralprojectedrectangularsby
application of appropriate mathematical methods.
Another important condition is to have the basic
elements of different shape and size. If all the
triangles had the same shape and size, again, an
appropriate mathematical method could be used
and attributes could be calculated precisely, or
estimated precisely enough, out of the original
elements.
8
-
8/6/2019 3D captcha
9/15
Fig.12decomposed2Dpicture(setofbasicelements)
Inthefigureaboveshowsthedecompositionofthe
image into the basic elements. After dividing the
originalimageintobasicelementsweobtainasetof
elements with known coordinates and colours.
Theseelementsarethenstoredintothedatabasein
anappropriate form. Informationwill thenserveus
fortheconstructionofthe3Dmodel.
2.7STEP4 Projectionofallthebasicelementsinto
thespace
Now that we have created respective basic
elements,wecanproceedtoconstructionofthe3D
modelitself.Fromthatmomentonwearebeginning
to work in 3D space. The first step is the
determination of so called original observation
point.Itisaplacefromwhichthe3Dmodelwillhave
thecorrectshape.Itisapoint,theinitiallocationof
an observer from which the calculations for 3D
model constructionarederived. It isalso thepoint
which has to be found in solving 3D captcha test.
Chooseoftheoriginalobservationpointisoptional.
But as it was alreadymentioned, the resulting 3D
model
shape
depends
on
its
position.
Fig.13originalobservationpoint,2Dpicture,projection
sphere
When we have the original location of the
observation point chosen, we shall determine the
positionandsizeofsocalledprojectionsphere.This
is a projection space towhich the particular basic
elements will be projected on the basis of the
coordinatesoftheoriginalobservationpoint,itsown
coordinates, the coordinates of the projection
sphereanditssize.
Fig.14exampleoftheprojectionofatriangleside
Each projected element will have to be inside the
projection sphere. Exact projected coordinate is
chosenrandomly.Randomprojectionoftriangles in
thespacebasicallyensuresthatthemeaningofthe
9
-
8/6/2019 3D captcha
10/15
model from other than the original observation
pointwill not be comprehensible for humans. The
projectedcoordinatesmustfallwithintheprojection
sphere. In case where at least one point of the
triangle,thebasicelement,cannotbeprojectedinto
theprojectionsphere,thegivenelementisexcluded
(willnotbeprojected).Thesphereischosenbecause
its shape from anyobservation point is always the
same and the shape of the projection area is not
important for observer in respect of information.
Sincetheoriginalsource image isarectangularand
theprojection ismade intothesphere,it isobvious
that some part of graphic information can be lost.
Giventhepreviousfacts,itisadvisabletochoosethe
characteristicsof theoriginalobservationpointand
the projection sphere, so that key graphic
informationfromtheoriginal2Dimageispreserved.
Fig.15possiblelossofgraphicinformation
When converting from 2D to 3D space the basic
trigonometricfunctionsareused.Anysuitablebasic
element with coordinates x1, y1 will be projected
accordingtothesetrulesinthespaceandtherewill
besomeresultingcoordinatesx1',y1',z1'.
Fig.16elementprojection
Fig.17elementprojection differentview
As can be seen from the previous two images 3D
perspectivehasamajorrole inthecaptchasystem.
Theprojectedelement is completelydifferent from
different angle of vision then from the original
observationpoint.Andasthelinktoabasicelement
is lost after the projection, it is impossible to
determine its original shape from the projected
elementitself.
10
-
8/6/2019 3D captcha
11/15
Figure18allelementsprojection
The above procedure provides calculation of
coordinatesforall thebasicelements.Thatwaywe
willgetasetofdata,whicharesubsequentlyusedto
generate a set of 3D models (eg DAE, KMZ, and
others).
2.8STEP5 Creationof3Dmodeloutofthe
projectedelements
Wenowhaveall thebasicelementsprojected into
thespace.Eachelementhasthusitscoordinatesx,y,
z defined. At the same time, each element is
assigned a corresponding colour. This colour
matches the colour of the corresponding basic
element.Thesedataarefullysatisfactoryandbased
on theelementsdefined thisway,we can createa
particularset(egCOLLADADAEformate,KMZ,etc.).
Fig.15DAEfileexample
Thisfileisthenuseddirectlyintheclientapplication
to display the CAPTCHA. These formats are
supported for example by Papervision3D, and
others. Hence, the choosing a file format for 3D
model is optional. It depends on what technology
willbeused for creationof interface, clientpartof
3D captcha system. The said Papervision3D
technologysupportsmany filetypes for3Dmodels,
suchasDAEorKMZformat.
2.9STEP6 Inclusionofmodelintotheclient
applicationtosolveCAPTCHAtest
Afterallthepreviousstepsisnowpossibletocreate
very functional3DCAPTCHA.Clientapplication can
becreatedbyvarioustechnologies.Inourprototype
solution flash in combination with Papervision3D
were used. However, with the launch of HTML5
technology, itwillbeeasytoimplementthissystem
using other tools too. The whole operation of 3D
CAPTCHA system presupposes the existence of
providerwhowouldprovideadatabaseofprepared
3D models and also presence API interface for
communication PROVIDER WEB APPLICATION.
Owner, creator of the web application would use
simpleflashapplicationonyourwebsiteandwould
communicate with captcha providers through
API.Verificationof the correct solutionwouldagain
tookplaceincooperationwith3Dcaptchaproviders
incooperationwithwebapplication.
11
-
8/6/2019 3D captcha
12/15
Fig.16webpageintegrationexample
3.SECURITYANALYSIS
Security and resistance to unwanted attacks are
essentialrequirementstobemetbyqualitycaptcha
systems. 3D captcha is a system that uses human
imagination and ability to distinguish between
different types of objects. In the process of
constructing 3D captcha interruption in the
connection between the original source 2D image
and3Dmodeloccurs,whichcanbeseenbytheuser
in solving the captcha test. The right solution is
therefore impossible to obtain by any calculation
methods. The right solution is basically just
estimated solution. Correct estimate, with high
accuracy level, canonlybemadebyhuman thanks
to itsadvanced intelligencecompared tonowadays
computer systems. It is likely that if there were
computersystemwiththeartificialintelligencewith
acomparativelyhighlevel,soanycaptchabasedon
recognition of graphic information would not be
applicableanymore.
Accordingtostandardofcaptchasystems,incaseof
possiblerandomestimationofat least1:10000,the
captcha system is considered acceptable. For 3D
captcha themodel can rotate in the rangeof360
andthereforeinthecaseofusingonemodelthereis
a probability of1/360 that automated system that
can determine the correct solution by random
estimate.Inpracticaldeploymentoftechnology it is
therefore necessary to use several models
simultaneouslywithinasinglecaptcha test. Inview
of the user's comfort, it is also necessary to set
certain tolerance level applicable to the solution.
Whenusing3models,eachonewith the tolerance
level of 5 , there is a likelihood of accidental
guessing the correct solution (5/360)3, which is
approximately1:373248.Whenusing2modelswith
a tolerance level of 3 , there is a likelihood of
accidental guessing the correct solution (3/360)2,
which is approximately 1:14400. Both these
probabilitiesaresufficientforsuchacaptchatestto
be acceptable. The 3D technology captcha concept
naturally allows using horizontal and vertical
rotationofthemodelsimultaneously inonemodel.
Thismethodof implementation ishoweverdifficult
tosolveevenforhumans.
Giventhatwithinthe3Dcaptchasystemalmostany
image as a source can be used and any additional
graphic filters can be applied to these images, the
database of sourcematerials is virtually unlimited.
Any possible unauthorized attack based on
technique of estimation on the basis of samples
from the database of source materials is virtually
useless.
3D captcha system displays graphic information
dynamically. Consequently, the attacker must
analyseevery single image fragment corresponding
torespectivepositionofamodelseparately incase
oftheattackusingtechniqueofimageanalysis.This
isasignificantincreaseintimeandenergydemands
in respect of the sources of attacker compared to
other captcha system based on the use of graphic
12
-
8/6/2019 3D captcha
13/15
13
information. In such cases, the attacker only
analyzesoneorfewimages.
To increasetheefficiencyof3Dcaptchasystemthe
source 2D images can be simplified as much
aspossible. The larger abstraction rate of images
limitsoptionstobeanalysedbyautomatedsystems
but, in appropriate use, it can also make the
procedureofsolvingmoresimplefortheuser.
4.ADVANTAGESANDDISADVANTAGES
Like themost technologies, the 3D captcha has its
advantagesanditsshortcomings.
4.1Advantages
The principle is based on the human imagination.This isthebiggestadvantageof3Dcaptchasystem.
Successful solution requires understanding of the
meaningofdisplayedgraphic information.Whileno
computer system can cope with the type of task
requiredby3Dcaptcha.
Fullautomationofthesystem.Itisveryeasytofullyautomate thewhole process of creating and using
3D captcha system. This greatly reduces the
resources that provider needs to spend on system
maintenance. Unlike other captcha systems using
images or 3D models, it is not necessary that the
sourcematerials are strenuouslymanually checked
oradditionallymodified (differentassigningof tags,
labels,descriptions,etc.)
Virtually unlimited database of source images. Thistechnologypracticallyenablesusingofanyimageas
thesource image.Thisgreatlyeliminatespossibility
of attack using method of comparison of samples
fromthedatabaseofusedimages.
Modifications to the advertising system. With theoption to use any graphic materials as the source
images, the support for advertising can be
implemented in the system. Advertiser delivers
graphic materials (e.g. logo), provider shall
incorporate them in3D captcha systemandowner
ofthewebsiteshall integrate it intohisapplication.
Web application can therefore receive additional
incomeinformofshareinadvertising.Thisprinciple
iswidelyusedbymanywebsitesincaseofdisplaying
simpletextads.Anotherimportantadvantageisthat
any possible modification of ads is more user
orientedthanatraditionaltextadvertisements.The
user is "forced" to cautiousness when solving the
captcha test.Typeofdisplayedgraphic information
in 3D captcha system can also be customized
accordingtocontentofwebsiteinwhichitisused.
Userfriendlinessofthesystem.The technologywascreatedtobeasfriendlytotheuseraspossible.User
just needs to usejust mouse or other positioning
device.Theuserdoesnotneedtousethekeyboard
to enter text inputs as in textbased captcha
systems. Moreover, with increasing experience in
using 3D captcha system the time necessary for
solutionoftestreduces.Significantadvantageisthe
independence of the technology in respect of
language and suitability for users who encounter
issuesinsolvingclassictextbasedcaptchasystems.
4.2Disadvantages
The prototype technology uses flash. To create aprototype 3D captcha system Flash runtime
environment has been used. However, this is not
supported on all devices. Fortunately, with the
progressandmassexpansionofHTML5 technology
it will be possible to modify the system to be
availableformoreusers.
-
8/6/2019 3D captcha
14/15
-
8/6/2019 3D captcha
15/15
15
6.REFERENCES
1) Rich Gossweiler, Maryam Kamvar, Shumeet
Baluja,WhatsUpCAPTCHA?
ACAPTCHABasedOnImageOrientation
http://static.googleusercontent.com/external_conte
nt/untrusted_dlcp/research.google.com/sk//pubs/ar
chive/35157.pdf
2)TaylorHayward,3DimagesasaCAPTCHA
http://taylorhayward.posterous.com/3dimagesas
acaptcha
3) Steven A. Ross, J. Alex Halderman, Adam
Finkelstein, Sketcha: A Captcha Based on Line
Drawingsof3DModels
http://www.cs.princeton.edu/gfx/pubs/Ross_2010_
SAC/index.php
4) Kurt Alfred Kluever, Dr. Richard Zanibbi, Video
CAPTCHAs
http://sudbury.cs.rit.edu/about
5)MichaelG.Kaplan,The3DCAPTCHA
http://spamfizzle.com/CAPTCHA.aspx
6)Papervision3D
http://www.papervision3d.org