8/6/2019 3D captcha

1/15

3D CAPTCHACaptcha based on spa t ia l perspec t i ve and human im ag inat ion

Aut hor: Juraj Rolko , i l ina, Slovak ia (rolko@3dc apt c ha.net)

Date : 01/10/2010

ABSTRACT

This document describes a new type of CAPTCHA

technologybasedonspatialperspectiveandhuman

imagination.Thebasicideaisrotationofaspecial3D

model and finding the correct position of rotation.

3Dmodelcanbecreated fromany2D image.First,

the picture is divided into several parts,which are

then randomly projected into 3D space, subject to

certain rules. Parts projected spatially this way

generate together 3D models so that the model

looks like the original 2D image from a single

observation point. The meaning of 3D model

observed from any other observation point is

incomprehensible forhuman.The task forauser is

to rotate the model to find the right observation

point and solve the CAPTCHA successfully. The

technologyisbasedonthefactthatthemeaningof

the model is recognizable from the correct

observation point only by human. Automated

system would not be able to achieve the goal

withoutusingahighdegreeofartificial intelligence.

Thedocumentdescribes in detail the 3D CAPTCHA

technology principle, method of implementation,

examples, comparison of themain advantages and

shortcomingsand,ultimately, theanalysisofsafety

andsecurityrisks.

Generalterms

HumanFactors,Security,Experimentation

Keywords

CAPTCHA,security,3Dmodels,spatialperspective

Fig.01exampleof3Dcaptcha.Theusersgoalistorotate3D

model and find the correct position (position where the

meaningisunderstandableforhuman)

1

8/6/2019 3D captcha

2/15

1.INTRODUCTION

CAPTCHA (completelyautomatedpublicTuring test

totellcomputersandhumansapart)isacommonly

usedsecurityfeatureofwebsitesthatpreventsfrom

unwanted access to automated systems (so called

bots) to certain parts and functions of Internet

applications.Nowadaystherearemanyvariationsof

CAPTCHAsystem,suchas:

TextbasedCAPTCHA

TextbasedCAPTCHAwhichusesdynamic

elements

Imagebased CAPTCHA based on rotation

of images (whats up captcha, sketcha

[1],[3])

VideobasedCAPTCHA[4]

Theoneofthemostcommonlyusedvariationsisthe

textbased CAPTCHA, which uses principle of

description of randomly generated alphanumeric

characters. The task of a user, investigator of the

test, istorecognizethesecharactersandtorewrite

themininputboxonwebsite.

Fig.02textbasedCAPTCHAexample1

Fig.03textbasedCAPTCHAexample2

Fig.04textbasedCAPTCHAexample3

Characters tend to be deformed in general. They

also use different contrast backgrounds. The

disadvantage of the method is that the pattern

recognitiontechniquesareconstantlyimprovingand

overcoming such method of computer protection

systems isgettingeasier.Moreandmoredeformed

text strings with more and more complex

background is being used as a prevention from

breaking through, which makes the text to be

unreadable topeople. Inaddition to the textbased

CAPTCHA version, there are other alternative

modifications, such as different alternatives with

dynamic content changes, overlapping letters, and

also CAPTCHA based on rotation of images and

settingtheircorrecthorizontalposition.

The new 3D CAPTCHA system aims to used the

spatial perspective and human imagination and

ability to recognize real objects in the context of

random graphical information. It is based on a

simpleprinciple.First,anyseparatepartsarecreated

fromany2Dpicture.Theseare thenprojected into

3D space. These elements together generate a 3D

model in space. Elements are reflected into the

space randomly,butwith theaim for3Dmodel to

lookasanoriginal2Dpicturefromacertainangleof

visionorobservationpoint.Thetaskofauser,solver

oftheCAPTCHA,istorotatethemodelandfindthe

correct observation point. The right solution is

basicallyonlyguessedby theuser.Yet, theprocess

can easily come true thanks to experience, human

imagination and intelligence. The basic principle of

3Dcaptchasystemcloselyresemblesthetechniques

ofopticalillusions,whereagroupofseveralobjects

scattered in space does not make a meaningful

object as a whole from many observation points

(doesnotresemblearealobject),butitmakessense

from one particular observation and people can

easily tell that the observation point is an

appropriateone.

2

8/6/2019 3D captcha

3/15

Fig.05spatialopticalillusionexample1

Fig.06spatialopticalillusionexample2(penrosetriangle)

Identification of a correct object in such case is

extremely difficult for the machine, automated

computer system, as the objects can be virtually

anything.Furthermore,theobjectmayevenlackany

realisticproportions.Itmayevenbejustanabstract

reflection of a real object. Any picture used in

creation of a model be modified before the

transformation to a 3D model additionally, i.e.

changing the shape,applying variousgraphic filters

to change a colour, contrast and so on. Variety of

modifications can be made from one image.

Databaseofusablefilesisbasicallyinfinite.Theonly

waytosolvethe3Dcaptchatestistousethehuman

imagination.Iftherewasacomputersystemcapable

ofsuchadegreeofrecognitionandinterpretationof

graphic information, any other captcha based on

image perception would not have been applicable

anymore.

The main focus in crating the 3D CAPTCHA

technologywasputonaninnovative,brandnewand

different approach to solving task aimed at

distinguishinghuman from computersystem.Akey

task was to incorporate human abilities and

characteristics, which cannot be emulated by

computersystems,intothetechnology.Moreover,it

wasobvioustotake intoaccountassimpleandfast

as possiblemethod of solving the task in terms of

user,userinterfaceandcomfort.

In general, good captcha system must meet three

basicproperties[1]:

1.Easyformostpeopletosolve

2.Difficultforautomatedbotstosolve

3.Easytogenerateandevaluate

3D captcha systemmeets all the three conditions,

which is significant difference compared to other

imagebased captcha systems. They have great

problemsmeeting the third condition above all. In

that case it is verydifficult toensuregoodenough

quality database of source documents, or the

creation

of

the

database

is

very

expensive

and

inefficient.

Theexistingprototype3Dcaptchasystemalongwith

basicdescriptioncanbefoundat:

www.3dcaptcha.net

3

8/6/2019 3D captcha

4/15

2.3DCAPTCHA

Ithasbeenmentionedseveraltimesthat3Dcaptcha

is based on the space perspective of objects. The

main objective is to solve the captcha test by

rotationof3Dmodelinuserinterfaceandtofindor

guess the right position of the 3D model (right

rotationangleof3Dmodel).

Fig.07wrongandcorrect3Dcaptchasolution

Thewholeconceptofthetechnologycanbedivided

intotwoparts.Clientsectionandacaptchaprovider

section. The client part includes solution of the

captcha test itself by uses through the interface.

Provider ensures and provides a database of

prearranged source documents, models and

respectiveinterfaceforprogramminginterface.Web

applicationcreatorsmaythenintegratetheinterface

itself, clientpartof the3D captcha system in their

new or existing projects through using of API

interface. Thanks to the provider a database of

quality and proven sourcemodelswill be ensured.

API interface will be used to provide 3D models,

evaluationofthecaptchatestsuccessandtoprovide

anyotherfunctionsfortheproperfunctioningofthe

technology. The very simplified processof creating

3Dcaptchasystem,orakindofprototypesolutions

canbedescribedbythefollowingsixsteps:

STEP1:Selectionofanappropriatesource2D

image

STEP2:Applicationofadditionalfiltersto2D

image

STEP3:Divisionoftheimageintobasic

elements

STEP4:Projectionofallbasicelementsinthe

space

STEP5:Creationof3Dmodeloutofthe

projectedelements

STEP6:Integrationofthemodelinto3D

CAPTCHAclientapplication

4

8/6/2019 3D captcha

5/15

2.1Projectdesign(provider,website,clientpart)

IMAGES SOURCE

5CLIENT

WEBSITE

Page

request

CAPTCHArequired

CAPTCHAsolving

answervalidation

CAPTCHA

request

CAPTCHA

answer

Page

response

3DCAPTCHAPROVIDER

3DCAPTCHAAPI

Imagesand3D

modelsprocessingPreprepared

models

8/6/2019 3D captcha

6/15

2.23Dcaptchaprototypecreations

6

IMAGES SOURCE

Select2Dpicture

Applyadditional

graphicfilters

Splitimageinto

basicelements

Projectbasic

elementsinto3D

space

Create3Dmodel

sourceandstorein

database

Incorporate3D

modelintoclient

application

(usingAPI)

8/6/2019 3D captcha

7/15

2.3Interface

Theaiminsolving3Dcaptchasystemistorotate3D

model and to find the point where the model is

comprehensiblefortheuser,investigatorofthetest.

Itmeans thepointatwhich theuser recognizesan

object and evaluates this object as the correct

solution. The principle is implemented in the

prototype3D captcha systemasa flashapplication

thatusesPapervision3D technology [6].External file

with 3D model definition is loaded in the flash

application.Thismodelisthendisplayedintheflash

animation.Theusercanthenrotatethemodelusing

the slider. Through his imagination the user

evaluatesthemostappropriatesolutionthatactually

corresponds to a certain degree of rotation of the

model.Theestimatedsolutioniscomparedwiththe

correct solution, which is provided for the given

model by the 3D captcha system provider. In the

case of match the captcha test is evaluated as

successful,otherwiseitisevaluatedasunsuccessful.

Theprincipleofoperationisbasicallyidenticaltothe

principle onwhich text captcha systemswork. The

onlydifference isthat inthetextcaptchasystemsa

text string is sent to the provider for verification,

whilein3Dcaptchasystemanumericvalue/values,

whichrepresenttheangleofrotationofthemodel,

issent.Intheactualimplementationanynumberof

models can naturally be used.As a rule, themore

models are used, the less likely possibility of

breakingthetestcomputersystemexists.However,

the user demands for test increase and user

tolerancetotestdecreaseatthesametime.

Fig.083Dcaptchaclientinterfaceprinciple

2.4STEP1 selectionofsource2Dimage

Thefirststepintheprocessofcreating3DCAPTCHA

technology is the selection of a suitable graphic

materialforfurtherprocessing.Thebigadvantageis

that it ispossibletouseanycommon image,which

hassomeinformationrelevanttopeople.Ofcourse,

thatnot all types of images canbe used for these

purposes.

Fig.09unsuitablesourcepictureexample

Theaboveimageisimproperlychosen,sinceitisthe

graphic information with very low semantic value.

Fortunately, the percentage of these types is very

low.

7

8/6/2019 3D captcha

8/15

Fig.10suitablesourcepictureexample

Unlikepreviouspicturethefig.10issuitablychosen

type,asitsmeaningisclearforpeopleimmediately.

It is picture of a fourleaf clover. People can

recognizearealobjectdespitethefactthatitisonly

asimplified,abstractformofarealisticdisplayofan

existing object. By the selection of these types of

imagesadatabasewithplentyofsourcedatafor3D

CAPTCHAsystemiscreated.Animportantdifference

compared tootherCAPTCHA systemsbasedon the

useof imagesor3Dmodels is that in this case the

source images do not have to undergo such a in

depthscrutinyofthe fitnessforuse.Therefore,the

initial creation of the database, filling of the

databasewithappropriatepictures is incomparably

faster and more efficient. There is no need for

sophisticated image analysers of suitability for use

and the amount of manual human intervention in

selectionisminimised.

2.5STEP2 Additionalmodificationstothesource

image

Applicationofvariousgraphicfilterscanmodifythe

original imageandmanyotherusablecombinations

can be gained. The change of shape, colour,

contrast, resolution and so on can be applied. In

general, the smaller resolution of a picture or the

bigger simplification of a picture, the more

demandingrecognitionbysomeautomatedsystems

is.

2.6STEP3 Creationofbasicelements

A good graphical method creates from the source

image a set of basic elements. The image is "cut"

intosmallerpieces.Thesearethesmallestelements

tobeprojectedintospace.Thebasicelementsform

ashapeof triangle.Each triangle is thusdefinedby

itscoordinates(x,y)anditscolour.

Fig.11basicelement

Whenatriangleisprojected inthespacerandomly,

the size and shape of the original basic element

cannot be defined. Should rectangles are used

instead of triangles the attributes, such are shape

andsize,oforiginal2Delementscouldbeestimated

outofthegroupofseveralprojectedrectangularsby

application of appropriate mathematical methods.

Another important condition is to have the basic

elements of different shape and size. If all the

triangles had the same shape and size, again, an

appropriate mathematical method could be used

and attributes could be calculated precisely, or

estimated precisely enough, out of the original

elements.

8

8/6/2019 3D captcha

9/15

Fig.12decomposed2Dpicture(setofbasicelements)

Inthefigureaboveshowsthedecompositionofthe

image into the basic elements. After dividing the

originalimageintobasicelementsweobtainasetof

elements with known coordinates and colours.

Theseelementsarethenstoredintothedatabasein

anappropriate form. Informationwill thenserveus

fortheconstructionofthe3Dmodel.

2.7STEP4 Projectionofallthebasicelementsinto

thespace

Now that we have created respective basic

elements,wecanproceedtoconstructionofthe3D

modelitself.Fromthatmomentonwearebeginning

to work in 3D space. The first step is the

determination of so called original observation

point.Itisaplacefromwhichthe3Dmodelwillhave

thecorrectshape.Itisapoint,theinitiallocationof

an observer from which the calculations for 3D

model constructionarederived. It isalso thepoint

which has to be found in solving 3D captcha test.

Chooseoftheoriginalobservationpointisoptional.

But as it was alreadymentioned, the resulting 3D

model

shape

depends

on

its

position.

Fig.13originalobservationpoint,2Dpicture,projection

sphere

When we have the original location of the

observation point chosen, we shall determine the

positionandsizeofsocalledprojectionsphere.This

is a projection space towhich the particular basic

elements will be projected on the basis of the

coordinatesoftheoriginalobservationpoint,itsown

coordinates, the coordinates of the projection

sphereanditssize.

Fig.14exampleoftheprojectionofatriangleside

Each projected element will have to be inside the

projection sphere. Exact projected coordinate is

chosenrandomly.Randomprojectionoftriangles in

thespacebasicallyensuresthatthemeaningofthe

9

8/6/2019 3D captcha

10/15

model from other than the original observation

pointwill not be comprehensible for humans. The

projectedcoordinatesmustfallwithintheprojection

sphere. In case where at least one point of the

triangle,thebasicelement,cannotbeprojectedinto

theprojectionsphere,thegivenelementisexcluded

(willnotbeprojected).Thesphereischosenbecause

its shape from anyobservation point is always the

same and the shape of the projection area is not

important for observer in respect of information.

Sincetheoriginalsource image isarectangularand

theprojection ismade intothesphere,it isobvious

that some part of graphic information can be lost.

Giventhepreviousfacts,itisadvisabletochoosethe

characteristicsof theoriginalobservationpointand

the projection sphere, so that key graphic

informationfromtheoriginal2Dimageispreserved.

Fig.15possiblelossofgraphicinformation

When converting from 2D to 3D space the basic

trigonometricfunctionsareused.Anysuitablebasic

element with coordinates x1, y1 will be projected

accordingtothesetrulesinthespaceandtherewill

besomeresultingcoordinatesx1',y1',z1'.

Fig.16elementprojection

Fig.17elementprojection differentview

As can be seen from the previous two images 3D

perspectivehasamajorrole inthecaptchasystem.

Theprojectedelement is completelydifferent from

different angle of vision then from the original

observationpoint.Andasthelinktoabasicelement

is lost after the projection, it is impossible to

determine its original shape from the projected

elementitself.

10

8/6/2019 3D captcha

11/15

Figure18allelementsprojection

The above procedure provides calculation of

coordinatesforall thebasicelements.Thatwaywe

willgetasetofdata,whicharesubsequentlyusedto

generate a set of 3D models (eg DAE, KMZ, and

others).

2.8STEP5 Creationof3Dmodeloutofthe

projectedelements

Wenowhaveall thebasicelementsprojected into

thespace.Eachelementhasthusitscoordinatesx,y,

z defined. At the same time, each element is

assigned a corresponding colour. This colour

matches the colour of the corresponding basic

element.Thesedataarefullysatisfactoryandbased

on theelementsdefined thisway,we can createa

particularset(egCOLLADADAEformate,KMZ,etc.).

Fig.15DAEfileexample

Thisfileisthenuseddirectlyintheclientapplication

to display the CAPTCHA. These formats are

supported for example by Papervision3D, and

others. Hence, the choosing a file format for 3D

model is optional. It depends on what technology

willbeused for creationof interface, clientpartof

3D captcha system. The said Papervision3D

technologysupportsmany filetypes for3Dmodels,

suchasDAEorKMZformat.

2.9STEP6 Inclusionofmodelintotheclient

applicationtosolveCAPTCHAtest

Afterallthepreviousstepsisnowpossibletocreate

very functional3DCAPTCHA.Clientapplication can

becreatedbyvarioustechnologies.Inourprototype

solution flash in combination with Papervision3D

were used. However, with the launch of HTML5

technology, itwillbeeasytoimplementthissystem

using other tools too. The whole operation of 3D

CAPTCHA system presupposes the existence of

providerwhowouldprovideadatabaseofprepared

3D models and also presence API interface for

communication PROVIDER WEB APPLICATION.

Owner, creator of the web application would use

simpleflashapplicationonyourwebsiteandwould

communicate with captcha providers through

API.Verificationof the correct solutionwouldagain

tookplaceincooperationwith3Dcaptchaproviders

incooperationwithwebapplication.

11

8/6/2019 3D captcha

12/15

Fig.16webpageintegrationexample

3.SECURITYANALYSIS

Security and resistance to unwanted attacks are

essentialrequirementstobemetbyqualitycaptcha

systems. 3D captcha is a system that uses human

imagination and ability to distinguish between

different types of objects. In the process of

constructing 3D captcha interruption in the

connection between the original source 2D image

and3Dmodeloccurs,whichcanbeseenbytheuser

in solving the captcha test. The right solution is

therefore impossible to obtain by any calculation

methods. The right solution is basically just

estimated solution. Correct estimate, with high

accuracy level, canonlybemadebyhuman thanks

to itsadvanced intelligencecompared tonowadays

computer systems. It is likely that if there were

computersystemwiththeartificialintelligencewith

acomparativelyhighlevel,soanycaptchabasedon

recognition of graphic information would not be

applicableanymore.

Accordingtostandardofcaptchasystems,incaseof

possiblerandomestimationofat least1:10000,the

captcha system is considered acceptable. For 3D

captcha themodel can rotate in the rangeof360

andthereforeinthecaseofusingonemodelthereis

a probability of1/360 that automated system that

can determine the correct solution by random

estimate.Inpracticaldeploymentoftechnology it is

therefore necessary to use several models

simultaneouslywithinasinglecaptcha test. Inview

of the user's comfort, it is also necessary to set

certain tolerance level applicable to the solution.

Whenusing3models,eachonewith the tolerance

level of 5 , there is a likelihood of accidental

guessing the correct solution (5/360)3, which is

approximately1:373248.Whenusing2modelswith

a tolerance level of 3 , there is a likelihood of

accidental guessing the correct solution (3/360)2,

which is approximately 1:14400. Both these

probabilitiesaresufficientforsuchacaptchatestto

be acceptable. The 3D technology captcha concept

naturally allows using horizontal and vertical

rotationofthemodelsimultaneously inonemodel.

Thismethodof implementation ishoweverdifficult

tosolveevenforhumans.

Giventhatwithinthe3Dcaptchasystemalmostany

image as a source can be used and any additional

graphic filters can be applied to these images, the

database of sourcematerials is virtually unlimited.

Any possible unauthorized attack based on

technique of estimation on the basis of samples

from the database of source materials is virtually

useless.

3D captcha system displays graphic information

dynamically. Consequently, the attacker must

analyseevery single image fragment corresponding

torespectivepositionofamodelseparately incase

oftheattackusingtechniqueofimageanalysis.This

isasignificantincreaseintimeandenergydemands

in respect of the sources of attacker compared to

other captcha system based on the use of graphic

12

8/6/2019 3D captcha

13/15

13

information. In such cases, the attacker only

analyzesoneorfewimages.

To increasetheefficiencyof3Dcaptchasystemthe

source 2D images can be simplified as much

aspossible. The larger abstraction rate of images

limitsoptionstobeanalysedbyautomatedsystems

but, in appropriate use, it can also make the

procedureofsolvingmoresimplefortheuser.

4.ADVANTAGESANDDISADVANTAGES

Like themost technologies, the 3D captcha has its

advantagesanditsshortcomings.

4.1Advantages

The principle is based on the human imagination.This isthebiggestadvantageof3Dcaptchasystem.

Successful solution requires understanding of the

meaningofdisplayedgraphic information.Whileno

computer system can cope with the type of task

requiredby3Dcaptcha.

Fullautomationofthesystem.Itisveryeasytofullyautomate thewhole process of creating and using

3D captcha system. This greatly reduces the

resources that provider needs to spend on system

maintenance. Unlike other captcha systems using

images or 3D models, it is not necessary that the

sourcematerials are strenuouslymanually checked

oradditionallymodified (differentassigningof tags,

labels,descriptions,etc.)

Virtually unlimited database of source images. Thistechnologypracticallyenablesusingofanyimageas

thesource image.Thisgreatlyeliminatespossibility

of attack using method of comparison of samples

fromthedatabaseofusedimages.

Modifications to the advertising system. With theoption to use any graphic materials as the source

images, the support for advertising can be

implemented in the system. Advertiser delivers

graphic materials (e.g. logo), provider shall

incorporate them in3D captcha systemandowner

ofthewebsiteshall integrate it intohisapplication.

Web application can therefore receive additional

incomeinformofshareinadvertising.Thisprinciple

iswidelyusedbymanywebsitesincaseofdisplaying

simpletextads.Anotherimportantadvantageisthat

any possible modification of ads is more user

orientedthanatraditionaltextadvertisements.The

user is "forced" to cautiousness when solving the

captcha test.Typeofdisplayedgraphic information

in 3D captcha system can also be customized

accordingtocontentofwebsiteinwhichitisused.

Userfriendlinessofthesystem.The technologywascreatedtobeasfriendlytotheuseraspossible.User

just needs to usejust mouse or other positioning

device.Theuserdoesnotneedtousethekeyboard

to enter text inputs as in textbased captcha

systems. Moreover, with increasing experience in

using 3D captcha system the time necessary for

solutionoftestreduces.Significantadvantageisthe

independence of the technology in respect of

language and suitability for users who encounter

issuesinsolvingclassictextbasedcaptchasystems.

4.2Disadvantages

The prototype technology uses flash. To create aprototype 3D captcha system Flash runtime

environment has been used. However, this is not

supported on all devices. Fortunately, with the

progressandmassexpansionofHTML5 technology

it will be possible to modify the system to be

availableformoreusers.

8/6/2019 3D captcha

14/15

8/6/2019 3D captcha

15/15

15

6.REFERENCES

1) Rich Gossweiler, Maryam Kamvar, Shumeet

Baluja,WhatsUpCAPTCHA?

ACAPTCHABasedOnImageOrientation

http://static.googleusercontent.com/external_conte

nt/untrusted_dlcp/research.google.com/sk//pubs/ar

chive/35157.pdf

2)TaylorHayward,3DimagesasaCAPTCHA

http://taylorhayward.posterous.com/3dimagesas

acaptcha

3) Steven A. Ross, J. Alex Halderman, Adam

Finkelstein, Sketcha: A Captcha Based on Line

Drawingsof3DModels

http://www.cs.princeton.edu/gfx/pubs/Ross_2010_

SAC/index.php

4) Kurt Alfred Kluever, Dr. Richard Zanibbi, Video

CAPTCHAs

http://sudbury.cs.rit.edu/about

5)MichaelG.Kaplan,The3DCAPTCHA

http://spamfizzle.com/CAPTCHA.aspx

6)Papervision3D

http://www.papervision3d.org