IP Library › Granted Patent US 12664252
Granted Patent B2
US 12664252 · App. 18/214,648 · Granted Jun 23, 2026

Challenge interface for web services

Inventors: Luke Fu (San Mateo, CA); Lirui Li (San Mateo, CA); Victor Reynolds (San Mateo, CA); Sanjay Kannan (San Mateo, CA); Justin Bartee (San Mateo, CA); Xueying Wen (San Mateo, CA); Shawn George (San Mateo, CA)
Assignee: Roblox Corporation
G06F21/45G06F2221/2103
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12664252
App. No.
18/214,648
Granted
Jun 23, 2026
Kind
B2
Abstract

The application describes a no coding integration approach for any web service by using a challenge interface as a middleware intermediate between a public application programming interface (API) and a challenge service so that any changes made in challenge protocols are implemented at the challenge interface. The challenge interface includes a rule engine that dynamically executes rules and evaluates suspicious signals from requests to automatically decide how many challenges and what kind of challenges are needed to satisfy a current request. The user interface provided to the user device automatically updates for different challenge types through an interceptor approach. The user interface works for all supported device types, including browsers, mobile devices, and native applications.

Claims (60)

1 . A computer-implemented method comprising:

receiving, from a user device, a first request to perform an action and a challenge session identifier that was provided to the user device from a challenge service based on a successful login attempt;

transmitting, from a challenge interface to the challenge service, a second request for a challenge token, wherein the second request includes the challenge session identifier;

receiving, with the challenge interface from the challenge service, a type of challenge based on the challenge session identifier and a type of action that is part of the first request, wherein the type of challenge comprises captcha, two-step verification, or reauthentication;

presenting a challenge of the type of challenge, with the challenge interface, to the user device, wherein the challenge interface is different for each type of challenge;

responsive to verifying that the user device solved the challenge, receiving the challenge token from the challenge service; and

providing the challenge token to the user device, wherein responsive to receiving the challenge token, the user device provides the challenge token and the challenge session identifier to an authenticator application programming interface (API).

2 . The method of claim 1 , further comprising:

responsive to receiving the challenge token from the user device via the authenticator API, providing the user device with access to a virtual environment.

3 . The method of claim 1 , further comprising:

before receiving the first request to perform the action, receiving, with the challenge service, a login request from the user device that is forwarded from the authenticator API; and

determining, with the challenge service based on the type of action being the login request, that a login challenge response is needed for authentication, wherein the authenticator API transmits a login challenge to the user device;

wherein the authenticator API acts as an intermediate between the user device and the challenge service to facilitate authentication of the login request.

4 . The method of claim 1 , wherein verifying that the user device solved the challenge includes determining whether the first request is suspicious based on information associated with the first request.

5 . The method of claim 4 , wherein the information associated with the first request is input to a machine-learning model that outputs a determination of suspicion and the machine-learning model is trained with training data that includes metadata associated with requests and determinations of whether the requests are suspicious.

6 . The method of claim 1 , wherein verifying that the user device solved the challenge includes determining whether to apply rate limiting that introduces a time delay in between authentication attempts.

7 . The method of claim 3 , further comprising:

receiving, with the challenge interface, a change to a protocol associated with the challenge; and

implementing, with the challenge interface, the change to the challenge;

wherein implementing the change to the challenge with the challenge interface does not change a protocol associated with the authenticator API.

8 . A system comprising:

one or more processors; and

a memory coupled to the one or more processors, with instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a user device, a first request to perform an action and a challenge session identifier that was provided to the user device from a challenge service based on a successful login attempt;

transmitting, from a challenge interface to the challenge service, a second request for a challenge token, wherein the second request includes the challenge session identifier;

receiving, with the challenge interface from the challenge service, a type of challenge based on the challenge session identifier and a type of action that is part of the first request, wherein the type of challenge comprises captcha, two-step verification, or reauthentication;

presenting a challenge of the type of challenge, with the challenge interface, to the user device, wherein the challenge interface is different for each type of challenge;

responsive to verifying that the user device solved the challenge, receiving the challenge token from the challenge service; and

providing the challenge token to the user device, wherein responsive to receiving the challenge token, the user device provides the challenge token and the challenge session identifier to an authenticator application programming interface (API).

9 . The system of claim 8 , wherein the operations further comprise:

receiving, with the challenge interface, a change to a protocol associated with the challenge; and

implementing, with the challenge interface, the change to the challenge instead of modifying a public API used by the authenticator API.

10 . The system of claim 8 , wherein the operations further comprise:

responsive to receiving the challenge token from the user device via the authenticator API, providing the user device with access to a virtual environment.

11 . The system of claim 8 , wherein verifying that the user device solved the challenge includes determining whether the first request is suspicious based on information associated with the first request.

12 . The system of claim 11 , wherein the information associated with the first request is input to a machine-learning model that outputs a determination of suspicion and the machine-learning model is trained with training data that includes metadata associated with requests and determinations of whether the requests are suspicious.

13 . The system of claim 11 , wherein verifying that the user device solved the challenge includes determining whether to apply rate limiting that introduces a time delay in between authentication attempts.

14 . The system of claim 10 , wherein the operations further include:

receiving, with the challenge interface, a change to a protocol associated with the challenge; and

implementing, with the challenge interface, the change to the challenge;

implementing the change to the challenge with the challenge interface does not change a protocol associated with the API.

15 . A non-transitory computer-readable medium with instructions stored thereon that, when executed by one or more computers, cause the one or more computers to perform operations, the operations comprising:

receiving, from a user device, a first request to perform an action and a challenge session identifier that was provided to the user device from a challenge service based on a successful login attempt;

transmitting, from a challenge interface to the challenge service, a second request for a challenge token, wherein the second request includes the challenge session identifier;

receiving, with the challenge interface from the challenge service, a type of challenge based on the challenge session identifier and a type of action that is part of the first request, wherein the type of challenge comprises captcha, two-step verification, or reauthentication;

presenting a challenge of the type of challenge, with the challenge interface, to the user device, wherein the challenge interface is different for each type of challenge;

responsive to verifying that the user device solved the challenge, receiving the challenge token from the challenge service; and

providing the challenge token to the user device, wherein responsive to receiving the challenge token, the user device provides the challenge token and the challenge session identifier to an authenticator application programming interface (API).

16 . The computer-readable medium of claim 15 , wherein the operations further include:

responsive to receiving the challenge token from the user device via the authenticator API, providing the user device with access to a virtual environment.

17 . The computer-readable medium of claim 15 , wherein the operations further include:

receiving, with the challenge interface, a change to a protocol associated with the challenge;

implementing, with the challenge interface, the change to the challenge;

before receiving the first request to perform the action, receiving, with the challenge service, a login request from the user device that is forwarded from the authenticator API; and

determining, with the challenge service based on the type of action being the login request, that a login challenge response is needed for authentication, wherein the authenticator API transmits a login challenge to the user device;

wherein the authenticator API acts as an intermediate between the user device and the challenge service to facilitate authentication of the login request; and

wherein implementing the change to the challenge with the challenge interface does not change a protocol associated with the API.

18 . The computer-readable medium of claim 15 , wherein verifying that the user device solved the challenge includes determining whether the first request is suspicious based on information associated with the first request.

19 . The computer-readable medium of claim 18 , wherein the information associated with the first request is input to a machine-learning model that outputs a determination of suspicion and the machine-learning model is trained with training data that includes metadata associated with requests and determinations of whether the requests are suspicious.

20 . The computer-readable medium of claim 15 , wherein verifying that the user device solved the challenge includes determining whether to apply rate limiting that introduces a time delay in between authentication attempts.