Requirements

Functional Requirements:

• System produces varied challenge types (image recognition, distorted text, audio) to differentiate humans from bots and keep challenges unpredictable.
• Accessibility features like audio CAPTCHA or simplified challenges ensure visually impaired users can verify while maintaining bot protection.
• Challenge difficulty can be tweaked or adjusted; usability balanced so CAPTCHA is quick and easy for humans while hindering bots; distortion levels varied.
• Security monitoring and logging of bot interactions; challenges must be robust against evolving bots; track IP failures, analyze attacks to adapt defenses.

Non-Functional Requirements:

• List the key non-functional requirements (eg low latency, scalability, reliability, etc.)...
• high availability 99.99%
• low latency for captcha generation and acceptance.
• Horizontal Scalability

API Design

POST /api/v1/generateCaptcha

POST /api/v1/submitCaptcha

POST /api/v1/validateCaptcha

GET /api/v1/getAlternativeCaptcha

GET /api/v1/analytics

POST /api/v1/admin/modifyCaptcha

High-Level Design

Generate Captcha Path: Client -> CDN -> API Gateway -> Load Balancer -> Captcha Proxy -> Captcha Generator

Validate Captcha Path: Client -> CDN -> API Gateway -> Load Balancer -> Captcha Proxy -> Validate Captcha

Edit Captcha Path: Client -> CDN -> API Gateway -> Load Balancer -> Captcha Proxy -> Admin

Analytics Path: Client -> CDN -> API Gateway -> Load Balancer -> Analytics

We can detect if a challenge is being done by a person or bot by looking at the mouse movement and how fast the challenges are getting completed. If a mouse movement is very robotic like perfect lines and such then we can be somewhat certain that it can be a bot but for better results we can have an ML Model which would be able to detect if its being done by person or bot. Based on the confidence score we can adjust the challenge difficulty of the next captcha.

When ever a captcha is being solved it will be logged with its attributes like how much time what was the challenge, mouse movements, key strokes etc., depending on the captcha type. We can use this data to perform analysis and adjust/edit the challenges.

We have a captcha validator service for validating the captcha that is being solved by the user. We will be taking the response from the solver and comparing it with the actual answer based on which we will either pass him or fail him.

Detailed Component Design

CDN - We host our frontend in this. I will be able to handle millions of request and is available on edge. It even acts as the first layer of cache where most of the read requests are taken care off. Also we can integrate our object store with this to serve the content files easily. this can help if external cache is either slow or unavailable.

API Gateway routes the traffic based on the api that is getting hit. This also helps in rate limiting/throttling of requests which prevents any DDoS and Brute force attacks.

Load Balancer this is configured with API gateway and is used to distribute the load across the servers hosting our services. Keeping the traffic uniform and capable of handling the spike in traffic.

captcha proxy is used for routing the captcha related requests are routed by it.

We can randomize the challenge paraments by using stratified randomization, which improves balance by considering known factors. Using this makes the challenges user friendly but effective against the bots.

we can measure the metrics from the user by tracking their key strokes, mouse cursor movements, and based on how bot like it is we will increase the difficulty.

we will also be taking our system metrics to keep track of how much load and traffic is being handled and scale it based on the load. Along with latency and success rates will also be monitored.

We can have a small pop up after captcha challenge is done for taking users feedback. They have the option to ignore this. Based on their feedback we can modify the captcha settings or redesign the challenge.

We will give the option of choosing different challenge which will show different type of captcha challenges. We will be having audio and visual accessibility as well for users with disability.