Abstract: An improved technique identifies risky transactions by mapping raw user location data to a particular cell in a fixed grid. Along these lines, when a user initiates a transaction with a service provider over a mobile device, the service provider collects raw location data such as a latitude and longitude for the user and transmits the location data to an adaptive authentication server. The adaptive authentication server then accesses a fixed set of geographical areas overlaid on a map of the Earth. For example, the geographic areas can correspond to square cells whose corners are defined by selected latitudes and longitudes. The adaptive authentication server finds a particular geographical area which contains the latitude and longitude for the user. Based on an identifier of the particular geographical area, the adaptive authentication server assigns a risk score to the transaction.

Abstract: An improved technique involves generating KBA questions based on facts from fact sources pointed to by an activity log. A KBA system obtains an activity log from a computer of a user in an organization. For example, the computer records the user's web browsing history. The KBA system then considers each entry in the activity log as a source of facts for deriving KBA questions. In the case of a web browsing history, the KBA system generates facts from web pages that the user visited. The KBA system then derives new KBA questions from the facts so derived.

Abstract: An improved technique employs knowledge-based authentication (KBA) based on data stored in a mobile apparatus. The mobile apparatus collects data from sources including email data, web browsing data, accessed YouTube video data, and GPS location data recently stored in the mobile apparatus. From such data, the mobile apparatus builds questions and stores the questions on a database on the phone. Upon receiving a request to access a resource stored in the mobile apparatus from a user, the mobile apparatus selects questions at random and ranks them according to a policy accessible to the mobile apparatus. The mobile apparatus presents the highest-ranked questions to the user. The mobile apparatus grants or rejects access to the resource based on an authentication result that the mobile apparatus generates from answers to the questions submitted by the user.

Abstract: An improved technique involves authenticating a user requesting access to a particular mobile device using knowledge-based authentication (KBA) questions generated from data taken from a group of mobile devices to which the particular mobile device belongs. Along these lines, consider a corporation that has a group of mobile devices distributed to its employees. The mobile devices provide data to an enterprise KBA (eKBA) server regarding events on each of the mobile devices. Because an owner of a mobile device belongs to a group of employees, the owner is able to answer questions regarding fellow employees. On the other hand, a malicious user that illegitimately gains access to the owner's mobile device will not be able to answer such questions, even if the malicious user knows details about the owner.

Abstract: Methods, computer program products, and apparatuses are provided for securely exchanging a data file between a client machine and a remote application server (e.g., a banking application operating on a banking server) in the context of a user communicating with the remote application server through a secure virtualized environment running on a virtualization server.

Abstract: A method of operating a VM server (VMS) is described, including (a) executing a VM instance (VMI) at the VMS, the VMI having a remote display within a terminal program of a client computer, the terminal program being configured to send commands received by the client from a user to the VMS to affect operation of the VMI, (b) running a browser within the VMI, the browser having a connection to a secure web application running on a web application server, the commands sent from the terminal program to the VMS allowing the user to interact with the web application via the terminal program and the browser running on the VMI, (c) at the VMS, asynchronously collecting information in connection with the commands sent from the user to the VMS, and (d) at the VMS, asynchronously sending the collected information to an analysis server to be analyzed for anomalous behavior.