Abstract: A technique detects mobile device emulation. The technique involves identifying, by processing circuitry, a user apparatus for mobile device emulation detection. The technique further involves collecting, by the processing circuitry, motion sensor data from the identified user apparatus (e.g., samples of accelerometer attributes, gyroscopic attributes, gravity attributes, etc. over multiple time periods). The technique further involves performing, by the processing circuitry, a motion sensor data analysis operation based on the collected motion sensor data. A result of the motion sensor data analysis operation indicates whether the identified user apparatus is a physical mobile device or an emulated mobile device.

Abstract: There is disclosed a technique for use in authentication. The technique comprises selecting an authentication challenge when an authentication request is deemed risky. An attack threat determined to be associated with the authentication request acts as a decision factor in the selection of the authentication challenge such that a biometric challenge is selected in the event that the attack threat describes a stolen device and an out-of-band challenge is selected in the event that the attack threat describes a stolen identification credential.

Abstract: A technique of performing knowledge based authentication (KBA) involves collecting activity data and time data based on operation of a mobile device, the activity data identifying an activity performed by the mobile device, and the time data identifying a time of the activity. The technique further involves generating a KBA question based on the activity data and the time data. The technique further involves providing the KBA question to a user to authenticate the user. Such a technique is capable of being performed by a remote server which communicates with the mobile device over time (e.g., in response to certain events, periodically, combinations thereof, etc.). Accordingly, the remote server is able to accumulate activity and time data which is not stored permanently (or perhaps even at all) by the mobile device, and then generate KBA questions based on that data.

Abstract: A technique performs user authentication. The technique involves generating a first usage pattern from a first set of mobile device communications performed during a first period of time. The technique further involves generating a second usage pattern from a second set of mobile device communications performed during a second period of time. The technique further involves performing a comparison between the first and second usage patterns to determine whether a human provider of the first usage pattern and a human provider of the second usage pattern are the same person. Accordingly, a malicious person who steals a mobile device or operates a mock mobile device would nevertheless be identified as different from the legitimate user because the malicious person does not behave the same way as the legitimate user (e.g., does not have the same phone call behavior, does not have the same text messaging behavior, etc.).