Detecting mobile device emulation

• US 9,667,613 B1
• Filed: 12/10/2014
• Issued: 05/30/2017
• Est. Priority Date: 12/10/2014
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Herskovic, Maya, Mihalache, Theodor, Wisemon, Tamar, Avital, Aviv, Avni, Ayelet, Bar-Menachem, Ika
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Little, Vance
• Application Number:
  US14/565,739
• Time in Patent Office: 902 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 9/455 Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

A technique detects mobile device emulation. The technique involves identifying, by processing circuitry, a user apparatus for mobile device emulation detection. The technique further involves collecting, by the processing circuitry, motion sensor data from the identified user apparatus (e.g., samples of accelerometer attributes, gyroscopic attributes, gravity attributes, etc. over multiple time periods). The technique further involves performing, by the processing circuitry, a motion sensor data analysis operation based on the collected motion sensor data. A result of the motion sensor data analysis operation indicates whether the identified user apparatus is a physical mobile device or an emulated mobile device.

Claims

1. A method of detecting mobile device emulation, the method comprising:

identifying, by processing circuitry, a user apparatus for mobile device emulation detection;

collecting, by the processing circuitry, motion sensor data from the identified user apparatus;

performing, by the processing circuitry, a motion sensor data analysis operation based on the collected motion sensor data, a result of the motion sensor data analysis operation indicating whether the identified user apparatus is a physical mobile device or an emulated mobile device;

upon performance of the motion sensor data analysis operation and in response to the motion sensor data indicating no mobile device movement, providing an electronic emulation detection result indicating whether a user operating the user apparatus (i) is operating a genuine physical mobile device or (ii) is emulating the genuine physical mobile device using a device which is different from the genuine physical mobile device; and

in response to the electronic emulation detection result indicating that the user is emulating the genuine physical mobile device using the device which is different from the genuine physical mobile device, outputting an alert electronically indicating that the user apparatus is an emulated mobile device rather than a physical mobile device;

wherein the collected motion sensor data includes a first set of motion sensor readings and a second set of motion sensor readings;

wherein the first set of motion sensor readings includes at least one of;

(i) first accelerometer data which signifies acceleration force applied to the user apparatus during the first reading collection time period, (ii) first gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the first reading collection time period, and (iii) first gravity data which signifies gravitational force applied to the user apparatus during the first reading collection time period; and

wherein the second set of motion sensor readings includes at least one of;

(i) second accelerometer data which signifies acceleration force applied to the user apparatus during the second reading collection time period, (ii) second gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the second reading collection time period, and (iii) second gravity data which signifies gravitational force applied to the user apparatus during the second reading collection time period.

2. A method as in claim 1 wherein identifying the user apparatus for mobile device emulation detection includes:

receiving an authentication request indicating that the user operating the user apparatus wishes to authenticate.

3. A method as in claim 2 wherein collecting the motion sensor data includes:

obtaining the first set of motion sensor readings from the user apparatus during a first reading collection time period, and

obtaining the second set of motion sensor readings from the user apparatus during a second reading collection time period which is after the first reading collection time period.

4. A method as in claim 3 wherein receipt of the authentication request initiates a user authentication session to authenticate the user;

and

wherein (i) obtaining the first set of motion sensor readings during the first reading collection time period and (ii) obtaining the second set of motion sensor readings during the second reading collection time period occur during the user authentication session to authenticate the user.

5. A method as in claim 3 wherein performing the motion sensor data analysis operation includes:

performing a comparison operation which compares the first set of motion sensor readings to the second set of motion sensor readings to determine whether the first and second sets of motion sensor readings indicates movement of the user apparatus.

6. A method as in claim 5 wherein the comparison operation indicates captured orientation movement of the user apparatus from a first user apparatus orientation to a second user apparatus orientation;

and wherein performing the motion sensor data analysis operation further includes;

comparing the captured orientation movement to a normal orientation movement profile to determine whether the first and second sets of motion sensor readings are actual motion sensor attributes from a physical mobile device.

7. A method as in claim 5 wherein the comparison operation indicates captured location movement of the user apparatus from a first user apparatus location to a second user apparatus location;

and wherein performing the motion sensor data analysis operation further includes;

comparing the captured location movement to a normal location movement profile to determine whether the first and second sets of motion sensor readings are actual motion sensor attributes from a physical mobile device.

8. A method as in claim 3 wherein obtaining the first set of motion sensor readings from the user apparatus includes acquiring first accelerometer data which signifies acceleration force applied to the user apparatus during the first reading collection time period;

and

wherein obtaining the second set of motion sensor readings from the user apparatus includes acquiring second accelerometer data which signifies acceleration force applied to the user apparatus during the second reading collection time period.

9. A method as in claim 3 wherein obtaining the first set of motion sensor readings from the user apparatus includes acquiring first gyroscopic data which signifies a set of rates of rotation of the user apparatus around a set of physical axes during the first reading collection time period;

and

wherein obtaining the second set of motion sensor readings from the user apparatus includes acquiring second gyroscopic data which signifies a set of rates of rotation of the user apparatus around the set of physical axes during the second reading collection time period.

10. A method as in claim 3 wherein obtaining the first set of motion sensor readings from the user apparatus includes acquiring first gravity data which signifies the force of gravity applied to the user apparatus during the first reading collection time period;

and

wherein obtaining the second set of motion sensor readings from the user apparatus includes acquiring second gravity data which signifies the force of gravity applied to the user apparatus during the second reading collection time period.

11. An electronic apparatus, comprising:

a network interface;

memory; and

control circuitry coupled to the network interface and the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to;

identify a user apparatus for mobile device emulation detection,

collect motion sensor data from the identified user apparatus through the network interface,

perform a motion sensor data analysis operation based on the collected motion sensor data, a result of the motion sensor data analysis operation indicating whether the identified user apparatus is a physical mobile device or an emulated mobile device;

upon performance of the motion sensor data analysis operation and in response to the motion sensor data indicating no mobile device movement, provide an electronic emulation detection result indicating whether a user operating the user apparatus (i) is operating a genuine physical mobile device or (ii) is emulating the genuine physical mobile device using a device which is different from the genuine physical mobile device; and

in response to the electronic emulation detection result indicating that the user is emulating the genuine physical mobile device using the device which is different from the genuine physical mobile device, output an alert electronically indicating that the user apparatus is an emulated mobile device rather than a physical mobile device;

wherein the collected motion sensor data includes a first set of motion sensor readings and a second set of motion sensor readings;

wherein the first set of motion sensor readings includes at least one of;

(i) first accelerometer data which signifies acceleration force applied to the user apparatus during the first reading collection time period, (ii) first gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the first reading collection time period, and (iii) first gravity data which signifies gravitational force applied to the user apparatus during the first reading collection time period; and

wherein the second set of motion sensor readings includes at least one of;

(i) second accelerometer data which signifies acceleration force applied to the user apparatus during the second reading collection time period, (ii) second gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the second reading collection time period, and (iii) second gravity data which signifies gravitational force applied to the user apparatus during the second reading collection time period.

12. An electronic apparatus as in claim 11 wherein the control circuitry, when identifying the user apparatus for mobile device emulation detection, is constructed and arranged to:

receive an authentication request indicating that the user operating the user apparatus wishes to authenticate.

13. An electronic apparatus as in claim 12 wherein the control circuitry, when collecting the motion sensor data, is constructed and arranged to:

obtain the first set of motion sensor readings from the user apparatus during a first reading collection time period, and

obtain the second set of motion sensor readings from the user apparatus during a second reading collection time period which is after the first reading collection time period.

14. An electronic apparatus as in claim 13 wherein receipt of the authentication request initiates a user authentication session to authenticate the user;

wherein the control circuitry is constructed and arranged to obtain (i) the first set of motion sensor readings and (ii) the second set of motion sensor readings during the user authentication session to authenticate the user; and

wherein the control circuitry, when performing the motion sensor data analysis operation, is constructed and arranged to perform a comparison operation which compares the first set of motion sensor readings to the second set of motion sensor readings to determine whether the first and second sets of motion sensor readings indicates movement of the user apparatus during the user authentication session.

15. A computer program product having a non-transitory computer readable medium which stores a set of instructions to detect mobile device emulation, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:

identifying a user apparatus for mobile device emulation detection;

collecting motion sensor data from the identified user apparatus;

performing a motion sensor data analysis operation based on the collected motion sensor data, a result of the motion sensor data analysis operation indicating whether the identified user apparatus is a physical mobile device or an emulated mobile device;

upon performance of the motion sensor data analysis operation and in response to the motion sensor data indicating no mobile device movement, providing an electronic emulation detection result indicating whether a user operating the user apparatus (i) is operating a genuine physical mobile device or (ii) is emulating the genuine physical mobile device using a device which is different from the genuine physical mobile device; and

in response to the electronic emulation detection result indicating that the user is emulating the genuine physical mobile device using the device which is different from the genuine physical mobile device, outputting an alert electronically indicating that the user apparatus is an emulated mobile device rather than a physical mobile device;

wherein the collected motion sensor data includes a first set of motion sensor readings and a second set of motion sensor readings;

wherein the first set of motion sensor readings includes at least one of;

(i) first accelerometer data which signifies acceleration force applied to the user apparatus during the first reading collection time period, (ii) first gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the first reading collection time period, and (iii) first gravity data which signifies gravitational force applied to the user apparatus during the first reading collection time period; and

wherein the second set of motion sensor readings includes at least one of;

(i) second accelerometer data which signifies acceleration force applied to the user apparatus during the second reading collection time period, (ii) second gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the second reading collection time period, and (iii) second gravity data which signifies gravitational force applied to the user apparatus during the second reading collection time period.

16. A computer program product as in claim 15 wherein identifying the user apparatus for mobile device emulation detection includes:

receiving an authentication request indicating that the user operating the user apparatus wishes to authenticate.

17. A computer program product as in claim 16 wherein collecting the motion sensor data includes:

obtaining the first set of motion sensor readings from the user apparatus during a first reading collection time period, and

obtaining the second set of motion sensor readings from the user apparatus during a second reading collection time period which is after the first reading collection time period.

18. A computer program product as in claim 17 wherein receipt of the authentication request initiates a user authentication session to authenticate the user;

wherein (i) obtaining the first set of motion sensor readings during the first reading collection time period and (ii) obtaining the second set of motion sensor readings during the second reading collection time period occur during the user authentication session to authenticate the user;

wherein performing the motion sensor data analysis operation includes performing a comparison operation which compares the first set of motion sensor readings to the second set of motion sensor readings to determine whether the first and second sets of motion sensor readings indicates movement of the user apparatus;

wherein obtaining the first set of motion sensor readings from the user apparatus includes acquiring;

(i) first accelerometer data which signifies acceleration force applied to the user apparatus during the first reading collection time period, (ii) first gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the first reading collection time period, and (iii) first gravity data which signifies gravitational force applied to the user apparatus during the first reading collection time period; and

wherein obtaining the second set of motion sensor readings from the user apparatus includes acquiring;

(i) second accelerometer data which signifies acceleration force applied to the user apparatus during the second reading collection time period, (ii) second gyroscopic data which signifies a set of rates of rotation around a set of physical axes for the user apparatus during the second reading collection time period, and (iii) second gravity data which signifies gravitational force applied to the user apparatus during the second reading collection time period.