Detecting unauthorized device access by comparing multiple independent spatial-time data sets

An authentication procedure utilizes multiple independent sources of data to determine whether usage of a device, such as a desktop computer, is authorized. The procedure includes gathering data from usage patterns associated with at least two devices such as a computer and a mobile phone, as well as optionally data from an independent source such as a facility access mechanism, lighting data, or an accelerometer on a keyboard, door or chair. The method includes identifying anomalous device use behavior by receiving two or three types of data from different sources: (1) first data from a first device, such as a desktop computer, via a first data path, the first device normally being accessed by a user; (2) second data from a second device, such as a mobile phone, associated with the user via a second data path; and (3) optionally third data from a third data source via a third data path, the third data source being, for example, an environment sensor. When a comparison indicates an anomaly from the base-line usage data, the system, provides a notice that access of the first device is not authorized.