Hello, my name is Florian Mathis from the University of Glasgow and it is my great
pleasure today to present on behalf of my co-authors our work Fast and Secure Authentication in Virtual Reality
using Coordinated 3D Manipulation and Pointing. There are many application areas where VR has been
adapted such as for education or for industrial design, and despite the advantages and all the
good bits of such a technology, there are also some security and privacy challenges.
In some situations users are actually required to authenticate, for example, when logging into an
email account or when making in-VR purchases -- fast and secure authentication systems are required.
Systems that are usable and secure within the context of a shared space where bystanders
can potentially observe the user's interactions during such an authentication. To make such PIN and
password entries in VR usable and secure against observations, we focus in this work particularly
on leveraging the third dimension of VR -- so we use a three-dimensional cube for authentication
and give users full control of an environment-independent authentication scheme. Based on
wrist and controller rotations, users can select password elements from different surfaces
in a fast and secure way. Our research was guided by three research questions.
We aimed to understand how different pointing methods impact VR authentication using coordinated
3D manipulation and pointing and how the number of object manipulations influences the usability
and the security. And finally, we also wanted to better understand how human-centered threat models
beyond classical one-time observations impact the security evaluation of an authentication system.
To interact with RubikAuth, users could use eye gaze,
head pose where input was provided with head movements
and controller tapping where users directly touch the cube with a controller.
To evaluate our authentication system, we conducted a usability study
followed by a memorability study one week later. We had as independent variables the pointing methods
and the number of cube rotations, which we call switches. We also conducted a
security study independent of the previous studies and with a new set of participants.
Here, we aimed to better understand the impact of different threat models, all within the scope of
shoulder-surfing where a bystander observes a VR user's interactions from the reality.
Due to brevity, I would like to present three key messages and I invite everyone to take a
look at the paper for more details. In this work, we leveraged a unique characteristic of VR for user
authentication and showed that a manipulable 3D object in the form of a cube can significantly
improve authentication in VR and provides a promising usability and security tradeoff.
We also found that increasing the number of object manipulations improves security -- and
what is really interesting here is, that some participants even voiced that this can be used
to trick attackers through fake rotations or even putting the cube into a position
where password elements from multiple surfaces are selectable, that you can see on this picture.
Yet, it is very important to note here that these object manipulations can also impact usability
and it remains unclear in which contexts, and if at all, users would make use of fake rotations.
Furthermore, advanced threat models can play an important role when assessing a system's security.
Supporting attackers to optimise their attacks improves researchers' understanding of a system's
security, and in our study allowing attackers to record authentications with a smartphone
and having access to a real-world replica of our VR authentication system indeed improved
attackers attacks. Please read more in the paper about the first concept and implementation
of Virtual Reality authentication using an environment-independent manipulable 3D object,
about the evaluation of the impact of different pointing methods on usability and security,
and about our lessons learned when conducting this research to guide researchers in the design
and evaluation of knowledge-based Virtual Reality authentication systems. Thanks a lot!