OcuLock: Exploring Human Visual System for Authentication in Virtual Reality Head-mounted Display

Abstract

The increasing popularity of virtual reality (VR) in a wide spectrum of applications has generated sensitive personal data such as medical records and credit card information. While protecting such data from unauthorized access is critical, directly applying traditional authentication methods (e.g., PIN) through new VR input modalities such as remote controllers and head navigation would cause security issues. The authentication action can be purposefully observed by attackers to infer the authentication input. Unlike any other mobile devices, VR presents immersive experience via a head-mounted display (HMD) that fully covers users' eye area without public exposure. Leveraging this feature, we explore human visual system (HVS) as a novel biometric authentication tailored for VR platforms. While previous works used eye globe movement (gaze) to authenticate smartphones or PCs, they suffer from a high error rate and low stability since eye gaze is highly dependent on cognitive states. In this paper, we explore the HVS as a whole to consider not just the eye globe movement but also the eyelid, extraocular muscles, cells, and surrounding nerves in the HVS. Exploring HVS biostructure and unique HVS features triggered by immersive VR content can enhance authentication stability. To this end, we present OcuLock, an HVS-based system for reliable and unobservable VR HMD authentication. OcuLock is empowered by an electrooculography (EOG) based HVS sensing framework and a record-comparison driven authentication scheme. Experiments through 70 subjects show that OcuLock is resistant against common types of attacks such as impersonation attack and statistical attack with Equal Error Rates as low as 3.55% and 4.97% respectively. More importantly, OcuLock maintains a stable performance over a 2month period and is preferred by users when compared to other potential approaches.

Emerging ExG-based NUI Inputs in Extended Realities: A Bottom-up Survey

“…The finding is clearly feasible over the entire reality-virtuality continuum. Additionally, as noted in Reference [142] XR generally improves the robustness of biosignal classification, while vivid and immersive imagery is preferred by users. XR provides a great opportunity for the development of down-to-earth scenarios with practical scenes that supports complex user interaction in daily life.…”

“…An alternative approach to authentication in XR head-mounted displays relies on unique features of the human visual system, such as eye globe, eyelid, and extraocular muscle movements. OcuLock [142], a system designed specifically for HMDs, captures the EOG associated with the ocular activity. Visual stimuli, presented in an immersive VR environment, improve the robustness of authentication using the acquired signal.…”

“…OcuLock, as an EOG-based authentication system, is resistant to impersonation and statistical attacks. As a part of the system's evaluation, Luo et al [142] conducted a questionnaire that established: (i) users prefer dynamic and attractive visual stimuli in VR, and (ii) EOG-based authentication system is a more convenient and socially acceptable method of establishing trust in XR, compared to gesture-and brainwave-based approaches.…”

OVRseen: Auditing Network Traffic and Privacy Policies in Oculus VR

“…Although there is work on security aspects of VR devices (e.g., authentication and attacks on using virtual keyboards) [15,38,39,41], the privacy of VR is currently not fully understood. Adams et al [1] interviewed VR users and developers on security and privacy concerns, and learnt that they were concerned with data collection potentially performed by VR devices (e.g., sensors, device being always on) and that they did not trust VR manufacturers (e.g., Facebook owning Oculus).…”

Towards Secure and Usable Authentication for Augmented and Virtual Reality Head-Mounted Displays

“…The glasses show a randomly created PIN pad on the private display according to which the user can input password through their smartphone. Other proposals include biometric authentication based on head and body movement [31,37,39] or the human visual system [29,32,34]. These proposals require either additional hardware (such as a smartphone) or a training phase to capture the user's biometric pattern.…”