OcuLock: Exploring Human Visual System for Authentication in Virtual Reality Head-mounted Display
OcuLock: Exploring Human Visual System for Authentication in Virtual Reality Head-mounted Display
复制标题
DOI：
10.14722/ndss.2020.24079
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Shiqing Luo;Anh Nguyen;Chen Song;Feng Lin;Wenyao Xu;Zhisheng Yan
中科院分区：
文献类型：
--
作者：
Shiqing Luo;Anh Nguyen;Chen Song;Feng Lin;Wenyao Xu;Zhisheng Yan
虚拟现实（VR）在广泛的应用中日益普及，产生了敏感的个人数据，如医疗记录和信用卡信息。虽然保护这些数据不受未经授权的访问至关重要，但直接应用传统的身份验证方法（例如，PIN）通过新的VR输入方式（如遥控器和头部导航）将导致安全问题。攻击者可以有目的地观察认证动作以推断认证输入。与任何其他移动的设备不同，VR通过头戴式显示器（HMD）呈现沉浸式体验，该显示器完全覆盖用户的眼睛区域，而不会暴露在公众面前。利用这一特性，我们探索人类视觉系统（HVS）作为一种为VR平台量身定制的新型生物识别认证。虽然先前的工作使用眼睛地球仪运动（注视）来认证智能手机或PC，但是它们遭受高错误率和低稳定性，因为眼睛注视高度依赖于认知状态。在这篇论文中，我们将人类视觉系统作为一个整体来探讨，不仅考虑眼球地球仪的运动，而且考虑人类视觉系统中的眼睑、眼外肌、细胞和周围神经。探索由沉浸式VR内容触发的HVS生物结构和独特的HVS特征可以增强身份验证的稳定性。为此，我们提出了OcuLock，一个基于HVS的系统，用于可靠和不可观察的VR HMD认证。OcuLock由基于眼电图（EOG）的HVS传感框架和记录比较驱动的身份验证方案授权。通过70个被试的实验表明，OcuLock对常见类型的攻击，如模仿攻击和统计攻击具有低等错误率分别为3.55%和4.97%。更重要的是，OcuLock在2个月的时间内保持稳定的性能，与其他潜在方法相比，用户更喜欢它。
The increasing popularity of virtual reality (VR) in a wide spectrum of applications has generated sensitive personal data such as medical records and credit card information. While protecting such data from unauthorized access is critical, directly applying traditional authentication methods (e.g., PIN) through new VR input modalities such as remote controllers and head navigation would cause security issues. The authentication action can be purposefully observed by attackers to infer the authentication input. Unlike any other mobile devices, VR presents immersive experience via a head-mounted display (HMD) that fully covers users’ eye area without public exposure. Leveraging this feature, we explore human visual system (HVS) as a novel biometric authentication tailored for VR platforms. While previous works used eye globe movement (gaze) to authenticate smartphones or PCs, they suffer from a high error rate and low stability since eye gaze is highly dependent on cognitive states. In this paper, we explore the HVS as a whole to consider not just the eye globe movement but also the eyelid, extraocular muscles, cells, and surrounding nerves in the HVS. Exploring HVS biostructure and unique HVS features triggered by immersive VR content can enhance authentication stability. To this end, we present OcuLock, an HVS-based system for reliable and unobservable VR HMD authentication. OcuLock is empowered by an electrooculography (EOG) based HVS sensing framework and a record-comparison driven authentication scheme. Experiments through 70 subjects show that OcuLock is resistant against common types of attacks such as impersonation attack and statistical attack with Equal Error Rates as low as 3.55% and 4.97% respectively. More importantly, OcuLock maintains a stable performance over a 2month period and is preferred by users when compared to other potential approaches.