ARSpy: Breaking Location-Based Multi-Player Augmented Reality Application for User Location Tracking
ARSpy: Breaking Location-Based Multi-Player Augmented Reality Application for User Location Tracking
复制标题
ARSpy：用于用户位置跟踪的突破性基于位置的多人增强现实应用程序
DOI：
10.1109/tmc.2020.3007740
复制
发表时间：
2020
影响因子：
7.9
通讯作者：
Shu Yin
中科院分区：
文献类型：
--
作者：
Jiacheng Shang;Si Chen;Jie Wu;Shu Yin
用数字生成的信息覆盖真实世界感知的增强现实(AR)应用程序正处于商业可行性的边缘。AR已经出现在微软全息镜头和智能手机等几个商业平台上。它们将用户体验扩展到二维以外，并补充了用户的正常3D世界。典型的基于位置的多玩家AR应用程序通过三个步骤工作，其中系统从真实世界收集感觉数据，根据对象的上下文识别对象，最后在用户感觉的基础上呈现信息。然而，由于这些AR应用程序经常与用户交换数据，它们暴露了新的个人和公共安全问题。在本文中，我们开发了一个完全基于用户网络流量信息的用户位置跟踪系统ARSpy，并在基于位置的多人AR应用上进行了测试。通过对12名志愿者的真实实验，验证了该方法的有效性和高效性，并证明了该方法能够以较高的精度获得任意目标的定位。我们还提出了三种缓解这些旁路攻击的方法。我们的结果揭示了当前基于位置的多人AR应用中的潜在安全威胁，并为广大AR用户提供了重要的安全提醒。
Augmented reality (AR) applications that overlay the perception of the real world with digitally generated information are on the cusp of commercial viability. AR has appeared in several commercial platforms like Microsoft HoloLens and smartphones. They extend the user experience beyond two dimensions and supplement the normal 3D world of a user. A typical location-based multi-player AR application works through a three-step process, wherein the system collects sensory data from the real world, identifies objects based on their context, and finally, renders information on top of senses of a user. However, because these AR applications frequently exchange data with users, they have exposed new individual and public safety issues. In this paper, we develop ARSpy, a user location tracking system solely based on network traffic information of the user, and we test it on location-based multi-player AR applications. We demonstrate the effectiveness and efficiency of the proposed scheme via real-world experiments on 12 volunteers and show that we could obtain the geolocation of any target with high accuracy. We also propose three mitigation methods to mitigate these side channel attacks. Our results reveal a potential security threat in current location-based multi-player AR applications and serve as a critical security reminder to a vast number of AR users.