Collaborative Research: EAGER: Enhancing Security and Privacy of Augmented Reality Mobile Applications through Software Behavior Analysis

增强现实(AR)移动应用将虚拟现实(VR)与现实相结合，在导航、虚拟会议、展览、游戏和翻译等任务中提供革命性的用户体验。为了使虚拟对象看起来附着到真实世界对象(例如，墙和人脸等表面)，AR应用将虚拟对象放置在相对于由AR设备标识的真实世界对象(称为跟踪物)的位置(称为锚)。然而，AR应用程序通过AR框架软件API获取和操作AR设备的摄像头输出(即，通常是用户部分或全部视力)的特权，导致了独特的安全和隐私问题，如破坏VR艺术和跟踪旁观者。现有的AR应用程序的防御机制(例如，Android智能手机中的许可系统)没有对AR元素(例如，可跟踪对象和锚)的独特行为进行建模，并且过于粗粒度，无法检测和缓解AR应用程序的潜在权限滥用。该项目的目标是(I)开发一个新的软件分析框架来检测和缓解VR应用程序的安全和隐私风险，以及(Ii)对真实AR应用程序(例如AR辅助驾驶和共享AR ART)进行大规模研究，以研究它们独特的安全问题。更具体地说，该项目将开发静态和动态程序分析，重点关注独特的AR元素(例如跟踪器和锚)，以检测两种主要类型的权限滥用：滥用对摄像头输出的读取访问权限和滥用对屏幕的写入滥用。特别是，该项目将开发(1)可跟踪锚分析，在AR软件中对AR元素的软件行为及其生命周期进行正式建模；以及(2)使用异常检测模型针对读写滥用行为的异常检测技术。然后，该项目将通过应用开发的技术对大量真实的VR应用程序进行研究，以评估这些技术的有效性，并发现独特的安全问题。该项目的成功将带来更安全的AR应用和AR系统，研究将加深对AR应用中安全风险和漏洞的理解。这项拟议的研究还将实现对动态生成的虚拟对象进行更细粒度的AR访问控制。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Augmented Reality (AR) mobile apps mix virtual reality (VR) with reality to provide revolutionary user experience in tasks such as navigation, virtual meetings, exhibitions, gaming, and translation. To make virtual objects appear to be attached to real-world objects (e.g., surfaces such as walls and human faces), AR apps place virtual objects at a location (called anchors) relative to the real-world objects (called trackables) identified by the AR devices. However, AR apps’ privilege to retrieve and manipulate camera output from AR devices (i.e., often part or the whole of users’ eyesight), enabled by AR framework software APIs, result in unique security and privacy concerns, such as vandalism of VR arts and tracking bystanders. Existing defense mechanisms of AR apps (e.g., the permission system in an Android smartphone) do not model the unique behaviors of AR elements (e.g., trackables and anchors) and are too coarse grained to detect and mitigate potential privilege abuses of AR apps. The goal of the project is to (i) develop a novel software analysis framework that detects and mitigates VR app’s security and privacy risks, and (ii) conduct a large scale study on real AR apps (e.g. AR-assisted Driving and shared AR arts) to study their unique security issues.More specifically, the project will develop static and dynamic program analysis with a focus on the unique AR elements (e.g., trackables and anchors) to detect two major types of privilege abuses: abuses of read access to camera output and abuses of write abuses to screen. In particular, the project will develop (1) trackable-anchor analysis that formally models the software behaviors of AR elements and their life cycles in AR software; and (2) anomaly detection techniques for read and write abuses using anomaly detection models. The project will then conduct a study on a large number of real VR apps by applying the developed techniques to evaluate the effectiveness of the techniques and uncover unique security issues. The success of this project will lead to more secure AR apps and AR systems, and the study will deepen the understanding of the security risks and vulnerabilities in AR apps. The proposed research will also enable finer-grained AR access control on dynamically generated virtual objects.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.