Abstract:While Virtual Reality (VR) applications are becoming increasingly common, efficiently verifying a VR device user before granting personal access is still a challenge. Existing VR authentication methods require users to enter PINs or draw graphical passwords using controllers. Though the entry is in the virtual space, it can be observed by others in proximity and is subject to critical security issues. Furthermore, the in-air hand movements or handheld controller-based authentications require active user participation and are not time-efficient. This work proposes a low-effort VR device authentication system based on the unique skull-reverberated sounds, which can be acquired when the user wears the VR device. Specifically, when the user puts on the VR device or is wearing it to log into an online account, the proposed system actively emits an ultrasonic signal to initiate the authentication session. The signal returning to the VR device's microphone has been reverberated by the user's head, which is unique in size, skull shape and mass. We thus extract head biometric information from the received signal for unobtrusive VR device authentication. Though active acoustic sensing has been broadly used on mobile devices, no prior work has ever successfully applied such techniques to commodity VR devices. Because VR devices are designed to provide users with virtual reality immersion, the echo sounds used for active sensing are unwanted and severely suppressed. The raw audio before this process is also not accessible without kernel/hardware modifications. Thus, our work further solves the challenge of active acoustic sensing under echo cancellation to enable deploying our system on off-the-shelf VR devices. Additionally, we show that the echo cancellation mechanism is naturally good to prevent acoustic replay attacks. The proposed system is developed based on an autoencoder and a convolutional neural network for biometric data extraction and recognition. Experiments with a standalone and a mobile phone VR headset show that our system efficiently verifies a user and is also replay-resistant.

Remote Keylogging Attacks in Multi-user VR Applications

Inception Attacks: Immersive Hijacking in Virtual Reality Systems

I Know What You Enter on Gear VR

Non-intrusive and Unconstrained Keystroke Inference in VR Platforms via Infrared Side Channel

mmSpyVR: Exploiting mmWave Radar for Penetrating Obstacles to Uncover Privacy Vulnerability of Virtual Reality

GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices

De-anonymizing Avatars in Virtual Reality: Attacks and Countermeasures

De-anonymization Attacks on Metaverse.

Exploiting Out-of-band Motion Sensor Data to De-anonymize Virtual Reality Users

Analysis and Design of Efficient Authentication Techniques for Password Entry with the Qwerty Keyboard for VR Environments

Key Listener: Inferring Keystrokes on QWERTY Keyboard of Touch Screen Through Acoustic Signals

Exploiting the Uncoordinated Privacy Protections of Eye Tracking and VR Motion Data for Unauthorized User Identification

POSTER - ReAvatar - Virtual Reality De-anonymization Attack Through Correlating Movement Signatures.

Exploring the Privacy Risks of Adversarial VR Game Design

Inferring Private Personal Attributes of Virtual Reality Users from Head and Hand Motion Data

Virtual Reality and Augmented Reality Security: A Reconnaissance and Vulnerability Assessment Approach

How Interactions Influence Users' Security Perception of Virtual Reality Authentication?

BehaVR: User Identification Based on VR Sensor Data

Privacy-Preserving Gaze Data Streaming in Immersive Interactive Virtual Reality: Robustness and User Experience

Low-effort VR Headset User Authentication Using Head-reverberated Sounds with Replay Resistance.

Zoom on the Keystrokes: Exploiting Video Calls for Keystroke Inference Attacks