BlinKey

Abstract

Virtual Reality (VR) has shown promising potentials in many applications, such as e-business, healthcare, and social networking. Rich information regarding user's activities and their online accounts is stored in VR devices. If it is carelessly unattended, then attackers, including insiders, can make use of the stored information to, for example, perform in-app purchases at the legitimate owner's expenses. Current solutions, mostly following schemes designed for general personal devices, have been proved vulnerable to shoulder-surfing attacks due to the sight blocking caused by the headset. Although there have been efforts trying to fill this gap, they either rely on some highly advanced equipment, such as electrodes to read brainwaves, or introduce heavy cognitive load that has users perform a series of cumbersome authentication tasks. Therefore, an authentication method for VR devices that is robust and convenient is in dire need. In this paper, we present the design, implementation, and evaluation of a two-factor user authentication scheme, BlinKey, for VR devices that are equipped with an eye tracker. A user's secret passcode is a set of recorded rhythms when he/she blinks, together with the unique pupil size variation pattern. We call this passcode as a blinkey, which can be jointly characterized by knowledge-based and biometric features. To examine the performances, BlinKey is implemented on an HTC Vive Pro with a Pupil Labs eye tracker. Through extensive experimental evaluations with 52 participants, we show that our scheme can achieve the average EER as low as 4.0% with only 6 training samples. Besides, it is robust against various types of attacks. BlinKey also exhibits satisfactory usability in terms of login attempts, memorability, and impact of user motions. We also carry out questionnaire-based pre-/post-studies. The survey result indicates that BlinKey is well accepted as a user authentication scheme for VR devices.

Recent Trends of Authentication Methods in Extended Reality: A Survey

“…In [176], Zhu et al proposed BlinKey, a two-factor VR authentication scheme based on the user's blinks as a password and pupil size as a biometric trait. They investigated the accuracy of BlinKey through extensive evaluations using four different ML classifiers and concluded that the k-NN classifier achieved the best results with a 0.04% EER and the shortest training time.…”

Usable Authentication in Virtual Reality: Exploring the Usability of PINs and Gestures

“…There exists a reciprocal relationship between usability and security [49]. When security is prioritized, usability may suffer.…”

“…In 2009, Hansen et al [17] reviewed gaze-based studies from the past 30 years and proposed that gaze features have unique characteristics that could be utilized for authentication. Eye movements, blinking, velocity, and other behaviors are distinctive [11,28,41,49] and can be used successfully to authenticate users. However, these biometric features demand a high cognitive load and are less user-friendly.…”

“…Therefore, an implicit and smooth authentication process is essential for VR. Research conducted by Zhu et al [49] found that if security measures are too stringent, usability tends to suffer. Overly complex passwords may increase security (in the short run) but lower usability and userfriendliness, prompting possible evasive user behavior (e.g., writing them down).…”

Virtually secure: A taxonomic assessment of cybersecurity challenges in virtual reality environments

“…Of particular interest is Blinkey [116] because it employs two-factor authentication using both knowledge-based and biometrics. The biometric feature involves creating a password based on the user's blink pattern which can be stimulated by a music rhythm.…”