Medusa3D: The Watchful Eye Freezing Illegitimate Users in Virtual Reality Interactions

• Published in: Proceedings of the ACM on human-computer interaction 2024-09, Vol.8 (MHCI), p.1-21, Article 270
• Main Authors: Jiao, Aochen, Duan, Di, Xu, Weitao
• Format: Article
• Language: English
• Subjects: Authentication; Human-centered computing; Security and privacy; Security services; Ubiquitous and mobile computing; Ubiquitous and mobile computing systems and tools
• ISSN: 2573-0142; 2573-0142
• DOI: 10.1145/3676515

The remarkable growth of Virtual Reality (VR) in recent years has extended its applications beyond entertainment to sectors including education, e-commerce, and remote communication. Since VR devices contain user's private information, user authentication becomes increasingly important. Current authentication systems in VR, such as password-based or static biometric-based methods, are either cumbersome to use or vulnerable to attacks such as shoulder surfing. To address these limitations, we propose Medusa3D, a challenge-response authentication system for VR based on reflexive eye responses. Unlike existing methods, reflexive eye responses are involuntary and effortless, offering a secure and user-friendly credential for authentication. We implement Medusa3D on an off-the-shelf VR and conduct evaluations with 25 participants. The evaluation results show that Medusa3D achieves 0.21% FAR and 0.13% FRR, demonstrating high security under various ocular conditions and resilience against attacks such as zero-effort attack, replay attack, and mimicry attack. A user study indicates that Medusa3D is user-friendly and well-adopted among participants.