CoordAuth

A Two-factor Authentication Method in Virtual Reality Leveraging Head-Eye Coordination

CoordAuth revolutionizes the popular 3x3 grid pattern unlock interface with a hands-free, gaze-based approach. You only need to gaze wherever you want to draw.

A demo and a storyboard.

CoordAuth is a two-factor authentication technology in VR/AR/MR, under any seneriors of wearing a HMD. This innovative two-factor authentication system combines knowledge-based (Pattern Match) with behavioral biometrics for enhanced security and ease of use.

Authentication algorithm design of CoordAuth.

CoordAuth opted for goal-crossing strategy for hit-test detection.

(a) Parameters for the hit test region. (b) Selection of targets based on goal crossing.

CoordAuth would further leverages eye trackers and IMU data, and segmenting it into saccades and fixation to refine user verification.

Time series data for a participant. Left is Yaw angle, middle is Pitch angle and right is Roll angle. Grey intervals represent fixation segments during drawing.

CoordAuth employs Random Forest algorithm for both the saccade classifier and the fixation classifier. And further incorporates Voting Neural mechanism for final verification.

Implementing this design, CoordAuth not only delivers rapid verification times (M=3.26s, SE=0.05s, 1280 experiment trials), but also achieves low FRR and FAR. What’s better, in the long term, CoordAuth’s performance is still good.

Data Source FAR (\%) FRR (\%)
Day 0 0.0 (SE=0.0) 0.0 (SE=0.0)
Day 3 1.6 (SE=0.1) 11.4 (SE=3.0)
Day 7 (Unchanged Classifier) 2.6 (SE=0.2) 12.6 (SE=3.7)
Day 7 (Retrained Classifier) 0.32 (SE=0.01) 2.73 (SE=0.11)

Beyond its immediate benefits, CoordAuth demonstrates enduring effectiveness and robustness against various contextual factors, such as the user’s posture (like sitting and standing), and offers strong resistance to shoulder surfing attacks.

Attack's view when trying to attack CoordAuth via shoulder surfing.

We submitted our work to UbiComp24’, and I am glad to have contributed CoordAuth equally with Alexzhao