AuthVR: Securing authentication against shoulder surfing and keystroke inference attacks using virtual reality

Abstract

Passwords serve as the primary authentication mechanism for knowledge-based systems, facilitating user access across a diverse spectrum of applications. Although password-based authentication is commonly employed in high-security environments such as security checkpoints and central control and command systems, it remains susceptible to fraudulent activities, e.g. shoulder-surfing and inference attacks (via direct observation, eavesdropping, or recording) particularly in public or monitored spaces equipped with CCTV cameras. In this paper, we present AuthVR, a Virtual Reality (VR) enabled authentication mechanism creating an additional layer of security in such high-security environments, significantly enhancing existing systems' security. Using Design Science Research Methodology, we assess potential threats and establish the system requirements. We present the architecture, its detailed protocol flow, validate its security through a formal analysis using ProVerif and provide a thorough analysis of the proposal's probable resistance against a number of attack vectors. Additionally, a user study is conducted to evaluate the usability and practical aspects of the system showing a positive impression towards the system.