DEA 5503 Research Proposal

Finding an optimal authentication method for different age groups in Virtual Environments: Focusing on user experience and information security Nayeon (Nancy) Kwon Cornell University nk434@cornell.edu Abstract The pandemic has increased our internet and virtual reality (VR) usage by significantly decreasing human contact. Almost all ages now utilize VR in his or her lives. With the increase in the internet and VR usage, there is a need to increase the information security of the internet world through a secure authentication method in the virtual environment with greater user experience possibility. This research tests four different authentication methods (textual password, graphical password, 3DPass, 3D Password) on four age groups {10 ~ 17 (adolescent), 18 ~ 25 (younger adults), 26 ~ 50 (adults), and 50+ (elderly)} in a virtual reality environment to find the optimal authentication method for each age group.

Keywords: Virtual environment, Authentication method, Age, User experience, Information security, Spatial memory

Introduction With the pandemic limiting human contact, people have been directed more and more towards using the internet; it could be used for work, connection, or even to pass the time when staying home. For instance, after their online classes, children now use virtual reality (VR) to play games like Beat Saber. Adults often have meetings in a virtual environment to feel like they are more cohesive than the simple zoom screen. This increase in demand for online features also led people, both young and old, to look into the venue of a virtual world instead of real-life environments. They started having meetings in virtual environments, meeting new people on VR chat programs, or even

playing games with a VR device like Oculus Rift. The virtual world and the environment creating it has thus become a crucial element in modern society. As it is often used for communication and relaxation, users seek an excellent user experience with comfort and pleasure from the virtual world.

On the other hand, information security is also a primary concern for modern-day citizens regardless of age. As internet usage increased, the percentage of crucial information exchange on the internet increased as well. Important information, such as one’s hospital records, passport numbers, or even banking information, is sent in data format, easily hacked without proper security measures. The appropriate security measures include having a secure authentication method to confirm whether the current user should or should not be having access to the critical information.

Combining the two modern changes to our world, we can conclude that we need an authentication system within the virtual environment, which secures the user’s information security and preserves their user experience. Also, as a wide range of age groups - with different abilities and concerns (e.g., eyesight, concentration levels, spatial memory ability, flexibility, etc.) - use the virtual environment, finding the most efficient and comfortable authentication would be helpful. For instance, “adults of all ages experience problems in holding multiple authentication codes in memory,” yet they have a similar level of recognition of known faces compared to younger adults (Nicholson et al., 2013). Therefore, this research study aims to find the optimal authentication method for each of the different age groups in virtual environments, focusing on their user experience while using the authentication method and the authentication method’s level of information security to assess the methods.

Authentication method: The four types An authentication method is used to “protect any system […] so that only authorized persons can have the right to use or handle that system & data related to that system securely” (Raiguru & Ramteke, 2014). It should have the possibility to “generate a large number of passwords which are not easy to guess or predict [yet are also] usable”

(Gurary et al., 2017) where the user needs “minimal time and effort [with] memorable” (Gurary et al., 2017) passwords.

For the research study, I will be focusing on four different types of authentication methods with a mix of traditional methods and recent methods from various research studies: textual password, graphical password, 3DPass (Gurary et al., 2017), and 3D Password (Warnekar & Mulchandani, 2015).

A textual password is one of the most traditional authentication systems. It is a password made of words and letters. They have the advantage of familiarity, being the most often used type of authentication for most people. However, there are severe weaknesses in its’ information security, as “users tend to choose meaningful words from dictionaries, which make [them] easy to break and vulnerable to […] brute force attacks” (Kognule et al., 2012).

On the other hand, graphical passwords have an advantage over textual passwords by being easier to memorize and identify than words (Warnekar & Mulchandani, 2015) as they are in image formats. This idea follows the “picture superiority effect” (Gurary et al., 2017). However, it is “vulnerable to shoulder surfing attacks” (Warnekar & Mulchandani, 2015) – which means that it is also easier for anyone to see the image, memorize it as easily as the authorized user, and steal it.

3DPass is a password made using navigation and movement through an interactable 3D space. (For example, the user can generate a password by going into space A and turning the lights on.) It works on memorability and usability through spatial memory, presence, context, and episodic memory. Spatial memory works with spatial cognition and experience-based information stored in the user’s memory (Oprean et al., 2014).

Presence is the notion of feeling like being within the environment – feeling used to being in the space enough to create similarity in reality and within the virtual environment (Gurary et al., 2017). Episodic memory creates fact-based memories, and context refers to the learned behavior from a familiar environment (Gurary et al., 2017).

Lastly, a 3D Password is a password made of a combination of all the other passwords. It has a 3D environment with multiple objects that the user can manipulate.

It has “recognisation + recalls + tokens + biometric” (Warnekar & Mulchandani, 2015) passwords in one system, which gives the advantage of flexibility in the types of passwords, strength in the number of possibilities of passwords, ease in memorizing, and security. However, it has disadvantages of being a long process, being more costly, complex, and need higher storage space (Warnekar & Mulchandani, 2015).

Measuring User experience / Usability & Information Security User experience and usability include standards like memorability and ease of usage.

These values can be measured by measuring the time spent in the environment (shows understandability), how many times they have gotten distracted from the task (shows usability by concentration on the task), and by having the user take a survey on the user experience (how comfortable space was). Information Security can be measured by analyzing “how hard it is for the attacker to break” (Alsulaiman et al., 2008) the system – through a security analysis by literature review.

Hypothesis Considering the different memorability and flexibility of adults and younger adults, I believe that the younger adults will have an advantage with the more recent 3DPass and 3D Passwords methods. In comparison, older adults will have an advantage in textual or graphical passwords.

Method Experiment Design: Rooms The 3D virtual environment would look like a series of rooms from a room escape game, yet with a more homely design to ease the participants. Each room will contain a

different authentication method. For the textual password room, there will be a door with a slot to type in the passcode (figure 1).

Figure 1: Example image for textual passcode room

For the graphical password room (figure 2), all four sides of the walls will be full of similar images.

Figure 2: Example image for graphical pattern room

For the 3DPass room (figure 3), there will be 3 rooms, each labeled A, B, and C. There will be a lightbulb and a switch in each of the rooms, which the user can operate.

Figure 3: Example image for 3DPass room For the 3D Password room (figure 4), there will be all of the above elements, with a word-password puzzle, a wall full of images, and interactable lightbulbs.

Figure 4: Example of 3D Password room

Experiment Design: Population sample & Data Collection For the research, I will try to gather 25 randomized samples from groups of ages 10 ~ 17 (adolescent), 18 ~ 25 (younger adults), 26 ~ 50 (adults), and 50+ (elderly). Each participant will begin with a pre-questionnaire (collecting caffeine consumption and sleep amount as confounding variable) and a Corsi test (Brunetti et al., 2014) to measure the participant’s visuospatial memory and spatial attention capacity.

Afterward, the participants will use an Oculus Quest device to see the virtual environments. Before viewing each room (which will be shown in a randomized order to avoid learning effect), the participant will be shown a screen of instructions (e.g., turn the lights off in room B and turn the lights on in-room C – for 3DPass room) for as long as they want. Then, they will complete the tasks, while the time taken for each task and distractions away from the tasks will be measured.

After escaping the four rooms, the participant will be asked to re-escape them, yet without being shown the instructions this time. (This step helps to show which method has been easier to learn, regardless of how long it took on the first trial, which may have struggled in using the technology for the first time.) The time spent and the number of distractions in each room will be measured again.

After the experiment, the participant will survey the level of comfort they felt in each room and their preferences.

Conclusion/Discussion This research is significant as it provides an opportunity for us to learn how to increase user experience and information security for different age groups through optimization of authentication method, which is crucial as virtual environment use expands more and

more. By learning which authentication method is optimal, we can apply the methods to diverse locations. For example, we can apply it to “ATMs, personal digital assistants, desktop computers and laptop logins, […] web authentication” (Alsulaiman et al., 2008), and mobile authentication (Gurary et al., 2017) in a smaller, more personal scale, and building entrances, “nuclear and military facilities, airplanes and jetfighters” (Alsulaiman et al., 2008) in the bigger, societal scale as well.

References [1] Alsulaiman, Fawaz & El Saddik, Abdulmotaleb. (2008). Three-Dimensional Password for More Secure Authentication. Instrumentation and Measurement, IEEE Transactions on. 57. 1929 - 1938. 10.1109/TIM.2008.919905.

[2] Brunetti, R., Del Gatto, C., & Delogu, F. (2014). eCorsi: Implementation and testing of the Corsi block-tapping task for digital tablets. Frontiers in Psychology, 5, 939. https://doi.org/10.3389/fpsyg.2014.00939 [3] Gurary, J., Zhu, Y. and Fu, H.R. (2017) Leveraging 3D Benefits for Authentication.

Int. J. Communications, Network and System Sciences, 10, 324-338. https://doi.org/10.4236/ijcns.2017.108B035 [4] James Nicholson, Lynne Coventry, Pam Briggs, Faces and Pictures: Understanding age differences in two types of graphical authentications, International Journal of Human-Computer Studies, Volume 71, Issue 10, 2013, Pages 958-966, ISSN 10715819, https://doi.org/10.1016/j.ijhcs.2013.07.001. (https://www.sciencedirect.com/science/article/pii/S1071581913000840) [5] Kognule, T.M., & Kognule, S.M. (2012). 3D PASSWORD. [6] Oprean, D. (2014). Understanding the immersive experience: Examining the influence of visual immersiveness and interactivity on spatial experiences and understanding. Submitted by the University of Missouri--Columbia Graduate School.

[7] Oprean, D. & Balakrishnan, B. (2020). From Engagement to User Experience: A Theoretical Perspective Towards Immersive Learning. In M. Schmidt, A. A. Tawfik, I. Jahnke, & Y. Earnshaw (Eds.), Learner and User Experience Research: An Introduction for the Field of Learning Design & Technology. EdTech Books. https://edtechbooks.org/ux/10_from_engagement_t [8] Rajguru, G., & Ramteke, P. (2014). Secure Authentication with 3D Password.

Academia.edu. Retrieved from https://www.academia.edu/6979070/Secure_Authentication_with_3D_Password_.

[9] Warnekar, C., & Mulchandani, N. (2015). Secured Authentication with 3-D Password.

Ijert.org. Retrieved from https://www.ijert.org/research/secured-authentication-with-3-dpassword-IJERTCONV3IS24016.pdf.

Image sources: Figure 1: Escape: The world of puzzles passing all levels. Escape: World Puzzles Passing All Levels Complete 4 Game Level. Chess-progress.ru. Retrieved 26 May 2021, from https://chess-progress.ru/en/instrumenty/pobeg-mir-golovolomokprohozhdenie-vseh-urovnei-pobeg-mir.html.

Figure 2: Decorating our Walls! - Ed Unloaded.com | Parenting, Lifestyle, Travel Blog.

Ed Unloaded.com | Parenting, Lifestyle, Travel Blog. (2011). Retrieved 26 May 2021, from http://edunloaded.com/everyday-life/decorating-our-walls/#.

Figure 3: Edited with Photoshop from The Better Light Bulb Debate. Business Ethics.

Retrieved 26 May 2021, from https://business-ethics.com/2011/09/05/7721-the-betterlight-bulb-debate/. And How many escape rooms are there in the world? - SolvePrague.

SolvePrague. Retrieved 26 May 2021, from https://solveprague.cz/blog/2019/02/26/how-many-escape-rooms-are-there-in-theworld/.

Figure 4: Jankovic, V. New 50 Rooms Escape | Rooms 11 to 15 Walkthrough. BMG. Retrieved 26 May 2021, from https://www.bluemoongame.com/walkthrough/new-50rooms-escape-game/11-12-13-14-15-walkthrough/.