The Investigation Of The Safety Level Of Augmented Reality

Introduction

Augmented Reality is the use of computer graphics to alter a perceived image for a user. These alterations can be used to do anything from creating playful cartoon animals to entertain children, to displaying custom tailored advertisements for users as they explore new places. Augmented Reality can be similar to Virtual Reality from a graphical standpoint, but there is one key characteristic that differentiates the two. Virtual Reality creates an entirely computer-generated viewpoint for a user to experience. These images are not bound to the user’s surroundings. Augmented Reality however, uses images to modify what the user already sees. This characteristic can pose some serious security threats if not dealt with properly. But before we dive into security, let’s first go over a brief history of Augmented Reality, and its impact on modern society.

The term, “Augmented Reality”, was coined by Tom Caudell in 1990. Caudell was a researcher for Boeing, a leading aircraft manufacturer. He used the term to describe the digital display that was being used by aircraft technicians to project virtual graphics onto their physical viewpoints. While this may be the first time we heard the term, “Augmented Reality”, its history and development actually go back several decades. In 1968, the world’s first head mounted display system for Virtual and Augmented Reality was created at the University of Utah. With the help of his student, Bob Sproull, professor Ivan Sutherland developed the Sword of Damocles. The system was so heavy that it wasn’t actually worn, rather it was hung from the ceiling over the user’s head. The graphics and user interface were very basic but served as a foothold for where the technology might go. In 1974, Doctor Mryon Krueger began doing research for the University of Wisconsin-Madison. While working, the university provided “institutional support” for what would become his major work, “Videoplace”. Videoplace was a virtual room, or set of rooms, where users would see projected images of themselves, as well as any other users in connected “rooms”. Utilizing a series of cameras and projectors, Videoplace created an augmented visual representation of the user’s surroundings and allowed the users to interact with the other user’s images. While it was mainly used for art and educational purposes, Videoplace showed great innovation for its time.

Both of the systems discussed were very early representations of the technology, but in 1992, the world’s first fully immersive Augmented Reality system was developed. At Brooks Air Force Base in San Antonio, Texas, Louis Rosenberg created “Virtual Fixtures”. Instead of using images to alter the user’s surroundings, Virtual Fixtures was designed to use Augmented Reality to give a human the controls to a robot by projecting a first-person viewpoint of the robot onto the user’s headset. While wearing the headset, the operator also wears a controller exoskeleton. This device was used as an input controller for the robot. The user in sense sees what the robot sees, while the robot does what the user does. It’s a beautiful combination of graphical user interface and real time robotics controlling. The result not only allows the user to see things differently, but also be able to interact with the real world on a physical level not possible for human bodies.

As newer developments in computer graphics, as well as faster network transmission speeds, arise, the uses for Augmented Reality have the potential to be world altering. But in order to provide a system that is safe and reliable, those who develop such systems must pay close attention to possible security threats. Considering the wide scope of applications, security must be a top priority in all levels of research and development.

Applications

In this section, I will be covering the types of applications used today that utilize Augmented Reality, as well as giving some examples of currently used systems. Some applications are completely dependent on Augmented Reality, while others only use it in small amounts to aid a mostly real image. One recent success in mobile gaming is a perfect example of the former. In July 2016, game developer and publisher, Niantic, released the mobile game, Pokémon Go. Using the camera on the user’s phone, Pokémon Go projects animated creatures onto the user’s surroundings in real time. To do this, the game is utilizing location-based tracking, as well as the onboard graphics of the user’s cell phone. The game was downloaded over 500 million times and was a huge topic in popular culture. This means that hundreds of millions of users have, in some way, experienced Augmented Reality from a single provider.

Medical professionals use Augmented Reality in conjunction with advanced medical images to provide a sense of X-Ray vision. To a lower extent, medical imaging is often accompanied with some form of AR in real time for mapping of blood vessels and bone structures. The potential for life saving techniques to be discovered and implemented using AR gives plenty of reason to research it extensively.

Another example that affects millions of people is the graphical overlays used in sports broadcasting. For example, the NFL uses a computer generated yellow line to represent the line of scrimmage. This system is called 1rst and ten and has been in use since 1998. As the team makes progress down the field, viewers at home are treated to a visual line on their screen. In the MLB, a pitching box has been implemented for years now. These are both examples of very minimal augmentations, but an Augmented Reality all the same. While not currently a “security risk”, the accuracy of these elements can be a headache for viewers at the very least.

When most people think of Augmented Reality, there is one major market electronic that never fully came to fruition do to various privacy and security concerns. Google Glass is the perfect example of AR being introduced into our daily lives. Google Glass behaves like glass, but it projects information and data directly onto the lens. This alters the wearers perception of their surroundings. However, because Google Glass is a real time AR device that must verify user permissions and security protocols on the fly, it poses many security threats that must be handled before a mass-produced product would be reasonable. Other common uses for AR technology today include Augmented Reality web browsers, “Virtual Tour” features utilized by online retailers and educational software designed to teach mechanical processes to technicians at car dealerships. Noting the type of data these systems access and the methods they do so can help us prevent serious attacks.

Security

Augmented Reality has the potential to unlock new ways for us to interact with the physical world around us, as well as the virtual data surrounding us. The rapid access manipulation of this data is paramount for a system to run smoothly and efficiently. In order to project information relevant to each user, these systems must utilize information gathered about the user, and authorize different apps and services to display information. Because of all this network traffic, there remain security risks that must be analyzed before adopted by the mass market.

There are a number of ways that attackers may take advantage of someone utilizing an AR platform in public. For instance, attackers will often attempt to disguise malicious content as something safe such as a restaurant menu. While the AR device may project the image of the menu on the users display, the data behind that image could be dangerous. This is known as an ad attack. “Ad Attackers” take advantage of third party applications and trick the AR channel into accessing their malicious content.

Certain security threats are made apparent due to negligence of the user. For example, if a user forgets to turn off certain AR applications can lead to constant location tracking of an unaware user. This data is in turn made available to applications associated with the appropriate AR channel. Simple failsafe mechanisms can be incorporated to minimize this type of risk. The dependence on network access to provide AR overlays in wearables poses one of the biggest security threats affecting Augmented Reality. Different websites have different permissions based on user input. So, in theory, your permission is needed for a site to access personal information such as location. The issue is that webpages can be created with the intent to hijack the user’s access rights without the user’s knowledge. While most of these types of attacks are confidentiality based, another serious threat is one of integrity. Because of the graphical nature of AR, these design elements may be taken advantage of by a hacker. For example, I may walk into a mall wearing Google Glass, and a notification from a trusted application appears on my display. I chose to access this data because it appears to be visually accurate to the design elements of that application. However, it turns out to be a virus that only needed me to authorize it to work. So, while the user may have intended to open a notification from their favorite social media application, what they actually opened was a virus. The visual representation of such applications can be misleading and lead users to giving away their information without their knowledge. Attackers may also hide their content close to that of other visual elements in the hope you will accidentally click them by mistake. These types of attacks are called clickjacking attacks.

Another serious security risk is the ability of businesses to potentially influence what is displayed on peoples’ displays. For instance, a company may purchase advertising rights so aggressively, that they in sense block out a competitor. While the user may be interested in what company B offers, company A spends enough on marketing that they are the only product visible. While this form of security flaw doesn’t affect the user’s personal information or property, it does influence them based on information somebody else paid for. This is a form of availability attack. A secure AR system shouldn’t hide valuable information based on paid privileges. This idea poses an important question. How does the AR device prioritize data and display the most appropriate information? Ensuring that what is displayed is relevant to the user’s history, and not just a paid advertisement will produce a system that produces unique displays for different users. An important thing to realize is that not all attacks need to be done at a software level. For example, I may own a coffee shop that isn’t getting a whole lot of business. I can pay a group of people to attend my shop with their location services active. Even if they don’t purchase anything, the location tracking will indicate a high traffic flow at my shop. This traffic information is in turn processed by Google and represented on Google maps. Someone else using Google Glass may receive a recommendation to visit my coffee shop based off of foot traffic that was falsely created by the coffee store. Again, this isn’t a serious attack on user information, but it still effects the reliability of the information displayed by AR systems.

Conclusion

Augmented Reality has the potential to revolutionize the way we interact with the world around us. Possibly to an extent never accessible to mankind. Unfortunately, with great power comes great responsibility. The proper security techniques must be implemented to protect users’ information. Wearable devices utilizing AR technology can in sense turn us into walking data storages. This data is being transmitted between device and server in real-time. The ability to intercept and manipulate these transmissions is the core security issue facing the technology. The teams in charge of developing such technology must incorporate safeguards protecting the confidentiality, integrity and availability of the data we use and send. The risks are numerous, but the potential that Augmented Reality provides is too good to ignore. By implementing fast and secure authentication and preventing attackers from taking advantage of back doors, we can create an AR environment that is both safe to use, and effective in providing accurate information to be displayed. The security risks of the internet itself are glaring and numerous, but the capabilities of the world wide web are too vast to be ignored because of security risks. As time goes on and new security threats are exposed, more resources will be allocated to combat these issues. I hope in the near future that Augmented Reality will be incorporated more frequently into our daily lives. From automobile heads-up displays to wearable electronics, AR is coming fast, and it is here to stay. As long as we are aware of its strengths and weaknesses, we will be able to properly utilize its power to better suit our needs.