Researchers have demonstrated a new password authentication technique for use in virtual reality (VR) settings, which allows users to choose directions rather than numbers. The approach supports the same number of possible combinations as a six-digit numeric password, but is much easier for users to remember.

“Passwords are a widely-used element of the authentication process, giving users privacy and security,” says Yuxuan Huang, first author of a paper on the work and a postdoctoral researcher at North Carolina State University. “However, people often forget passwords or choose ones that are easy to remember, but less secure.

“Immersive VR environments offer another approach, using directions or interactions with the environment in lieu of numbers and letters when entering a password,” says Huang. “This approach allows users to make use of their environmental context to help remember the password. Our goal was to make use of this approach to develop an authentication process that is memorable, but that also provides users with an efficient log-in process.”

The new authentication technique is called Adaptive Direction-Based Authentication (ADBA). It works by placing the user in six different environments, one after another. In each environment, the user selects one of ten different directions. Each direction corresponds to a number.

When it is time to log in, users enter the virtual environment and can opt to either choose directions in the six environments – which is easy to remember – or to punch in the six-digit passcode – which is faster.

“The coolest thing about the method is that one password works two ways,” says Qiao (Georgie) Jin, co-author of the paper and an assistant professor of computer science at NC State. “You create it by picking spots in six 360 degree scenes, so it’s easy to remember. But each spot secretly maps to a random digit, so you can’t pick something weak like 123456. And once you know it well, you can skip the scenes and just type the digits. So instead of forcing a tradeoff between memorable and fast, ADBA gives you memorability first and lets speed come later.”

To evaluate the new authentication technique, the researchers recruited 66 study participants between the ages of 18 and 74. Study participants were split into three groups, each of which was given a different authentication technique. One group was asked to create a password using ADBA; one was asked to create a 6-digit conventional password; and one group received a randomly assigned 6-digit password.

The study consisted of a “low-frequency” log-in period and a “high-frequency” log-in period. During the low-frequency period, participants were asked to enter their password twice over the course of 12-16 days, with the two entries 6-8 days apart. During the high-frequency period, users entered the password four times over the course of 4-8 days, with the entries 1-2 days apart.

“One of the things that stands out about this study is that we had people participate in the study remotely, instead of having them come to the lab,” says Huang, who is part of Jin’s Extended Horizon Lab at NC State. “We wanted people to interact with the technology in a setting that is more consistent with their regular lives. This sort of ecological validity is important for user experience research.”

One key finding from the study is that people in the ADBA group outperformed the other groups when it came to remembering their passwords.

“In addition, people in the ADBA group reported feeling that the password was easier to remember,” says Huang. “So, both objective and subjective results supported ADBA having better memorability.”

From an efficiency standpoint, the ADBA method of entering a user’s password was slower than techniques that relied purely on numeric passwords. However, study participants reported that the ADBA authentication technique was more efficient. This was because study participants in the other groups more frequently forgot their passwords or needed multiple attempts to log in.

“ADBA took about five times longer to enter than a PIN, and people could have switched to the faster digit option anytime, but nobody did,” says Jin. “Study participants in the ADBA group uniformly opted for choosing directions when logging in. They actually rated it as more efficient, because they never forgot it – no failed attempts, no struggling to remember.

“Our findings also highlight how important it is to select the environments carefully that users interact with during the authentication process,” says Huang. “The environments need to have enough visually specific detail that people can remember the appropriate direction, but you want them to be sufficiently uniform that it would not be obvious to other people which direction they would choose.

“We’re excited about the potential this technique holds for making secure authentication in VR technologies more user friendly,” says Huang.

The paper, “Context or Digits? Balancing Memorability and Efficiency in Virtual Reality Authentication,” will be presented at the 32nd ACM Symposium on Virtual Reality Software and Technology (VRST), being held Nov. 16-18 in Sendai, Japan. The paper was co-authored by Tongyu Nie, Victoria Interrante and Evan Suma Rosenberg of the University of Minnesota.