Securing Shared State in Multi-User Augmented Reality

In multi-user AR experiences, some form of shared state is needed to save the state of the application and propagate it to the participating devices. Examples of shared state include Google ARCore’s CloudAnchors, which are stored in the Google Cloud, or Mapillary’s crowd-sourced street view data that could power future AR experiences. In this position paper, we highlight attacks that can disrupt the shared state and result in adverse impacts on users, such as causing workers to view incorrect AR safety signs in construction zones. We summarize possible mitigations at the data input, cloud storage, and output sides, and touch on their deployment challenges.