XR-PRISM: Data-Driven Privacy and Risk Impact Scoring Metric for Extended Reality in Healthcare

Technical Summary: XR-PRISM

Problem Statement
Extended Reality (XR) technologies, encompassing Virtual Reality (VR), Augmented Reality (AR), and Mixed Reality (MR), are increasingly transforming healthcare through immersive training, remote consultation, and patient rehabilitation. However, the high-fidelity data pipelines required for these applications—integrating motion traces, physiological signals, biometric identifiers, and environmental context—introduce novel and severe security and privacy (S&P) vulnerabilities. While individual vulnerabilities have been documented, there is currently no unifying, quantitative framework to systematically assess these risks. Existing research often focuses on enterprise workflows or discrete user attributes, failing to address the unique characteristics of XR or to support both preventive and post-compromise evaluations. Consequently, healthcare deployments lack mechanisms to score combined safety and privacy impacts, and most proposed defenses lack rigorous, standardized risk evaluations.

Methodology
To address these gaps, the authors conducted a Systematization of Knowledge (SoK) based on a systematic literature review (SLR) of 65 peer-reviewed XR security and privacy studies published between 2017 and 2024. The review followed PRISMA guidelines, searching databases including IEEE Xplore, ACM Digital Library, USENIX Proceedings, and PubMed.

The methodology involved three primary steps:

1. Taxonomy Construction: The authors conceptualized the XR system pipeline as a four-layer architecture:
   • User Layer: Captures biometric and behavioral signals (gestures, voice, EMG, heart rate).
   • Device Layer: Handles sensor fusion, local rendering, and real-time preprocessing.
   • Network Layer: Manages encrypted transport channels (Wi-Fi 6E, 5G, BLE) for telemetry and video streams.
   • Cloud Layer: Provides remote compute for analytics, storage, and federated learning.
2. Threat-Defense Mapping: The study extracted and analyzed attack attributes (target layer, vector, adversary prerequisites, expertise required) and defense attributes (mitigation vector, overhead, efficacy, stage of deployment).
3. Metric Development: Based on identified gaps—specifically the lack of standardized risk evaluations and the predominance of preventative controls over recovery mechanisms—the authors developed a quantitative scoring framework.

Key Contributions
The paper makes three primary contributions:

1. Four-Layer Threat Taxonomy: A deconstruction of XR systems into Device, Network, User, and Cloud layers, classifying threats and countermeasures within each specific context.
2. Threat-Defense Analysis: A rigorous mapping of representative attack vectors (e.g., keystroke inference via IMU data, side-channel attacks via video, cloud code execution) against defenses, highlighting prerequisites, attacker expertise, and efficacy.
3. XR-PRISM (XR-Privacy and Risk Impact Scoring Metric): A six-factor, weighted metric designed to integrate security and privacy risks into a single actionable score. The framework utilizes a Multi-Criteria Decision Analysis (MCDA) approach with the following factors:
   • Threat Likelihood (L): Probability of an attack.
   • System Vulnerabilities (V): Severity of known flaws.
   • Attack Surface (A): Exposure of interfaces and sensors.
   • Safety Impact (Is): Potential for patient harm (weighted at 0.30).
   • Privacy Impact (Ip): Severity of Protected Health Information (PHI) leakage (weighted at 0.20).
   • Control Effectiveness (C): Strength of existing controls (subtracted from the score).

The formula for the RiskScore is:
$$RiskScore = L \cdot W_L + V \cdot W_V + A \cdot W_A + I_s \cdot W_{Is} + I_p \cdot W_{Ip} + (10 - C) \cdot W_C$$
Where weights ($W$) sum to 1.00, heavily prioritizing patient safety and data confidentiality.

Results and Findings
The analysis of the 65 studies yielded several critical insights:

• Attack Accessibility: Over 70% of documented countermeasures lack standardized risk evaluations. Furthermore, fewer than 15% of the analyzed attacks require high expertise to launch; the majority demand minimal privileges and modest expertise, suggesting XR systems are broadly exposed to relatively unsophisticated adversaries.
• Defense Imbalance: There is a predominance of preventative controls (blocking attacks) with a significant lack of mechanisms for detection, forensics, or automated recovery post-compromise.
• Layer-Specific Vulnerabilities:
  • Device Layer: Vulnerable to keystroke inference via motion sensors and avatar observation.
  • User Layer: Susceptible to side-channel attacks (e.g., "Hidden Reality" models) that infer data from indirect observations.
  • Network Layer: Exposed to wireless sniffing and virtual keystroke inference (e.g., VR-Spy).
  • Cloud Layer: Risks include unmediated access to body-tracking streams and potential poisoning of federated learning updates.
• Emerging Gaps: The study identifies underexplored areas in Machine Learning/Deep Learning threat surfaces (e.g., adversarial perturbations, model inversion) and Cloud-layer threats (e.g., side-channel inference on aggregated telemetry).

Significance
The paper claims to provide the first comprehensive systematization of knowledge specifically for XR privacy and security in healthcare. By introducing XR-PRISM, the authors offer practitioners a transparent, data-driven tool to prioritize and mitigate risks. Unlike standard frameworks like CVSS, XR-PRISM explicitly incorporates Safety Impact and Privacy Impact as distinct, heavily weighted factors, acknowledging that in clinical XR, a security breach can lead directly to physical patient harm or severe privacy violations. The metric allows organizations to move from qualitative assessments to quantitative prioritization, determining whether a threat requires routine monitoring, immediate mitigation, or emergency system shutdown. The authors note that future work will involve validating these scores against real-world case studies and practitioner feedback.