# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 5 XR for Usability Studies & Device Pairing
### Device Pairing in XR  
The body of work on the topic of device pairing in XR is still small, and to the best of our knowledge, four known techniques exist to assist in the secure pairing of AR devices. These techniques take advantage of the built-in functionality that allows a user to wear a device and watch other users in an augmented space. First, [PERSON] et al. implemented Looks Good to Me (LGTM) [194] and paved the way for effective approaches for AR devices' pairing. To pair AR devices and authenticate shared keys, LGTM incorporates AR-friendly technologies like facial recognition paired with wireless localization. The LGTM cannot be evaluated against any other suggested approaches since the wireless localization hardware has never been deployed on any implemented AR devices. The other three techniques [195; 196; 197] require physical interaction and an Out-Of-Band (OOB) communication channel for pairing. HoloPair [195] proposed a mechanism that calls for the creation of a local secret on a device, followed by the generation of a public key, then the transmission of the key to a pairing partner, and finally the authentication of the key. For key validation, both users are required to outline the hologram created from the shared keys and wave while the outlined keys are being transmitted as a preventive measure to \begin{table}
\begin{tabular}{|c|c|l l l l l|} \hline _Concept_ & **Ref.** & **Year** & \multicolumn{2}{c|}{**Scheme Name**} & \multicolumn{1}{c|}{**Input Method**} & **HMD** & **US** & **SS** & **A\%. SUS** \\ \hline \multirow{6}{*}{
\begin{tabular}{} \end{tabular} } & \multirow{3}{*}{2022} & \multirow{3}{*}{2022} & Traditional & Traditional keypad & \multirow{3}{*}{202} & \multirow{3}{*}{25} & 84.5 (SUS) \\  & & & Glass UnlockAR* & & AR private keypad layout/traditional keypad & & & 71.2 (SUS) \\  & & & Hand MenuAR* & & Hand-attached AR keypad/mid-air input & & & 90.5 (SUS) \\  & & & TapAR* & & Fingerprints-attached AR digits/pinch and tap gestures & & & 50.3 (SUS) \\ \cline{2-7}  & & [91] & 2022 & RepliAT/ColorFin* & Keyboard/ keypad & & & \\ \cline{2-7}  & & & KeyadAuth* & & Keyboard, controller’s laser for pointing and trigger for selection & & \\ \cline{2-7}  & & & Floor FeetAuth & & & & \\ \cline{2-7}  & & Spatial FeetAuth & & & & & \\ \cline{2-7}  & & & Egocentric FeetAuth & & & & \\ \cline{2-7}  & & [189] & 2021 & RepliCueAuth & & Touch gestures & & & 89.97 \\ \cline{2-7}  & & & Mid-air gestures & & & & 80.42 \\ \cline{2-7}  & & & Eye gaze pursuits & & & & 83.75 \\ \hline \end{tabular}
\end{table} 
Table 10: Summary of usability studies using VR. avoid attacks. To speed up the pairing process, HoloPair permits users to just accept the hologram verification with no consideration for accuracy, which may possibly compromise the security of the protocol. Also, HoloPair makes no claims about the feasibility of its protocol for more than two user pairing scenarios. HoloPair's pairing times are between 8 and 9 s, an effectiveness target that pairing solutions should aim to reach. [PERSON] et al. proposed Tap-Pair [196]. Their prototype enhances HoloPair by lowering the standards of user interaction. For selection, it is necessary that two AR users direct their heads toward the same physical position. Tap-Pair is limited because it does not permit the use of windows in a physical position. The original HoloLens could recognize the head orientation but had no eye-gaze tracking. Tap-Pair theoretically supports the idea that it can accommodate several users, despite not trying to test or develop such a solution. The most current work, GazePair, proposed by [PERSON] et al. [197], requires less user movement than the two previous techniques. The pairing initiator is required to speak a key sequence cue of any length and employs eye gaze, where users focus their gaze at a holographic target. The opaque visor on the majority of AR devices makes GazePair's technique partially hidden from observers, and it extends to more than two users, unlike the previously mentioned techniques.