# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Inference-Based (Biometric) Authentication
#### 4.2.2 Behavioral Biometrics
: Reference, **HMD**: Head-mounted Display, **S**: User-/Usability/Security Study sample size, **A**:\%: Accuracy, **E**: Equal Error Rate, *** Scheme name not given by the author but given depending on the method used, **HTC**: V-HTC Vive, **HTC-VP**: HTC Vive Pro, **SG**: Smart Glass, **FLab**: Pupil Lab Eye Tracker, **PLab-IC**: Pupil Lab Infrared Crames, **FOV-12:5 [PERSON] et al. [134] suggested a head-tilt-based user authentication approach. They established their study, selected their task, and chose features from previous findings [135; 136]. Both works in [135; 136] concluded that head movements are among the most accurate features to distinguish users' movements during walking tasks. [PERSON] et al. designed a within-subject study and collected data from 10 recruited participants by directing them to move freely in a VR space for 5 min. They used four ML classifiers for training; SVMs and k-NN models' accuracy results were poor due to insufficient sample size. However, RF and Decision Tree (DT) classifiers resulted in high identity authentication accuracy, reaching above 95%. [PERSON] et al. [137] implemented VRCAuth, a novel continuous authentication scheme for VR HMDs using head movements' information. In their experimental setup, they studied two tasks for a VR driving simulator and a VR video-watching open-source datasets. The head movement information in both datasets was used to extract unique user signatures. Five binary ML classifiers were used for classification, and a comparative study was performed. The authentication accuracy results were promising and reached 99% with all ML classifiers when using the VR video-watching dataset. Similar results were achieved using the Logistic Model Tree (LMT) classifier for the VR driving simulator. They indicated their future interest in implementing a lightweight online version of their continuous authentication mechanism using a Capsule Neural Network (CapsNet) classifier. [PERSON] et al. [138] experimented with using head movement data for user authentication in VR. They built a VR application where users have to collect 25 balls from one target point to another and used it for data collection from 23 subjects. ML algorithms were used for authentication, and the Logistic regression (LR) model manifested a 7% EER outperforming the SVM model. Their approach used only head movement data without incorporating hand movement data, which represents realistic interactions. Hence, using a full range of body movement data in future works would more likely provide a closer representation of real-world interactions. They highlighted that their authentication approach is app-specific due to head movement data changes from one setting to another and pointed out their current efforts to design alternative frameworks based on DL techniques. Most of today's authentication mechanisms lack usability and are cumbersome due to the need for 2F authentication through smartphone use. [PERSON] et al. [139] designed Headbanger, a lightweight authentication system for head-worn devices, with the aim of providing a more usable and efficient alternative to the current authentication solutions. Head-banger monitors the distinctive patterns in head movement data after exposure to an outer phonographic stimulus. The authors collected head movement data from 28 participants performing head nodding activity in response to a short audio music cue. They custom-built a distance-based classifier and evaluated the accuracy and robustness of Headbanger through a series of usability and security evaluations. The results showed that Headbanger authenticates users with a 4.43% EER and is robust against imitation attacks. [PERSON] et al. [140] investigated both AR and VR user identification using user unmanual and bimanual hand-tracking data. The authors collected data from 16 volunteers interacting in AR and VR environments using eight different interaction modalities: button, slider, slate, context menu, reposition, rescale, unimanual keyboard, and bimanual keyboard.