# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Multifactor and Multimodal Authentication  
A minimum of two authentication factors are necessary for authentication systems to be deemed robust. Elements might be things the user is, creates, owns, or knows, such as a fingerprint, a signature, a token, and a PIN, respectively. We examined 18 studies on multifactor and multimodal schemes and mechanisms and briefly mapped them according to their implementation requirements and accuracy results. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline _Concept_ & **Ref. ** & **Year** & **Scheme Name** & **Classifier** & **Features** & **Equip. ** & **Sample** & **Av(EER)** \\ \hline \multirow{4}{*}{**Ref. : References, HMD: Head-mounted Display, Study sample size, GG: Google Glass, \(\frac{\text{\text{\text{\text{\text{\text{\text{\text{\text{\text{\text{\text{\  
In [172], [PERSON] et al. proposed a two-factor authentication mechanism in an attempt to balance usability, security, and a continuous user experience. To address the usability factor and overcome the cumbersome password methods, they suggested a haptic-based OTP, where the user receives a Morse code TOTP generated by the system and interprets its haptic feedback as dots and dashes. Then, the user used the HMD controller to enter the dots and dashes as short and long presses, respectively. Next, in order to maintain security, a continuous authentication phase starts, where the system continuously collects and compares rotational data from both the authentication device and the HMD. In [173], [PERSON] et al. demonstrated how minimal changes to a User Interface (UI) can make shoulder attacks a very challenging task for attackers in VR environments. They built a multifactor VR authentication system that uses a password for access and acceleration to assess the user's movements while entering the password. They implemented three different key layouts to test the effect of key randomness on user movements. They concluded that despite the change in key layout, the users did not make significant adjustments to their hand position. They suggested more randomized layouts to introduce more noise to the hand movements and pointed out their interest in testing user input over a \(360^{\circ}\) space. In [174], [PERSON] et al. proposed a hybrid approach for VR authentication aiming at improving the protection of user information in the health sector. To log in, users need a username of string type and a dance movement's password chosen at the registration phase. The authors used two machine learning models to verify if the user's movements match the original registered movements. Their authentication results showed promising accuracy, with 88% and 99% for both the Artificial Neural Network (ANN) and k-NN classifiers, respectively. They pointed out the potential of their method to replace traditional password authentication methods due to the extra layer of security offered by the biometric dynamic movements. Their experiments showed their system's success at not authenticating the wrong user (false positives) and being secure against shoulder surfing attacks. In [175], [PERSON] et al. investigated freestyle in-air handwriting password authentication for XR environments. Their authentication framework uses both the password security side as a knowledge part of the authentication and the writing style as a behavioral trait. After collecting data on the in-air handwriting task using an LM camera and custom-made hand gloves, they performed a comparative study using three different sets of features (temporal features, statistical features, and geometry features). Despite the promising results of their experiments and the potential of in-air handwriting authentication in XR wearables, they pointed out many usability concerns, such as customers putting on movement-tracking gloves and the LM camera not performing well with fast hand movements.