# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Knowledge-Based Authentication
They designed a set of ten symbol-based tapping gestures that get captured by a custom-made touchpad attached to the side of the Epson Moverio (EM) SG and that can differentiate between gesture types. They evaluated two versions of their scheme: a standard version that displays a black highlight on the private display and a disclosed version that displays the input symbols of the password. Their evaluations' results showed that tapping gestures boosts the accuracy and rapidity of the scheme and reported that the disclosed version helps with password memorization. They suggested further work to obfuscate observable physical inputs on GlassPass to improve resistance against observation attacks. In [94], [PERSON] et al. developed Beat-PIN, a touch-based authentication scheme for wearable devices. The scheme's rhythm-based password is a set of beats marked by their timing. Users enter the beat-PIN via taps on a touchpad several times for training and enter the same password to authenticate. They get authorized if the tapped password matches the training sample. Through experimental evaluations with 124 participants, they collected data and extracted tapping time instances, tapping intervals, and relative interval features. Then, they proposed a classification algorithm, Vector Comparison Algorithm (VCA), and compared the results with those of an SVM classifier. Their scheme achieved a 7.2% Equal Error Rate (EER) with a low input time and outperformed the SVM classifier. In [95], [PERSON] et al. proposed a shoulder-surfing-resistant authentication scheme for AR and VR devices. They based their proposed scheme on their previous work, the Zero-Trust Authentication Protocol explained in [96]. For registration, the users receive a secret assigned to them by the server through a private channel. Then, to authenticate, users answer a series of semantic challenges related to the registration phase secret without disclosing the secret by using speech, touchpad, or head movements as input modalities. The server then checks the accuracy of the answers and grants access. The authors did not evaluate the usability of their proposal. In [97], [PERSON] et al. studied users' perceptions toward the usability and security of authentication interaction modalities in VR. They designed four authentication technology probes (PIN, virtual card, and signature) for a VR environment and embedded them in an archery VR game for evaluation. They evaluated the probes in terms of interaction experience, security and privacy perception, and meeting user expectations. Among their prominent findings, users face usability challenges such as motion control and space awareness while performing authentication; the gamified VR context affects users' sense of security and privacy; improving interaction factors such as designing flexible and engaging interfaces. The suggested knowledge-based methods are generally satisfactory but do not always seem to be the ideal option for XR devices. It is possible that other approaches could yield greater advantages than knowledge-based approaches. Table 3 shows an overview of the selected papers with each scheme type, technical equipment, and conducted usability and security studies. \begin{table}
\begin{tabular}{c c c c c c c c} \hline _Concept_ & Ref. & Year & \multicolumn{2}{c}{**Scheme Name**} & **Input Method/Equip. ** & **Equip. ** & **US** & **SS** & **A\% (_HER_)** \\ \hline \hline \multirow{8}{*}{**m**} & \multirow{2}{*}{[66]} & \multirow{2}{*}{2022} & \multirow{2}{*}{CueVR} & \multicolumn{2}{c}{Lasepointer} & \multirow{2}{*}{HTC-V} & \multirow{2}{*}{20} & \multirow{8}{*}{15} \\  & & & & & & & \\  & & & & & & & \\  & & & & & & & \\ \cline{2-8}  & \multirow{2}{*}{[67]} & \multirow{2}{*}{2021} & \multirow{