# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Multifactor and Multimodal Authentication
For enrollment, the user chooses a password, which is a sequence of movements displacing virtual objects present in the virtual environment. To log in, the user has to perform the same sequence used for enrollment, and the system checks if the sequence matches the original sequence stored in the database. If the sequences match, the user is successfully authenticated. The authors mentioned that their VR mechanism can be used for most modern devices, operating systems, and security systems. In [181], [PERSON] et al. implemented a two-factor authentication mechanism using lip-reading as a biometric factor and the content of the speech as a knowledge factor. They used the Grid audio-visual corpus open-source dataset to train their LSTM classifier-based lip-reader. Their system's results reached 93.8% accuracy with a usable interactive method that uses only digits instead of letters. They pointed out their future plan to collect their own data and re-investigate. In [182], [PERSON] et al. were the first to investigate head movements' recognition for GG due to its cumbersome and error-prone interface. They implemented GlassGesture, a two-factor head movement-based authentication mechanism for GG. In their experiment, the user answers questions from the near-eye display using head movements. k-NN and DTW were used for head movements and gesture recognition, and a one-class SVM classifier was used for authentication and reached 96% authentication accuracy. In [183], [PERSON] et al. suggested 3D Passwords, a multi-factor 3D authentication scheme that is a combination of many schemes. Three-dimensional passwords can be only recall-based, biometric-based, token-based, or any combination of these. The user chooses the password by performing a set of actions or picking certain objects inside the virtual environment; the password will be defined by the 3D coordinates of the object. The authorsperformed a user study on using 3D passwords, and the results of the study showed a high acceptability of 3D passwords among users. In [184], [PERSON] et al. proposed a multifactor authentication XR framework that fuses knowledge, physiological, and behavioral modalities. Users authenticate by writing a code (signature, PIN, or doodle) using the index finger. The in-air handwriting code and the hand skeleton geometry get captured by an in-depth camera (LM, Kinect, GG). Next, both the handwriting signal and hand geometry signal get matched with the registration templates and fused together. The experiments using the proposed prototype showed a 0.6% EER. Despite the limitations of the prototype, such as long-term performance and registration template protection, the authors pointed out the potential of their multifactor handwriting and hand geometry framework and their intention to test the performance of their prototype on larger datasets. In [185], [PERSON] et al. investigated the use of Federated Learning (FL) algorithms for metaverse user authentication to address the privacy concern of raw biometric data being uploaded to servers. They proposed MetaGuard, a continuous multimodal biometric framework where multiple data modalities are fused together. As a preliminary study and using the public dataset proposed in [154] by [PERSON] et al., they fused all the different modalities (ball throwing trajectories' signals) and used 3 DL classifiers to build the authentication models. The server trained these models, which compromised data privacy; however, the results of the models were promising, with an accuracy range of 87-90%. Next, they implemented the FL model using only user data without sharing it with the server, preserving data privacy. The FL model used the FCN architecture combined with the FedAvg algorithm and achieved only 6.34% accuracy. They argued that the reason for low accuracy is the model not distinguishing all user features and that their results improved when they trained the model with fewer users and modalities. They concluded that applying FL does not improve the accuracy of authentication systems. In [186], [PERSON] et al.