# Recent Trends of Authentication Methods in Extended Reality: A Survey
## 4 Authentication Methods in XR
### Multifactor and Multimodal Authentication
They highlighted their future plan to use the glove as an input device or embed the glove's inertial sensor in the HHC and also collect a larger dataset with more constraints on the in-air handwriting to stabilize the user's behavior and improve matching. [PERSON] et al. [158] developed RubikBiom, an authentication scheme to test the suitability of behavioral biometrics collected during knowledge-driven authentication to authenticate VR users. They collected behavioral biometrics datasets from 23 participants who entered a 4-digit PIN from cube surfaces and extracted nine features for classification using six DL architectures. The results showed 98.91% accuracy using the FCN architecture with a combination of features. They highlighted their future plan to investigate the effect of knowledge-based biometric authentication on usability and security, and they also pointed out the non-suitability of their approach for users with motor disabilities and the need for alternative hand-free knowledge-driven biometric solutions based on eye or head movements. In [176], [PERSON] et al. proposed Blinkey, a two-factor VR authentication scheme based on the user's blinks as a password and pupil size as a biometric trait. They investigated the accuracy of Blinkey through extensive evaluations using four different ML classifiers and concluded that the k-NN classifier achieved the best results with a 0.04% EER and the shortest training time. Furthermore, they further tested the scheme's robustness against attacks such as zero-effort, shoulder surfing, credential aware, and statistical attacks, as well as its utility regarding time consumption, login attempts, user motion impact, and memorability. They concluded that their scheme offered less cognitive overload in comparison with its rival schemes. In [177], [PERSON] et al. looked into a hand-free solution for authentication with smart glasses. They investigated eye gaze authentication while obfuscating pupil movements due to their vulnerability to observation attacks. Thus, they combined closed eyes' eye gaze passwords with EOG sensor password detection. An EOG gaze gesture password dataset was collected with 15 participants and used for gaze gesture recognition with 5 ML classifiers. The recognition results reached 80.6% and 88.3% with SVM classifiers for closed eyes vs. open eyes, respectively, but their authentication results reached only 44.7% and 54.8% for closed eyes vs. open eyes. Their security evaluations for observation attacks with 18 participants showed that closed-eye gaze gesture passwords are harder to copy than their counterparts. They highlighted that despite the non-promising results of their authentication scheme, they believe that their future work holds room to improve the results through better model tuning and more accurate EOG sensor positioning. In [178], [PERSON] et al. proposed a 4D password combining a 3D VR password with hand movements as a 4 th-dimension of the password. They discussed the robustness of their proposed scheme for shoulder surfing, timing, keyloggers, and brute force attacks. In [179], [PERSON] et al. implemented Pixie, a two-factor authentication proof-of-concept based on the user's knowledge and possession. Unlike limited biometric solutions, Pixie offers unlimited choices. The user takes a picture of a trinket for the enrollment phase and uses the same trinket and angle used to take the picture as a knowledge factor for the authentication phase. The authors mentioned that their prototype can be used for wearable devices that have a camera, including smart glasses. They collected pictures manually and from open-source datasets and used four ML classifiers for authentication; their best results were achieved using a Multi-Layer Perceptron (MLP) classifier with a 1.87 EER. Their longitudinal user study showed that Pixie is simpler, faster, and more memorable than text passwords. In [180], [PERSON] et al. proposed and evaluated a VR authentication system that combines graphical passwords with hand movements.