From PINs to Gestures: Analyzing Knowledge-Based Authentication Schemes for Augmented and Virtual Reality

As Augmented and Virtual Reality (AR/VR) advances, secure and user-friendly authentication becomes vital. We evaluated 17 authentication schemes across gaze, gesture, PIN, spatial, and recognition-based categories using a systematic framework focused on effectiveness, security, and usability. Our analysis revealed varied performance and significant gaps requiring standardized methods. For example, Beat-PIN demonstrated strong security with 140-bit entropy, while RubikAuth achieved high usability with authentication times of 1.69 seconds. Gaze-based methods, though innovative, faced accuracy issues. We also observed a preference for schemes like In-Air Handwriting and Things, which balanced security and ease of use. By extending Bonneau et al.'s framework [5] to develop an AR/VR-specific evaluation model, we identified schemes like RubikAuth and Things as particularly promising for AR/VR. This study highlights the strengths and limitations of current methods and emphasizes the need for cross-modal and context-aware techniques to advance AR/VR authentication.