CoordAuth: Hands-Free Two-Factor Authentication in Virtual Reality Leveraging Head-Eye Coordination

We present CoordAuth, a gaze-based two-factor authentication technique in VR utilizing implicit head-eye motion features to offer a more secure and natural alternative to traditional pattern-based authentication. Users authenticate by performing gestures across 3×3 grid points using their eyes. We first optimized CoordAuth’s UI by evaluating participants’ input performance and experiences across different grid sizes. Then we extracted the head-eye coordination features during pattern entering to construct CoordAuth’s authentication algorithm, which ensembles Random Forest classifiers across saccade and fixations segments. CoordAuth demonstrated strong security with a 1.6% FAR and 1.5% FRR across 24 registered users in the password collision scenarios. A subsequent study demonstrated that CoordAuth achieved an 0.6% Attack Success Rate (ASR) against shoulder-surfing attack from a 1-meter distance. Usability evaluations in standing, sitting, and moving postures showed that CoordAuth achieved significantly faster authentication speed and lower rejection rate than laser and touch-based baselines. Meanwhile, it was the most preferred by the participants in terms of social acceptance and physical effort.