What you know, How you act: Transactional VR Authentication

Abstract

Mid-air PIN entry in virtual reality is vulnerable to observation and replay: once an attacker learns the credential, access to sensitive data, collaboration spaces, or financial workflows is compromised. We investigate transactional VR authentication, which combines what you know (the PIN) with how you act (behavioral biometrics from natural VR motion), so that knowing the PIN alone is not enough to impersonate a legitimate user. Prior VR behavioral biometrics evaluate within a single repeated entry task, leaving open if behavioral signatures remain stable when users return to authenticate under different intent, pacing, and posture. In our study, 42 participants enter a 4-digit PIN to unlock a virtual room, perform an intervening task inside, and re-enter the same PIN to lock the door on exit, enrollment on unlock, verification on lock. We model motion from the dominant hand, non-dominant hand, and headset with a Siamese network that compares enrollment and use-time trajectories, supporting both verification and identification. Across four PINs and 1,680 trials, we achieve EERs of 2.05–2.83% and Top-1 identification of 98.57–99.05%, outperforming FCN and KNN baselines. Including orientation alongside position substantially improves robustness across the unlock-to-lock shift, indicating that rotational strategies provide stable, user-specific signatures even when positional trajectories drift.