Casual-VRAuth: A Design Framework Bridging Focused and Casual Interactions for Behavioral Authentication in Virtual Reality

Current behavioral authentication systems in Virtual Reality (VR) require sustained focused interaction during task execution - an assumption frequently incompatible with real-world constraints across two factors: (1) physical limitations (e.g., restricted hand/eye mobility), and (2) psychological barriers (e.g., task-switching fatigue or break-in-presence). To address this attentional gap, we propose a design framework bridging focused and casual interactions in behavior-based VR authentication (Casual-VRAuth). Based on this framework, we designed an authentication prototype using a modified ball-and-tunnel task (propelling a ball along a circular path), supporting three interaction modes: baseline Touch, and two eyes-free options (Hover/Tapping). Experimental results demonstrate that our framework effectively guides the design of authentication systems with varying interaction engagement levels (Touch > Hover > Tapping) to accommodate scenarios requiring casual interaction (e.g., multitasking or eyes-free operation). Furthermore, we revealed that reducing interaction engagement enhances resistance to mimicry attacks while decreasing cognitive workload and error rates in multitasking or eyes-free environments. However, this approach compromises the average classification accuracy of Interaction behavior under different algorithms (including InceptionTime, FCN, ResNet, CNN, MLP, and MCDCNN). Notably, moderate reduction of interaction engagement enhances authentication speed, while excessive reduction may conversely slow it down. Overall, our work establishes a novel design paradigm for VR authentication that supports casual interactions and offers valuable insights into balancing usability and security.