AURA-XR: A risk-based methodology for the optimal selection of user authentication mechanisms in extended reality

The increasing adoption of Extended Reality (XR) technologies brings immersive interfaces into critical domains like healthcare and manufacturing. However, deciding how to protect users in these environments remains an open challenge. Although prior research explores individual authentication mechanisms, existing selection methods ignore context-specific constraints, environmental factors, and user perceptions central to XR. To address this, we conducted a qualitative study with usable-security experts to uncover key design considerations that current approaches overlook. Next, we mapped well-known selection methodologies against these considerations and identified important mismatches. In response, we developed AURA-XR, a risk-based framework integrating stakeholder perceptions, environmental and scenario-specific constraints, and risk assessment into a decision model. We demonstrate that AURA-XR supports context-sensitive, multi-objective authentication decisions tailored to this emerging domain. By filling a methodological gap, AURA-XR advances adaptive, privacy-aware, human-centred security in immersive systems, opening new routes for robust, situationally informed authentication in XR.