The core idea is deceptively simple: treat a hand-drawn signature as a biometric trait, just as banks and document workflows have done for decades with pen and paper. What makes AirSign distinctive is how it captures that signature. Instead of confining users to a predefined two-dimensional plane, or demanding specialized peripherals such as data gloves or a Leap Motion sensor mounted on a desk, the system exploits hardware that modern headsets already carry. Users can sign either with motion controllers or, on devices that support it, with camera-based hand tracking. A single unified gesture, a pinch between the index finger and thumb, signals the intent to write. When the virtual fingertips touch, the system begins sampling the three-dimensional coordinates of the fingertip at the headset’s refresh rate, typically 90 to 120 hertz, and renders the resulting strokes in real time so the user receives immediate visual feedback.

Under the hood, every signature becomes a multivariate time series. Each sampled point stores a position vector and a velocity vector, the latter computed from the change in position between consecutive frames divided by the elapsed time. Because the hand-tracking cameras on consumer headsets rely on monocular RGB input without dedicated depth sensors, the raw trajectory is noisy. To tame the jitter, the researchers apply linear interpolation, smoothing each sampled position halfway toward the previous one. This acts as a first-order low-pass filter, balancing responsiveness against stability. Two normalization steps then make signatures comparable regardless of where and how the user was facing when signing: the entire trajectory is translated so its first point sits at the world origin, and it is rotated by a quaternion so that the user’s initial viewing direction aligns with a canonical axis. The result is a signature that can be drawn anywhere, at any orientation, and still be matched against stored templates.

Comparing two signatures captured at different speeds and lengths is the central algorithmic challenge, and it is where Dynamic Time Warping enters the picture. Simple Euclidean distance fails catastrophically when two otherwise identical trajectories are temporally shifted, because points that should correspond are compared with the wrong partners. DTW solves this by warping the time axis of one sequence to find an optimal non-linear alignment with the other, minimizing the cumulative local distance along an admissible warping path that respects boundary, continuity, and monotonicity constraints. The method’s key property for signature verification is its invariance to time shifts: identical but misaligned sequences yield a distance at or near zero. Classic DTW carries a quadratic cost in both time and memory, however, which is prohibitive on a battery-powered headset, so the team turned to FastDTW, a multilevel approximation that coarsens the series, projects a low-resolution warping path upward, and refines it within a constrained radius, achieving linear time and space complexity.

The engineering choices reveal how much practical constraint shapes such systems. An early client-server design was abandoned in favor of fully on-device processing, with signature data saved directly to the headset’s local file system. The DTW computation was rewritten in Rust after benchmarks showed the original Python implementation took 2.37 seconds to compare a 383-point signature with itself, while the Rust version finished in 0.03 seconds, roughly 79 times faster. On a tenfold larger sample of 3,830 points, the gap widened to 480-fold, with Rust completing in 0.13 seconds what Python needed more than a minute to do. Further optimizations, including a Sakoe-Chiba band that restricts the warping path to a diagonal window and a diagonal DTW variant that slashes memory use, cut processing time by more than half on a 70,000-point signature. Classification also runs asynchronously on a background thread, preventing the rendering loop from freezing, a detail that matters enormously in VR, where a stalled frame that no longer matches head movement can induce motion sickness.

Even the choice of which features to feed the matcher mattered. An initial feature set combining position, velocity, and acceleration produced puzzling misclassifications: a handwritten name and an arbitrary wave pattern were judged suspiciously similar to a figure eight, with average DTW distances low enough to slip beneath the acceptance threshold. Ablation analysis showed that acceleration data was injecting noise rather than discriminative power, so the team stripped it out, keeping only position and velocity. The revised feature set produced a much clearer separation between similar and dissimilar signatures, eliminated the false positives, and, as a bonus, shrank the data files and simplified the computation. It is a textbook example of how more sensors and more features do not automatically mean better biometrics.

To evaluate the system, the researchers recruited 28 volunteers, roughly 60 percent male and 40 percent female, aged between 20 and 40, none of whom had meaningful prior headset experience. Each participant produced 25 signatures under two input modalities, controllers and hand tracking, and two experimental conditions. In the fixed-signature scenario, everyone wrote the same word, AIRSIGNX, deliberately stressing the system’s ability to distinguish people who share an identical signature shape. In the custom-signature scenario, each user chose a personal symbol or name, mimicking real-world variability. The team measured false acceptance and false rejection rates across swept thresholds and derived Equal Error Rates, the operating point where the two error rates coincide. Custom signatures proved markedly easier to verify, with EERs as low as 0.030 to 0.061 depending on input method, corresponding to authentication accuracy of roughly 94 to 97 percent. The hostile fixed-signature scenario, which doubles as a simulation of a skilled forgery attack in which an attacker knows the target’s signature shape, yielded EERs between 0.097 and 0.165, still translating to accuracy between roughly 83.5 and 90 percent.

Two further findings stand out. First, when the template gallery was reduced from 20 signatures per user to just 5, error rates rose only marginally, with the custom-signature EER reaching 0.030 with controllers and 0.053 with hand tracking. That stability matters for practical deployment, because it suggests users could enroll quickly without degrading security. Second, controllers consistently outperformed hand tracking on the Area Under the Curve metric, with very large effect sizes in both scenarios, reflecting the spatial jitter, gesture-detection latency, and occasional tracking losses inherent to camera-based hand modeling. Yet for the metric that matters most in practice, the EER on custom signatures, the difference between input methods was statistically negligible. In other words, when inter-class variability is high, the noisier but more convenient hand-tracking mode authenticates just as reliably, especially after smoothing. Users themselves praised the pinch-to-write gesture as natural and ergonomic, with the only recurring complaint being a slight lag in detecting fingertip contact at the start and end of strokes.

The security analysis is framed with appropriate caution. The researchers consider three threat levels: zero-knowledge attacks by random impostors, captured by the custom-signature EER; shape-aware attacks by forgers who know what the victim writes, captured by the fixed-signature EER; and dynamics-aware attacks, which they defer to dedicated future adversarial testing. Including velocity profiles in the DTW calculation is hypothesized to resist spatial replay attacks, since replicating how fast a signature was drawn is substantially harder than copying its shape, but the team is explicit that this hypothesis still needs rigorous testing. On the performance side, the entire verification cycle, including normalization, feature extraction, and DTW matching, completes within 350 milliseconds and adds less than 2 percent power draw on a standalone Meta Quest 2, confirming that biometric authentication can run continuously without draining the battery or degrading frame rates.

The authors are candid about the study’s limits. Twenty-eight participants cannot represent the full demographic spectrum, all data was collected in a single session, and no head-to-head comparison with classifiers such as support vector machines or deep learning architectures was possible, partly because variable-length 3D time series resist fixed-length feature extraction and the sample size is too small to train neural models fairly. They position AirSign accordingly, not as a novel classification algorithm but as a systems-level contribution: the first demonstration that unconstrained, on-device, three-dimensional signature verification is feasible on ordinary consumer VR hardware. Future work will scale the user cohort, parallelize the DTW computation across CPU cores, refine index-thumb contact detection, mount a proper defense against forged signatures, and benchmark the approach against gaze, motion, and keystroke biometrics. If those steps succeed, the awkward floating keyboard may finally give way to something far more intuitive: simply signing your name into the air.

Subject of Research: VR-based 3D hand-written signature recognition for biometric user authentication in virtual reality

Article Title: AirSign: An innovative VR-based hand-written signature recognition

Article References: Frascarelli, G., Marini, M. R., De Marsico, M., Mecca, A., & Cinque, L. (2026). AirSign: An innovative VR-based hand-written signature recognition. Multimedia Tools and Applications, 85(10), Article 790. https://doi.org/10.1007/s11042-026-21951-x

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21951-x

Keywords: virtual reality, biometrics, signature recognition, Dynamic Time Warping, hand tracking, authentication, Meta Quest, behavioral biometrics, Rust, Unity, human-computer interaction, cybersecurity

The core insight behind BTFA is that human interaction with a mobile device carries a behavioral signature as distinctive as a fingerprint, but one that requires no special hardware, no scanning, and no additional action from the user. When someone types a password on a touchscreen, the rhythm of their taps, the pressure they apply, the size of their touch contacts, and the micro-movements of the device in their hand all combine into a pattern that is difficult for an impostor to replicate even when the password itself has been compromised. BTFA captures these signals during the ordinary act of logging in and feeds them to a machine learning model that decides, in real time, whether the observed behavior matches the enrolled owner. If it does, the login proceeds seamlessly; if it does not, the system can demand additional verification or block access entirely.

Technically, the researchers turned to a Long Short-Term Memory network, a class of recurrent neural architecture well suited to sequential data. Touch gestures and sensor readings arrive as time series, and LSTM networks excel at learning the temporal dependencies within such sequences—the way one tap flows into the next, how accelerometer and gyroscope values oscillate as a hand steadies a phone. The team trained separate models on touch interaction data and on motion sensor data collected during login, allowing them to compare which modality carried the stronger authentication signal. This design choice matters because behavioral biometrics are inherently noisy: a user may be seated on a train one day and standing in a corridor the next, and the system must tolerate that natural variability while still rejecting an attacker with surgical precision.

To evaluate the approach under realistic conditions rather than in a sterile laboratory setting, the team conducted a field study using a custom-developed mobile application with registration and login interfaces. Participants used the app in their daily lives, generating a substantial corpus of 38,542 behavioral samples that were used for model training and validation. Field data of this kind is considerably harder to model than curated laboratory recordings, precisely because it contains the posture changes, device swaps, and environmental distractions of real-world use. The scale of the dataset also matters for deep learning: LSTM networks require enough examples to generalize across sessions and days rather than memorizing individual recordings, and the collected volume gave the models that opportunity.

The results revealed a striking asymmetry between the two behavioral modalities. The model trained on sensor data—accelerometer and gyroscope readings captured while the user interacted with the login screen—achieved an area under the ROC curve of 97.28 percent, with an equal error rate of just 6.84 percent. The touch gesture model, by contrast, reached 78.67 percent AUC with an equal error rate of 28.48 percent. The researchers attribute the gap primarily to the stability of motion patterns: the way a person’s hand trembles, tilts, and counterbalances during typing is remarkably consistent across sessions, whereas touch characteristics such as tap duration and swipe geometry fluctuate more with context, device position, and even mood. In practical terms, the sensor channel alone provides a second authentication factor strong enough to meaningfully complement a password.

Equal error rate deserves a moment of explanation, because it is the figure of merit by which biometric systems are judged. It is the point at which the system’s false rejection rate—legitimate users wrongly locked out—equals its false acceptance rate—impostors wrongly waved through. A lower EER means the threshold can be tuned so that both errors are rare simultaneously. An EER of 6.84 percent for the sensor-driven model means that security administrators can calibrate BTFA to reject the vast majority of attackers while inconveniencing only a small fraction of legitimate users, a trade-off that compares favorably with many published behavioral biometric systems evaluated under similar conditions.

What makes BTFA particularly relevant for Identity and Access Management systems is its resistance to phishing and its zero-burden design. Phishing remains one of the most successful attack vectors in enterprise environments: a user is tricked into entering credentials on a fraudulent site, handing the attacker everything needed to impersonate them. But stolen credentials alone are useless against BTFA, because the attacker logging in from their own device or an automated script will not reproduce the victim’s hand movements and sensor signatures. Unlike SMS one-time passwords, which can be intercepted through SIM swapping, or push-based approval, which users can be manipulated into accepting through fatigue attacks, behavioral verification cannot be forwarded, replayed, or socially engineered out of the user. The second factor exists only in the physical act of the legitimate owner logging in.

The user-experience implications are equally significant. Surveys of multi-factor adoption consistently find that friction is the primary reason users disable or circumvent second factors, and organizations under regulatory pressure to enforce MFA often face pushback when the added security slows daily workflows. BTFA inverts this equation: the second factor is collected passively as a byproduct of the login the user was going to perform anyway. There is no code to read, no token to carry, no notification to approve. The researchers emphasize that this reduction in user dependency on the MFA solution is especially valuable in IAM applications where critical and confidential information is accessed and shared, since those environments demand both stringent security and sustained user cooperation.

The work builds on a growing body of research into behavioral biometrics and continuous authentication on mobile devices, and the authors position BTFA as a pragmatic deployment model for that science—one that targets the specific, high-value moment of login rather than demanding background monitoring throughout a session. The study’s limitations are those of the field generally: behavioral patterns can drift over time as users’ habits change, models must be retrained or adapted to accommodate new devices, and privacy considerations around collecting motion data require careful governance. Yet the field study’s results suggest that the technical barriers are surmountable with data already being generated by every tap. As organizations worldwide retire passwords in favor of phishing-resistant authentication, BTFA offers a vision of security that asks nothing extra of the user—because the strongest proof of identity, it turns out, may simply be the way you hold your phone.

Subject of Research: Behavioral biometric two-factor authentication for Identity and Access Management systems

Article Title: BTFA: Behavioral Two Factor Authentication For IAM Systems

Article References: Mahfouz, A., ALMouh, K., Samrouth, K., Bakir, N., & Chalhoub, G. (2026). BTFA: Behavioral Two Factor Authentication For IAM Systems. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02515-7

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02515-7

Keywords: behavioral biometrics, two-factor authentication, IAM systems, LSTM, touch gestures, sensor data, smartphone security, phishing resistance, user authentication, machine learning, mobile security, identity and access management