{'fraction_non_alphanumeric': 0.038250932465677324, 'fraction_numerical': 0.005773351321323704, 'mean_word_length': 4.864456079115765, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 7, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Secure Authentication Framework to Guarantee the Traceability of Avatars in Metaverse

Metaverse is a vast virtual environment parallel to the physical world in which users enjoy a variety of services acting as an avatar. To build a secure living habitat, it's vital to ensure the virtual-physical traceability that tracking a malicious player in the physical world via his avatars in virtual space. In this paper, we propose a two-factor authentication framework based on chameleon signature and biometric-based authentication. First, aiming at disguise in virtual space, we propose a chameleon collision signature algorithm to achieve the verifiability of the avatar's virtual identity. Second, facing at impersonation in physical world, we construct an avatar's identity model based on the player's biometric template and the chameleon key to realize the verifiability of the avatar's physical identity. Finally, we design two decentralized authentication protocols based on the avatar's identity model to ensure the consistency of the avatar's virtual and physical identities. Security analysis indicates that the proposed authentication framework guarantees the consistency and traceability of avatar's identity. Simulation experiments show that the framework not only completes the decentralized authentication between avatars but also achieves the virtual-physical tracking.

The most representative prototype of metaverse is the virtual platform Second Life 1 released by Linden Research in 2003. The platform constructs a virtual world that is highly similar to reality in which players can freely socialize, trade, and build facilities via their digital role. IBM once purchased a piece of land and built its own sales center in the complete virtual ecosystem. As a highly digitized world, metaverse is devoted to build an environment that satisfies immersive interaction and virtual-physical coexistence [2], which breaks through the limitations of the physical world and enables people to perform unimaginable works. For example, in the medical field, the digital representation of a patient is projected into a virtual consultation room, in which experts from around the world discuss treatment options face-to-face without leaving their office. In education, virtual molecules and atoms are cast around students to perceive the abstract microscopic world. In the social field, friends in different places are projected into the same virtual environment allowing them to communicate and shop like in the physical world.
Metaverse will become the second living space of human beings coexistence with the physical world [3]. At present, leading companies in various countries have turned their attention to the metaverse [4] [5], where the dimension is infinite but the ecosystem is finite. Baidu, the largest Internet company in China, has published a immersive interactive environment, Xirang 2 , based on Virtual Reality (VR) and Artificial Intelligence (AI). The environment consists of infinitely connected virtual spaces, each of them is a unique digital metropolis. MATE (formerly Facebook), the most popular social platform in America, has released an open VR social environment Horizon Worlds that enables each player to create his own community and meet strangers from all over the world for leisure and entertainment. However, something as disturbing as the real world is happening in this emerging environment. In the public beta of Horizon Worlds, a female tester reported that her avatar was sexually harassed by other players. Soon after, it was reported that a researcher from SumOfUs had suffered similar harassment in the virtual cyberspace, which was worse than the previous. It can be seen from the above events that the avatar's safety is being threatened, which seriously hinders the further development of metaverse [6]. Therefore, there is an urgent need to establish a traceable authentication mechanism that tracks a malicious avatar to its player.
Realizing such a traceable mechanism is non-trivial. One of the challenges is that we are unable to track malicious 1 https://secondlife.com 2 https://vr.baidu.com/product/xirang arXiv:2209.08893v3 [cs.CR] 6 Dec 2022 players via the avatars' appearances because different players may create avatars with the same shape [7]. Another challenge is that it is impossible to track the malicious player directly through the device in which the malicious player may somehow obtain devices authenticated from legitimate users to impersonate the player. The final challenge is that mutual authentication between avatars may impose a massive overload to the system. The reason is that metaverse breaks through the physical limitations in terms of geography, allowing millions of users to communicate in a zone.
In this paper, we aim to address the above challenges. For the first challenge, the player can generate a signature when creating an avatar, thereby forming non-repudiation information for the avatar's virtual identity. However, the traditional signature algorithm [8] is cumbersome, which results in that players not only have to perform a lot of calculations but also need to store a large number of signature parameters for later tracing. Therefore, it is essential to construct an efficient signature algorithm to ensure the traceability of the avatar's virtual identity. Chameleon signature is a one-tomany signature mechanism that signs multiple plaintexts with one signed message. Based on this feature, the players are able to sign multiple avatars without changing the original signed message, which significantly improves computational efficiency and reduces storage costs. However, the traditional chameleon signature consists of two parts, the chameleon hash and the common signature algorithm, which leads to the players having to hold multiple key pairs. To this end, we modify the chameleon hash function [9] and propose a chameleon collision signature algorithm, which enables players to sign avatars with only a pair of keys.
For the second challenge, a natural idea is that the user as a verifier throws a random challenge to the avatar, while the avatar as a prover submits its player's biological sample in response. Based on these physical identity parameters, the verifier can check the avatar's physical identity. However, the biometric feature is difficult to avoid replaying attacks [11] and thus a malicious player may deny that the violation wasn't performed by him. To solve this problem, we build an avatar's identity model based on the player's biometric template and chameleon key. In the process of authentication, it requires the player to embed a watermarking into the captured biological sample and generate a check parameter utilizing his chameleon private key to guarantee the verifiability of the avatar's physical identity.
For the third challenge, we assume that there is an authentication mechanism that allows avatars to complete dynamic identity verification without involving a trusted third party, which ensures the consistency of the avatar's virtual and physical identities in a decentralized manner. Unfortunately, current mutual authentication schemes primarily focus on onetime authentication between devices [12] and have not yet considered dynamic authentication between avatars. To this end, we designed two immersive decentralized authentication protocols based on the avatar's identity model, including the one-party authentication protocol and the two-parties authentication protocol. By these protocols, players can implement dynamic authentication as well as track malicious avatars.
To sum up, we construct a decentralized and traceable authentication framework for avatars based on chameleon signature and biometrics. The contributions are as follows: • We introduce the notion of virtual-physical tracking for avatars authentication systems and define the security requirement of consistency for avatar's virtual and physical identities. • We propose a chameleon collision signature algorithm to achieve the verifiability of the avatar's virtual identity, which effectively generates chameleon collisions to form signatures using only one private key. • We construct an avatar's identity model based on the biometric template and the chameleon public key to realize the verifiability of the avatar's physical identity. • We design two sets of decentralized avatar authentication protocols based on the avatar's identity model to guarantee the consistency of the avatar's virtual and physical identities. • We build an avatar authentication system based on blockchain and iris recognition method, which realizes the virtual-physical tracking to avatars.
The rest of the paper is organized as follows. We introduce the secure authentication framework in the next section. The verifiable avatar's identity is presented in Section III. Section IV designs the decentralized avatar authentication protocol. The security analysis and the performance evaluation are given in Section V and Section VI, respectively. We review related works in Section VII and finally conclude the paper in Section VIII.

II. SECURE AUTHENTICATION FRAMEWORK
To ensure the virtual-physical traceability tracking a virtual avatar to its physical player, we combine knowledge-based and biometric-based methods to build a two-factor authentication framework. Here, we introduce the system model, security threats, and design goals of the proposed authentication framework shown in Fig. 1.

A. System Model
• Avatar: It is the virtual representation of a physical player.
Based on this feature, we regard an avatar as the unity of virtual identity and physical identity, which means that a valid avatar must satisfy the consistency of virtual and physical identities. • Player: It is a specific manipulator of an avatar in the physical world. To ensure traceability, players need to submit their chameleon key and biological samples to complete registration and obtain a verifiable metaverse identity token (MIT), which enables the player to create an avatar that satisfies the virtual-physical traceability. • Identity provider (IDP): As a trusted organization in the physical world, it audits players' real identities and generates the corresponding MIT. During the tracking process, it discloses the violator's real identity through the MIT and the related parameters submitted by whistleblower. • Blockchain: It stores public information about the avatars' identity.

B. Security Threats
A malicious player may disguise his avatar as the one of target player's to deceive others, may get device authenticated by legitimate player to manipulate the corresponding avatar, and may even replay outdated information collected from interactions to target player. Thus, we assume that the malicious player can mount the following attacks: • Disguise: In the virtual metaverse, the attacker as a malicious avatar disguises his appearance that looks the same as the target avatar to deceive the interactor. • Impersonation: In the physical world, the attacker as a malicious manipulator gets a device authenticated by legitimate player and impersonates the player to manipulate the corresponding avatar. • Replay: Both in the metaverse and the physical world, the attacker collects the outdated identity parameters associated with a honest avatar and submits them to the interactor by which claims to be the target avatar.

C. Design Goals
To realize the secure interaction for avatars in the metaverse, the proposed framework should achieve the following goals.
• Traceability: The traceability refers to tracking an avatar in the virtual metaverse to the corresponding manipulator in the physical world, we call it virtual-physical traceability. It requires that a malicious avatar should be traced back to its manipulator through the avatar's identity parameters retained in the authentication process, while a honest player should not be framed by fake identity parameters about his avatar. • Consistency: To achieve virtual-physical traceability, the avatar's virtual and physical identities must be consistent. Therefore, we should check the validity of the avatar's virtual identity to prevent disguise, check the avatar's physical identity to avoid impersonation, and check the freshness of the submitted identity parameters to prevent replaying.
• Decentralized: Authentication between avatars can be done without the involvement of a trusted third party. • Immersive: During the authentication process, players do not need to perform specific operations, ensuring the immersive experience for players. • Privacy: The player's physical identity is not disclosed during authentication.

III. VERIFIABLE AVATAR'S IDENTITY
An avatar is a unity of the virtual identity and the physical identity. In this section, we first propose a chameleon collision signature algorithm to ensure the verifiability of the avatar's virtual identity, which prevents malicious players from mounting disguise. Then, we design an avatar's identity model to ensure the verifiablity of avatar's physical identity, which prevents impersonation.

A. Chameleon Collision Signature
The methods of traditional chameleon signature involve signing on the chameleon hash and forging collisions, resulting in the signer having to hold two private keys, one for signing and the other for generating collisions. In addition, the methods introduce zero-knowledge proofs to ensure the security of chameleon hash , which seriously reduces the efficiency of the algorithm [9] [10].
Since a collision is forged by the private key, the new collision can be treated as a chameleon signature. Based on this idea, we propose an efficient chameleon collision signature, which reduces the cost of holding keys and eliminates the zeroknowledge proofs while ensuring security by modifying the chameleon hash [9]. The proposed algorithm consists of the following six parts, namely, , , ℎ, ℎ , , and .
• ( ) → . Let be a security parameter in the chameleon collision signature system. G, G are multiplicative cyclic groups of prime order ≥ 2 , where is a generator of G. A pairingˆ: G×G → G is an efficiently computable bilinear map, which satisfiesˆ( , ) = ( , ) for all , ∈ Z . The system selects the global anti-collision hash function G : {0, 1} * → G , which maps bit strings of arbitrary length to corresponding elements in G. Finally, the algorithm publishes the system parameters = {G, G , , ,ˆ, G }.
The key generation algorithm takes the system parameter as input. The algorithm picks a randomness ← Z as the private key and calculates = (1/ ) ∈ G as the public key . It outputs the following public-private key pair = , = .
• ℎ( , ) → (ℎ, ). The chameleon hash generation algorithm takes as input the public key = and the message . The algorithm sets = G ( ) and picks a randomness ← Z . It outputs the chameleon hash ℎ and the corresponding check parameter as • ℎ ( , ℎ, , ) → . The chameleon hash check algorithm takes as input the public key = , the chameleon hash ℎ, the message , and the check parameter . The algorithm sets = G ( ) and checks the compatibility of ( , ℎ, , ). It outputs = 1 if

B. Avatar's Identity Model
In this part, we design an avatar's identity model based on the chameleon signature and the biometrics, including the metaverse identity token (MIT), avatar's virtual identity (VID), and the avatar's physical identity (PID). As shown in Fig.2, the player's chameleon public key = ∈ is linked to the avatar 's virtual identity = ( , ). The player's biological template ∈ is related to the avatar's physical identity = ( , ) , which ensures the verifiability of avatar's physical identity.
Metaverse Identity Token (MIT): The metaverse identity token is a bridge between the virtual space and the physical world. To obtain this token , the user provides , , , and to IDP, then the IDP generates a signed = ( , , ℎ, , ) after reviewing the above information. Among them, the is the player's real identity, is the anonymous identity, is the biometric template such as the iris, is the chameleon public key taken from the key pair ( , ) ← (·), ℎ is the chameleon hash generated by (ℎ, ) ← ℎ( , ), and is the check parameter of . Ultimately, the IDP publishes on the blockchain to ensure the public verifiability of the avatar's identity and records ( , ) in a secure database to guarantee the traceability of the player's real identity.
Virtual Identity (VID): The avatar's virtual identity (VID) is the player's public identity in a metaverse region, which appears as a visible avatar. Before entering the metaverse, the player need to create the = ( , ) based on the and his chameleon private key , where is the avatar's identity information, ← ( , ℎ, , , ) is the corresponding check parameter.
Physical Identity (PID): The avatar's physical identity (PID) is the player's biometric information in the physical world, which presents as a processed biometric feature. During metaverse interactions, an avatar provides its = ( , ) to the verifier, where is the player's biometric feature, ← ( , ℎ, , , ) is the corresponding check parameter.

IV. DECENTRALIZED AVATAR AUTHENTICATION PROTOCOL
In this section, we design two decentralized authentication protocols based on the avatar's identity mode. In the one-party authentication protocol, the verifier throws challenges to the prover at any time to achieve real-time authentication. For the two-party authentication, the verifier and the prover can not only complete mutual authentication but also establish a session key to facilitate secure communication.

A. One-party Authentication Protocol
The one-party authentication protocol implements dynamic authentication based on a challenge-response mechanism to ensure the consistency of avatar's virtual and physical identities. As shown in Fig. 2: 1) avatar as a prover claims that his identity is valid; 2) avatar as a verifier checks the validity of 's virtual identity and throws a random challenge to to confirm whether 's physical identity matches its virtual identity; 3) avatar 's manipulator provides his biometric feature and corresponding check parameters as a response; 4) avatar checks the validity of the parameters to determine the consistency of avatar's virtual and physical identities. The detailed processes are as follows: Claim: In this phase, avatar submits its metaverse identity token = ( , , ℎ, , ) and virtual identity information = ( , ) to avatar to initiate an identity claim. Challenge: After avatar completing the check on and , he throws a random challenge to avatar . As shown in Fig.3, if the IDP's signature on is validity and the collision ( , ) = with respect to ( , ) ∈ is validity according to ( , ℎ, , , , ) in III-A, 's virtual identity is validity. Response: In the response phase, avatar 's manipulator submits his biometrics embedded with challenge information to prove the validity of 's physical identity. The specific steps are as follows: (i) the manipulator randomly samples his biometric information and processes it locally to form a biometric feature ; (ii) the manipulator embeds the challenge as watermarking into to form a watermarked biometric feature , which provides conditions for anti-replay attacks; (iii) the manipulator generates the check parameter ← ( , ℎ, , , ) using his chameleon private key according to III-A. Finally, submits = ( , ) to avatar as the response corresponding to . Verify: To verify whether avatar 's physical identity is consistent with his virtual identity, the avatar needs to perform the following three steps: (i) extracts the challenge information from and checks = to ensure whether is a playback; (ii) checks the match between the biometric feature and the biological template ∈ to ensure the validity of 's physical identity; (iii) checks the match between the collision pairs ( , ) = and ( , ) ∈ to ensure the consistency of avatar's virtual and physical identities. After the above steps are passed, the verifier can determine that 's physical identity is consistent with its virtual identity.

B. Two-party Authentication Protocol
In this part, we designed a two-party authentication protocol to realize the decentralized mutual authentication between avatars. As shown in Fig. 4, the designed protocol adds a session key negotiation based on the one-party protocol to achieve secure communication between avatar and avatar . The detailed processes are in the following three phases: Round 1: In this phase, first avatar submits an identity claim to avatar , then submits a claim of 's identity and a challenge to . The specific steps are as follows: (i) submits with and to initiate a claim about 's identity; (ii) upon checking the validity of 's virtual identity based on and , sends , and to , where and is the claim of 's identity, is a random challenge to 's physical identity.
Round 2: In round 2, first avatar submits his physical identity parameters as a response and throws a challenge to avatar , then submits his own physical identity parameters as a response and sends a session parameter to . The specific steps are as follows: (i) after checks the validity of 's virtual identity based on and , submits and to , where is the random challenge to 's physical identity; (ii) upon checking the consistency of 's physical identities based on and , responses and to , among them, is the secure parameter for constructing session key = between and . Session Key Establishment: After checking the validity of 's physical identity based on and , establishes the session key = ( ) 1/ = using his private key = to realize secure communication.

V. SECURITY ANALYSIS
The security of the proposed authentication framework we constructed depends on the proposed collision chameleon signature. In this section, we first analyze the security of the chameleon collision signature, including the existential unforgeability under adaptive chosen message attacks (EUF-CMA) and the keys holding cost. Then, we analyze the security of the authentication framework, involving consistency, traceability, decentralized authentication, immersive mutual authentication, key escrow problem, and privacy protection.

A. Security of Chameleon Signature
EUF-CMA: The security of the proposed chameleon collision signature is based on the Divisible computation Diffie-Hellman (DCDH) assumption [13]. Its security model is based on the existential unforgeability game In the following, we briefly analyze the security of the proposed chameleon signature algorithm, while the detailed proof is in the Appendix A.
The security of the proposed chameleon signature algorithm depends on the DCDH assumption, that is, it is hard to output / ∈ G on given random triples , , ∈ G. According to the game model at Fig.5, the adversary attempts to forge a , if the polytime adversary is able to output * = (ℎ/ * ) = / , then the DCDH problem can be solved (it contradicts with the DCDH assumption). Therefore, the proposed chameleon signature is EUF-CMA.
Keys Holding Cost: We compare the keys holding cost of our proposed chameleon signature with that of Khalili's [9] and Gamenisch's [10]. From the III-A we get that the public and private key of our scheme contain one element in G 1 and one element in Z , respectively. For Khalili's scheme, it constructs two sets of chameleon hash methods in which construction 2 is more efficient, therefore, we only analyze it. Since the construction 2 leverages the signature of knowledge [14] to ensure the security of the chameleon hash, the elements contained in the keys are greatly increased. By analyzing this construction, the elements contained in the key pair are shown in Table I. Its public key involves 3 group elements (2 1 , 1 2 ) and a set of common reference string ( + 2 + 5 1 , + 3 2 ). Therefore, Khalili's public key contains ( + 2 + 7 1 , + 4 2 ) and private key contains 3 parameters in Z , which are ∈ Z in chameleon hash and , ∈ Z in zero-knowledge-proofs. For Gamenisch's scheme, it builds a chameleon hash algorithm in Gap-Groups, which is the same as the group of our scheme. By analyzing this construction, we get that its public key contains (1 1 + 2 2 ) and private key contains 2 . Thus, our scheme has low element cost in public-private key. Additionally, Khalili's and Gamenisch's construction have to add a pair of public-private keys for signing because their keys can only generate a hash. But for our proposed algorithm, it only needs a pair of keys for hashing and signing. Therefore, our scheme has fewer key pairs to generate signatures. From the above analysis, we can get that our proposed chameleon signature has obvious advantages in terms of key holding cost under the premise of security. to denote the number of elements contained in groups G 1 , G 2 , and finite field Z , respectively. 2 It indicates whether an additional key is required to implement the chameleon signature.

B. Security of Authentication Framework
Definition 1: If an avatar's virtual identity and physical identity match a metaverse identity token, the avatar's identity satisfies consistency.
Consistency: To guarantee the consistency, three aspects should be checked according to the Definition 1 : the validity of the avatar's virtual identity, the validity of the avatar's physical identity, and the freshness of the submitted identity parameters. During an interaction between avatar as the prover and avatar as the verifier, (i) checks the match of ( , ) = and ( , ) ∈ to ensure the validity of 's virtual identity; (ii) checks the match of ( , ) = and ( , ) ∈ sampled from 's manipulator to ensure the validity of 's physical identity; (iii) first checks the match of and ∈ , then it extracts the watermarking from and compares with the challenge throwing by him to ensure that the biometric feature is freshness. To dynamically check the consistency of 's virtual and physical identities, dynamically executes the one-party authentication protocol to have submit the biometric feature containing a new challenge. Through the above steps, it guarantees the consistency of the avatar's virtual and physical identities.
Traceability: The virtual-physical traceability means that a malicious manipulator should be traced back through the avatar's identity parameters, a honest manipulator should not be framed by fake identity parameters.
To track back a malicious manipulator, whistleblower submits IDP with the avatar's identity parameters = ( , , ℎ, , ), = ( , ) and = ( , ). After IDP completing the check on these parameters, it discloses the manipulator's real identity based on { , } reserved registration, which achieves the virtual-physical tracking.
Conversely, if a malicious whistleblower wants to frame an honest avatar, the whistleblower needs to forge the avatar's , , and . Among them, the and the is the avatar's public information in the metaverse. Thus, the target parameter whistleblower attempts to forge is the , that is, the biometric feature and the corresponding check parameter . For , the whistleblower is able to embed the fresh challenge into the outdated biometrics, which is easy to accomplish. But for , since the whistleblower lacks the corresponding chameleon private key and the proposed chameleon signature is EUF-CMA, it is hard for a whistleblower to forge . Therefore, the proposed authentication framework satisfies the virtual-physical traceability. Decentralized Authentication: The decentralization authentication of the proposed framework relies on the MIT signed by IDP. In the process of authentication, the verifier checks the validity of the avatar's virtual identity based on and , checks the consistency of the avatar's virtual and physical identities based on and . The entire authentication process does not involve a trusted third party, realizing decentralized authentication between avatars.
Immersive Mutual Authentication: In the process of authentication, the verifier throws a random challenge to the prover, then the prover automatically generates physical identity parameters as a response, such as capturing biometrics through a head-mounted display(HMD) devices, ensuring that the player's interactive experience is not disturbed in any way.
No Key Escrow Problem: During authentication, the check on the avatar's virtual and physical identities is completed only by a pair of chameleon keys ( = , = ), holding by the player himself. Therefore, the player's keys are not escrowed with any trusted third party, which avoids the key escrow problem.
Privacy Protection: In the process of authentication between avatars, the prover initiates an anonymous claim through and , at the same time, the verifier achieves anonymous authentication based on the locally processed biometric feature and the corresponding check parameter . The whole process doesn't reveal the actual information about the prover's identity.

VI. PERFORMANCE EVALUATION
In this section, we first evaluate the computation cost of the chameleon signature. Then, we evaluate the performance of the proposed authentication framework, including the impact of embedding watermark into biometrics, the computational cost in authentication, the authenticating consumption on different platforms, and the virtual-physical tracking consumption .

A. Performance of Chameleon Signature
Computation Cost: We compare the computation cost of our proposed chameleon collision signature with that of Khalili's [9] and Gamenisch's [10] as shown in the TABLE II. It can be seen that the proposed algorithm has obvious computational advantages. The reason is that Khalili's and Camenisch's construction involves the signature of knowledge and zero-knowledge proof, respectively, while our algorithm eliminates the above time-consuming steps under the premise of security and greatly reduces the computational cost.
To further analyze the performance of the proposed chameleon collision signature, we implemented our scheme and Khalili's construction based on the Java programming language. The simulation set the batch size of data processing to 10, 20, 30, 40, and 50 respectively. The average time consumption of these two methods is shown in Fig.  6. It can be seen from the figure that the consumption of our proposed algorithm is within 50ms, which has obvious advantages compared with Khalili's construction. 1 We utilize 1 , 2 , and to denote the exponential operation on G 1 , G 2 , and G , 1 to denote the multiplication operation on the group G 1 , to denote the bilinear map. 2 We utilize to denote the in Khalili's construction, the in Camenisch's construction, and the in our scheme because the algorithms , , and are essentially forging chameleon collisions.

B. Performance of Authentication Framework
Since the metaverse platform presents vivid digital environments via HMD devices that fully cover the player's eye area to guarantee a perfect visual experience, we consider the iris-based authentication method will be an important way to achieve metaverse authentication. Based on this idea, the proposed protocol embeds challenge information into the iris feature to realize the avatar authentication and prevent replay attacks.
Watermarked Biometrics: To analyze the impact of embedding watermarks into biometrics, we take the player's native iris feature as the biotemplate in the avatar's , take the native and the watermarked iris features as the response parameters, respectively. During simulation, we utilize the public dataset CASIA-IrisV4-Thousand 3 and CET2005 4 to build the iris biometrics, the OSIRIS algorithm [15] to extract the iris-encoded, and the adaptive image watermarking algorithm [16] to embed 128-bit random challenge into the iris-encoded image. Through simulations, we obtain the False Rejection Rate (FRR) and the False Acceptance Rate (FAR) of iris recognition as shown in 7. It can be seen that although the proposed authentication framework embeds a watermark into the iris-encoded, the FRR and FAR of iris recognition are almost the same as that of the native iris features under the two types of public datasets. Therefore, our method further prevents replay attacks without affecting the recognition efficiency. Computational Cost of the Protocol: The proposed authentication protocol contains one-party and two-parties. Since the latter includes all the steps of the former, we analyze the computational cost of the latter. The two-parties protocol involves verifying the signature on , embedding and extracting watermarks in biometric features, and generating and checking chameleon parameters. To analyze the core computational cost of our proposed protocol, we only consider the generating and checking of chameleon parameters. From the two-parties protocol in IV-B, the costs of each phrase are shown in the TABLE III. In round 1, avatar only submits the identity parameter to , so no computation is involved, while the avatar need to check the validity of avatar 's identity through , which involves the computational cost of (1 1 + 2 ) × 2. In round 2, need to check the validity of 's identity through and generate a chameleon signature by , which involves the calculation cost of (1 1 + 2 ) × 2 + 1 1 + 1 1 . need to check the validity of 's response by , generate a chameleon signature by , and submit a random parameter to , which involves the computation cost of (1 1 +2 )× 2 + 2 1 + 1 1 . In session key establishment, need to check the validity of 's response through and generate the session key = ( ) 1/ by his chameleon private key , which involves the computation cost of (1 1 +2 ) ×2+1 1 . But for , he establishes the session key = by the random number , which involves the computational cost of 1 1 . To sum up, the calculation costs of and in the twoparties authentication protocol are (5 1 + 2 1 + 8 ) and (5 1 + 3 1 + 8 ), respectively. Authenticating Consumption on Different Platforms: To further analyze the time consumption of the proposed authentication framework, we conduct simulations on three different platforms, PC ( CPU is Intel Core i5 7500, memory is 8 GB, the operating system is Windows 10 ), Smart Phone(CPU is Hisilicon Kirin 659, memory is 4 GB, the operating system is Android 9), and Raspberry(CPU is Cortex-A72, memory is 4 GB). The time consumption of one-party authentication protocol and two-parties authentication protocol on different platforms are shown as Fig.8, where is the time consumption to generate the chameleon signature, is to embed random challenge as a watermark into the biometric feature, is to extract the watermark from the biometric feature, and is to check the validity of avatar's virtual and physical identities. It can be seen from Fig. 8 that the total consumption of the two-parties authentication protocol on PC and Smart Phone is within 1000ms, while that on Raspberry is about 2000ms. In general, the proposed authentication framework is efficient on PC and Smart Phone.

Virtual-physical Tracking Consumption on Core Steps:
The identity parameters retained in the authentication process provide conditions for virtual-physical tracking. The specific steps are as follows: (i) the whistleblower submits IDP with the avatar's identity parameters including , , and ; (ii) the IDP checks the validity of virtual identity based on and , checks the consistency of physicalvirtual identity based on and ; (iii) after the above check is passed, the IDP reveals the manipulator's real identity via { , }, which achieves virtual-physical tracking.
The time consumption of the above process mainly involves the feature matching between the iris-encode and biometric template, the extracting watermark from iris-encode, and the verifying signature on the chameleon collision pair. To analyze this consumption, we set the report times for malicious avatars to be 10, 20, 30, and 40 respectively. Through simulations, we get the tracking consumption for virtual-physical tracking as shown in Fig.9. What can be seen from the figure that the average consumption of feature matching is about 75ms, the extracting watermark is about 35ms, and the verifying signature is about 65ms. From the above cost analysis, we can get that the designed authentication framework can not only achieve virtual-physical traceability but also has a low consumption cost.

VII. RELATED WORK
Metaverse players manipulate their avatars based on headmounted display devices. In building an authentication framework, if the avatar is checked only by the device keys, it is hard to ensure the consistency between the avatar in virtual space and its manipulator in physical world; if the avatar is checked only by the player's biometrics, it is difficult to avoid biometrics replay. Therefore, combining device keys and player biometrics is critical for building a traceable authentication framework. At present, researchers mainly design authentication protocols for users or devices through two types of methods, knowledge-based and biometric-based. To the best of our knowledge, there is no authentication mechanism for avatars in the metaverse. In this section, we sort out the above authentication methods to build a traceable authentication framework for avatars.

A. Knowledge-Based Authentication
Knowledge-based authentication methods discriminate the identities of users or devices based on information known only to the entity. For example, the network platform authenticates the login user via their password, and the Internet of Things authenticates the device based on its key.
Password-authenticated: The most widespread authentication method over the Internet is the password-authenticated mechanism. The mechanism relies on server operators as trusted parties to offer secure authentication, giving them full control over users' identities. Zhang [17] constructed a password-based threshold single-sign-on authentication scheme to thwart adversaries from compromising the identity servers. To mitigate the threat of centralized authentication, Szalachowski [18] designed a password-authenticated decentralized identityn by which users register their self-sovereign username-password pairs and use them as universal credentials. This kind of password-authenticated method can realize the security authentication between the device and the service provider. However, these methods require the user to enter a password during the authentication process, which fails to achieve immersive authentication. In addition, anyone can pass the login authentication as long as he knows the password, making this method impossible to guarantee the consistency between the avatar and its manipulator.
Key-authenticated: With the large-scale application of IoT devices, researchers have been working on building a secure and efficient authentication framework [19] based on publicprivate key pairs. Guo [20] designed an asymmetric cryptographic algorithm based on elliptic curve cryptography (ECC) to construct a distributed and trusted authentication system for smart terminals. To achieve that the users' identifying information is controlled by himself, Xu [21] constructed blockchainbased identity management and authentication scheme. Shen [22] presented an efficient blockchain-assisted secure device authentication mechanism for cross-domain IIoT to alleviate the cost of key management overhead and eliminate the problem of relying on a trusted third party. These public keybased authentication methods facilitate one-party authentication without involving a trusted third party, but it is difficult to efficiently realize Device-to-Device (D2D) mutual authentication. Certificateless cryptographic algorithms are widely used to build mutual authentication methods between devices [23] because it avoid key escrow issues. Shang [24] designed an authentication and key agreement protocol to negotiate a group session key securely and effectively in D2D group communications, which merges the advantages of certificates public key cryptography (CL-PKC) and ECC. Gope [25] presents a lightweight and privacy-preserving two-factor authentication scheme in which physically unclonable functions(PUF) have been considered as one of the authentication factors. Li [26] proposes an end-to-end mutual authentication and key exchange protocol for IoT by combining PUF with CL-PKC on an elliptic curve. The above scheme realizes efficient mutual authentication between devices, but the authentication process is separated from the user. If this kind of method is directly used to build the metaverse authentication framework, it is also difficult to ensure the consistency of an avatar and its manipulator. Additionally, the process of generating signatures is cumbersome, which imposes huge computational and communication costs. Therefore, we desire to construct an efficient signature algorithm based on the ideas of chameleon hash [9] and short signature [27] to realize the immersive authentication for the avatar's virtual identity. We utilize and ℎ to denote the verifiability of an entity's virtual identity and physical identity respectively, indicates the immersive authentication between entities, represents the continuous authentication, as the mutual authentication, and as the negotiation of session keys.

B. Biometric-based authentication
Biometrics are inherent information of the human body and there is no risk of being forgotten or lost, making these methods widely used in the verification of the user's physical identity. The type of biometric-based authentication method can be divided into two sub-categories, physiological biometric-based and behavioral biometric-based. The physiological biometric-based methods are primarily based on face [28], iris [29], fingerprint [30] and other characteristics to complete static authentication. The behavioral biometric-based methods rely on walking gait [31], eye movements [32], and response to vibrations [33] to achieve dynamic authentication.
Physiological biometric-based: Owing to its simplicity and accuracy, physiological-based authentication technology has attracted extensive attention of many experts and scholars [12] [34] [35]. Papadamou [36] proposed a privacy-preserving federated architecture for device-centric authentication (DCA) in which the core authentication functionality resides on a trusted entity. To prevent the attacker from knowing the user's biometrics after the database is compromised, Chatterjee [37] proposed practical secure sketches to conceal the correspondence between users and their biometric templates. The above methods realize efficient authentication of device and user identities, but these methods are all one-time authentication methods, which are difficult to guarantee that the user's identity is consistent with avatar's identity.
Behavioral Biometrics-based: To mitigate the vulnerabilities of static biometrics, the behavior-based authentication method realizes dynamic authentication by continuously collecting user biometrics. Zhu [38] designed an unobtrusive real-time user authentication system by which each biometric sample is aggregated into users' implicit events, such as raising hands to check the time on the watch. Li [39] leverages the response of hand-surface vibration to construct a resilient user authentication system. Similarly, Lee [33] proposed a usable method for user authentication through the response to vibration challenges on the user's smartwatches. Wu [40] designed a multimodal biometrics system on smartphones that leverages lip movements and voice for authentication. It can be seen from the above scheme that the behavioral-mentioned authentication mainly solves the problem of dynamic authentication without involving mutual authentication between users. Moreover, these methods are beneficial to complete the continuous authentication between the user's physical identity and their device but are easily limited by physical scenarios, such as, the vibration-response method may be invalid when the user has some items in their hands because the newly added item may interfere with the response value [11].
Multi-factor authentication mechanism is conducive to building an authentication mechanism that meets any scenario, as it eliminates dependence on trusted third parties and avoids the involvement of user behavior. Gunasinghe [41] introduces a three-factor authentication scheme based on a signed identity token that encodes the user's biometric identifier and the password entered by the user into the token. Although this method requires users to enter a password during the authentication process, which disturbs the immersive experience of metaverse players, this method is facilitative to the realization of decentralized mutual authentication for avatars based on player's biometrics and his keys. Inspired by this idea, we designed a decentralized authentication framework based on two factors to achieve the verifiability on avatar's virtual and physical identities and guarantee the virtual-physical traceability.

VIII. CONCLUSION
Metaverse is a virtual-physical coexistence environment where people communicate and work via digital avatars. In the emerging social ecosystems, however, malicious players frequently violate the safety of other avatars, posing a huge challenge to the healthy development of metaverse. For this issue, we design a two-factor authentication framework based on chameleon signature and biometrics, which guarantees the virtual-physical traceability that tracking an avatar in virtual space to its manipulator in physical world. To the best of our knowledge, our method is the first work for avatars tracking in the metaverse field. We hope that the proposed framework could bring a little reference to researchers in related fields.

APPENDIX A SECURITY PROOF FOR CHAMELEON COLLISION SIGNATURE
Theorem: Let G be a multiplicative cyclic group and G be a collision-resistant hash on G, if the DCDH assumption holds on G, the chameleon collision signature is EUF-CMA.
Proof: suppose there is a polytime adversary A that breaks the chameleon collision signature with the advantage of (K), then there must be an adversary B to solve the DCDH on G at least by the advantage of Where is the base of the natural logarithm, is the maximum number of queries to G .
From section V, the process of the game A (K) between A and B is as follows: (1) Adversary B runs (K) and ( ) to select a random function G ← { : {0, 1} * → G}, generate the key pair ( , ), calculate the original chameleon parameters ( , ℎ, , ), and send adversary A with the system parameters and the chameleon parameters.
(2) The adversary A queries the adversary B for the hash and the corresponding signature with any . Adversary B response and as the corresponding answer. During this process, is the maximum number of times A queries G (·).
From the above process, the adversary A wants to find a certain * related to * such that ( * ) = (ℎ/ * ) = * , then, a fake collision ( * , * ) can be successfully output. During the hash query, if * is the hash value of a certain message * , then (ℎ/ * ) = * is the check parameter for * . In step (3), ( * , * ) is generated by adversary A, but G ( * ) is generated by B, so B is able to set * = ℎ/ G ( * ) = ( * ). When B lets * be the potential hash of a target message, his goal is to call A to calculate ( * ) based on the triple ( , 1/ , * ), which is to solve the DCDH problem. As already proven in [13], the DCDH problem is equivalent to the CDH problem. Thus, we convert 's attack target to the CDH problem, that is, calling A to calculate ( * ) based on the triple ( , , * ). Throughout the game, B doesn't know which message will be generated by A to forge a check parameter. Therefore, B has to make a guess that the j-th query corresponds to the final forged result from A.
For simplicity without loss of generality, we assume that: (i). Adversary A will not initiate the same query (·) twice to ; (ii). Adversary A must have asked ( ) before querying the check parameter ; (iii). Adversary A must have asked ( * ) before he outputs ( * , * ). In the actual process, B implicitly regards = in the known tuple ( , = , * ) as its own public key (in fact, B doesn't know the specific value of , then ( * ) is a forged check parameter of a certain message, namely * = ( * ) = (ℎ/ G ( * )) = ( ( * )) , where ( * ) is forged by B. To hide instance = , B needs to select a randomness ← * and send · to A as the public key of B.
The following proves that the EUF-CMA game A (K) of the chameleon collision signature can be reduced to the CDH problem.
(1) B sends the generator of group G and the public key to A, where the private key corresponding to is + , ← * . That is At the same time, B randomly selects ← {1, 2, · · ·, } as the hypothetical index of the forged parameters, that is, the j-th query of from A corresponds to the hash of the target message * .
(2) query (at most times). B creates an empty list and lets the five-tuple (ℎ, , , , ) be the element in it, which means that B has set ( ) = ℎ/ G ( ) = .
When A makes the i-th inquiry to (·), B randomly selects ← * and answers as follows: · If = , return = · ∈ G; · Otherwise, calculate = ∈ G. B takes as the answer to the query ( ) and appends (ℎ, , , , ) to the list . (3) query (at most times). In the process of A requesting the check parameter of a message , B lets = be the i-th query, and answers the query in the following way: · If ≠ , B retrieves the tuple (ℎ, , , , ) in the by , computes = ( · ) , and returns to A, where is the check parameter constructed by ( , ) with secret key + . For From this, we can get the following result: * = ( * ) = ( * ) .
If the guess j from B is correct and A finds a correct forgery, B successfully solves the given CDH problem, that is, B finds * = ( * ) based on ( , , * ) through A. The successful output * = ( * ) from B is determined by the following three events: E 1 : No interruption was encountered during the interaction between A and B. E 2 : A produces a valid "message-parameter" pair ( * , * ). E 3 : E 2 occurs and the subscript of * in the corresponding five-tuple (ℎ, , , , ) is = . Then So the advantage of A is : Since the DCDH assumption holds on G and the DCDH problem equals to the CDH problem, the advantage (K)/( · ) of polytime adversary B is negligible, so the chameleon sign algorithm is EUF-CMA. (Theorem is proved)