  Metaverse is a vast virtual environment parallel to the physical world in
which users enjoy a variety of services acting as an avatar. To build a secure
living habitat, it's vital to ensure the virtual-physical traceability that
tracking a malicious player in the physical world via his avatars in virtual
space. In this paper, we propose a two-factor authentication framework based on
chameleon signature and biometric-based authentication. First, aiming at
disguise in virtual space, we propose a chameleon collision signature algorithm
to achieve the verifiability of the avatar's virtual identity. Second, facing
at impersonation in physical world, we construct an avatar's identity model
based on the player's biometric template and the chameleon key to realize the
verifiability of the avatar's physical identity. Finally, we design two
decentralized authentication protocols based on the avatar's identity model to
ensure the consistency of the avatar's virtual and physical identities.
Security analysis indicates that the proposed authentication framework
guarantees the consistency and traceability of avatar's identity. Simulation
experiments show that the framework not only completes the decentralized
authentication between avatars but also achieves the virtual-physical tracking.
