  Recent years have witnessed the fast penetration of Virtual Reality (VR) and
Augmented Reality (AR) systems into our daily life, the security and privacy
issues of the VR/AR applications have been attracting considerable attention.
Most VR/AR systems adopt head-mounted devices (i.e., smart headsets) to
interact with users and the devices usually store the users' private data.
Hence, authentication schemes are desired for the head-mounted devices.
Traditional knowledge-based authentication schemes for general personal devices
have been proved vulnerable to shoulder-surfing attacks, especially considering
the headsets may block the sight of the users. Although the robustness of the
knowledge-based authentication can be improved by designing complicated secret
codes in virtual space, this approach induces a compromise of usability.
Another choice is to leverage the users' biometrics; however, it either relies
on highly advanced equipments which may not always be available in commercial
headsets or introduce heavy cognitive load to users.
  In this paper, we propose a vibration-based authentication scheme, VibHead,
for smart headsets. Since the propagation of vibration signals through human
heads presents unique patterns for different individuals, VibHead employs a
CNN-based model to classify registered legitimate users based the features
extracted from the vibration signals. We also design a two-step authentication
scheme where the above user classifiers are utilized to distinguish the
legitimate user from illegitimate ones. We implement VibHead on a Microsoft
HoloLens equipped with a linear motor and an IMU sensor which are commonly used
in off-the-shelf personal smart devices. According to the results of our
extensive experiments, with short vibration signals ($\leq 1s$), VibHead has an
outstanding authentication accuracy; both FAR and FRR are around 5%.
