# Biometrics for Internet-of-Things Security: A Review
## 9 Conclusions  
This review paper scrutinizes a range of biometric systems or techniques for addressing vulnerabilities of different layers of the IoT architecture. Attention is paid to the authentication and encryption aspects of biometric-based systems for the sake of IoT security. Regarding authentication, contemporary biometric systems are discussed and categorized into single-modal or multi-modal biometric authentication systems based on the types and number of biometric traits used. Regarding encryption, bio-cryptosystems utilizing different cryptographic techniques are reviewed. We emphasize that each biometric trait or a combination of traits has strengths as well as noteworthy shortcomings. Moreover, despite the significant advantages of applying biometrics to safeguarding IoT security, potential challenges are highlighted, and possible solutions are presented. To overcome the challenges identified, the authors suggest the following future research directions:  
* Because no single biometric trait can satisfy the needs of all IoT applications, how to select suitable biometric traits for IoT-oriented biometric authentication is a nontrivial task, calling for more research attention. Moreover, although multi-modal biometric systems can reduce the effect of biometric uncertainty and bring about higher authentication accuracy than single-modal biometric systems, the extra cost incurred (e.g.,additional processing and computing time) should be taken into consideration. Due to the resource limitations of IoT devices, how to design efficient and cost-effective multi-modal biometric systems is a much-needed research topic. For example, capturing iris and face biometrics simultaneously saves data collection time and brings convenience to users;
* The implementation of biometric-cryptographic techniques (e.g., fuzzy vault and fuzzy commitment) can provide both authentication and data encryption/decryption for IoT, but the large computing cost of the cryptographic key binding or generation operation and possible performance degradation are certain drawbacks of biocytosystems. Therefore, more research effort should be directed to the development of new biometric-cryptographic techniques which can save cost, while providing satisfactory authentication performance in the IoT environment;
* The spoofing attack to the user interface is a serious security issue concerning biometric systems in the IoT, and the situation is made worse due to IoT's automatization requirement. To the best of our knowledge thus far, there has been little study on this issue in the IoT field; thus, urgent research activities are required to defy spoofing attacks to IoT devices, especially in IoT applications with no human intervention;
* Despite its importance, biometrics for IoT security is a relatively new research area, evidenced by the limited number of articles that can be found in the literature. Given the resource constraints of IoT devices and the issue of user acceptability and/or convenience of collecting biometrics, it is necessary to develop lightweight authentication schemes, preferably with functions such as template data protection or key management so as to strengthen system security. Moreover, a user-friendly course of action is another critical factor to encourage public acceptance of biometrics in the IoT. We believe that the key to the widespread deployment of biometric systems in the IoT is to strike the right balance between privacy and convenience.  
Conceptualization, W.Y., S.W. and C.V.; methodology, W.Y.; writing--original draft preparation, W.Y. and S.W.; writing--review and editing, W.Y., S.W., N.M.S., N.M.K., M.A. and C.V.; supervision, S.W. and C.V.; funding acquisition, W.Y. and C.V. All authors have read and agreed to the published version of the manuscript.  
The work has been supported by the Cyber Security Research Centre Limited whose activities are partially funded by the Australian Government Cooperative Research Centres (CRC) Program.  
The authors declare no conflict of interest.