# Biometrics for Internet-of-Things Security: A Review
## 4 Biometric-Based Systems for IoT-Oriented Authentication
### Single-Modal Versus Multi-Modal Biometric Authentication Systems
#### 4.1.1 Single-Modal Biometric Authentication Systems
[36] developed an ECG-based biometric system that acts as the communication interface between users and IoT devices for authentication purposes. The ECG is utilized in this study given its advantages in security, convenience, and implementation over other biometric traits. [PERSON] et al. [37] presented a real-time ECG-based authentication system for IoT. The discrete cosine transform (DCT) is used to extract the ECG feature vectors. This system can achieve an accuracy rate of 97.78% with a processing time of 1.21 s. [PERSON] et al. [61] implemented a biometric system making use of techniques such as obfuscation and physically unclonable functions to mitigate the risk of compromising biometrics under different malicious attacks. Moreover, a noise-aware biometric quantization framework is proposed in this work to generate unique, reliable keys with reduced processing time. Without complex processing, [PERSON] et al. [38] proposed a feature selection algorithm utilizing fiducial points from the ECG signal records. The number of features used is less than 10, achieving 98.2% recognition accuracy over the stress recognition database. [PERSON] et al. [39] proposed a biometric quantization framework that can generate unique and high-entropy keys costing less enrollment time. The experimental results show that extracting the key from ECG rather than other biometric traits makes a good trade-off between reliability, security, and cost. _Voice_: [PERSON] and [PERSON] [40] applied a voice-based recognition system to increasing the security and convenience of the home-IoT devices as it is a security risk if the home-IoT devices are operated by unauthorized voices. By recognizing the identity and analyzing the commands of the user, the voice recognition system ensures that only authorized users can control the home-IoT devices. [PERSON] et al. [41] investigated the suitability of using voice for IoT authentication. In this research, the techniques and tools applied to voice authentication are reviewed and discussed. There are two phases of the proposed system, the enrollment phase and the verification phase. Specifically, in the enrollment phase, noise is first removed from the voice signals and then feature extraction is conducted. After that, the extracted features are input into a machine learning algorithm for training. In the verification phase, the query voice features are extracted in the same way as in the enrollment phase and tested against the trained model for verification. _Others_: [PERSON] et al. [58] presented an authentication framework for the IoT in eHealth using biometric modules and wireless device fingerprinting. The proposed framework verifies whether the sensed data comes from the correct patient and ascertains the integrity of the data received. The patient's behavioral features are used for continuous biometric authentication. When the received biometric data cannot match the stored template, the system assesses whether the patient suffers a heart attack and if so, an alarm is triggered at the server and a notification is issued to the hospital system. In comparison with password-based or two-factor authentication methods, [PERSON] et al. [42] explored finger-vein-based user authentication to achieve a more secure IoT environment. In the proposed scheme, an efficient local descriptor, called histogram of competitive orientations and magnitudes, is used to represent the finger-vein patterns in finger-vein impressions. [PERSON] et al. [43] designed an iris recognition system to secure the communication between the IoT devices and the broker server. The two feature vectors extracted by different algorithms are fused into one. The size of the fused feature vector is then reduced and input into the Euclidian Distance classifier for classification. [PERSON] et al. [62] presented a conceptual view about the application of iris-based authentication in the IoT. The authors identify the difficulty of applying iris authentication to IoT devices.