# Biometrics for Internet-of-Things Security: A Review
## 2 Security Challenges and Vulnerabilities of the IoT  
Due to the limitations and constraints of the IoT in terms of computing capability, power and ubiquity, many security challenges are present in the IoT. The wireless technology, scalability, energy and distributed nature of the IoT are several of the main causes of security challenges [14]. According to [15], there are several underlying factors of the security challenges in the IoT:1. The weakest parts of a system. As the number of IoT devices is rapidly growing, the resource limitations of IoT devices lead to the use of lightweight security algorithms and the security of certain devices is likely neglected. These devices become the weakest parts of an IoT network;
2. Low control over updates. Often, users have a shallow understanding of the internal mechanisms of IoT devices and little knowledge about how to handle online updates, opening up opportunities for security attacks by various malware;
3. Data privacy. Smart sensors in IoT networks collect large amounts of data from different sources, and a certain amount of data may be related to users' personal and sensitive information. The leakage of these data endangers the privacy of users.  
The security challenges in the IoT can be overcome by authentication, confidentiality, integrity, and end-to-end security. Security principles, such as confidentiality, integrity, availability, authentication, lightweight solutions, key management systems and policies, should be implemented to enable a secure communication architecture [14]. Due to the variety of devices and communication protocols in an IoT setting as well as the diverse interfaces and services available in IoT, it is inappropriate to implement security mitigation based on conventional IT network solutions. Security measures (e.g., authentication through cryptographically pre-shared keys) currently utilized in traditional networks may not be adequate [16]. There are many attacks targeting IoT systems of a typical three-layer architecture, which is composed of the perception layer, network layer and application layer [17]. Vulnerabilities of or possible attacks to each layer [2] and security requirements in each layer [18] are listed in Table 1 and expounded in this section.  
\begin{table}
\begin{tabular}{|c|c|c|} \hline
**Layers** & **Attacks** & **Description** & **Security Requirements** \\ \hline \multirow{8}{*}{**Perception Layer**} & Node Tampering & The attacker physically alters the node to obtain sensitive information. \\ \cline{2-3}  & RF Interference & The attacker sends noise signals in the radio frequency spectrum. \\ \cline{2-3}  & Node Jamming & The attacker disturbs the wireless communication using jammers. \\ \cline{2-3}  & Malicious Node Injection & The attacker injects malicious nodes in the network, which can modify data and pass wrong data to other nodes. \\ \cline{2-3}  & Physical Damage & The attacker physically harms components of IoT. \\ \cline{2-3}  & Malicious Code Injection & The attacker introduces malicious code into the nodes of IoT to obtain control of the IoT system. \\ \hline \multirow{8}{*}{**Network Layer**} & Traffic Analysis Attacks & The attacker intercepts and examines messages to obtain network data. \\ \cline{2-3}  & RFID Spoofing and Cloning & The attacker spoofs RFID signals, copies data from a pre-existing RFID tag to another RFID tag. \\ \cline{2-3}  & Man-in-the-middle Attacks & The attacker intercepts the communication between two nodes in the wireless channel. \\ \cline{2-3}  & Routing Information Attacks & The attacker spoofs, modifies or sends wrong routing information to complicate the network. \\ \cline{2-3}  & Denial of Service & The attacker creates a large amount of traffic to flood the network such that the intended users cannot access services. \\ \cline{2-3}  & Sybil Attacks & The malicious node takes the identifies of multiple nodes and acts as them. \\ \hline \end{tabular}
\end{table}
Table 1: Attacks on different layers and security requirements [2].