# Biometrics for Internet-of-Things Security: A Review
## 7 Potential Solutions and Opportunities
### Protecting Biometric Template Data  
Biometric systems provide authentication between users and IoT devices [102], however, during the authentication process, users' sensitive biometric data should be protected. The anonymous technology can be utilized to handle user-identifiable information, but we need to balance the efficacy of privacy protection with the accuracy of results [102]. To achieve this goal, privacy-preserving techniques, such as cancelable biometrics [103] and homomorphic encryption [104], are effective methods in the latest research outcomes. For cancelable biometrics, in the enrollment phase, instead of storing the original biometric data, they are transformed by a non-invertible transformation function to achieve template data protection. In the verification phase, the same non-invertible transform is applied to the query data. Matching between the template and query data is conducted in the transformed domain to reduce the risk of biometric data leakage [105]. Homomorphic encryption is a technique that enables mathematic operations on encrypted data without the involvement of the decryption key. This allows the confidentiality of biometric data to be protected and matching to be performed between encrypted template data and encrypted query data without degrading recognition accuracy. As long as the decryption key is safe, the system is cryptographically secure [106].  
Cancelable biometric authentication aimed for IoT security is proposed in the following research papers. [PERSON] et al. [4] developed a biometric authentication system for IoT devices based on both iris recognition and steganography techniques. In the proposed approach, system security is increased by using random projection-based cancelable biometrics and steganography to hide the user-specific key in cancelable template generation. [PERSON] et al. [107] introduced a cloud-based lightweight cancelable biometric authentication system, which protects template data with the random projection-based cancelable biometric technique. The random projection transforms data points into another version using random orthonormal matrices. In the meantime, distances between data points before and after the transformation are preserved. [PERSON] and [PERSON] [108] provided a partial DCT (Discrete Cosine Transformation)-based privacy-preserving cancelable biometric authentication framework applicable to the IoT. The proposed framework also comprises a session key agreement and data encryption.  
In addition to cancelable biometrics, homomorphic encryption is another technique that renders privacy preservation while maintaining recognition accuracy. [PERSON] et al. [109] proposed an identity management framework for IoT and cloud computing-based healthcare systems using ECG and photoplethysmogram (PPG) signals. To protect users' sensitive biometric data, homomorphic encryption is performed such that data processing and analysis can be conducted in the encrypted domain in the cloud. The proposed framework is evaluated using a machine learning model on a dataset of 25 users. The experimental results show significant improvements in overall performance in terms of authentication accuracy and security, compared to that using just ECG or PPG signals. Although homomorphic encryption applied to biometric authentication enables matching of biometric data in the encrypted domain and generates same matching results as those obtained in the unencrypted domain, how to reduce algorithm complexity and improve computational efficiency is an open question. More work is required in this direction to further cut down computational cost [104].