# Biometrics for Internet-of-Things Security: A Review
## 4 Biometric-Based Systems for IoT-Oriented Authentication
### Biometric Authentication and Key Agreement  
As authentication and key agreement are two of the main security requirements in IoT applications [2], several existing research articles discuss both authentication and key agreement. [PERSON] et al. [76] proposed a smart card- and password-based two-factor user authentication scheme for mutual authentication and key management between the user and server. The proposed scheme can defend several common attacks (e.g., smart card stolen attacks and password guessing). Improving on [56], [PERSON] et al. [77] developed anonymous authentication and key exchange in the mobile client-server environment. The proposed scheme is immune to attacks such as user impersonation, insider, and trace attacks, which the scheme in [56] suffers. To further strengthen the security of two-factor user authentication and key agreement, biometrics is utilized as the third factor to withstand the stolen card attacks. For example, [PERSON] and [PERSON] [78] combined biometric-based authentication with key agreement for secure authentication in multi-server communication environments. A reinforced user authentication function is obtained by using biometrics, while a strong key agreement is provided by adopting the elliptic curve cryptosystem, reducing the computational load on smart cards. [PERSON] et al. [79] proposed secure biometric-based user authentication and key agreement for cloud computing with additional functionalities, such as efficient password and biometric data update and support for multi-server environments. _Biometric authentication and key agreement with privacy protection_: Although incorporating biometrics can enhance the security level of the key agreement process between the user and server, vulnerabilities associated with biometric data in the key agreement process may lead to exposure of user identity and privacy. To resolve this issue, [PERSON] and [PERSON] [80] presented a multi-server authentication and key agreement method using three factors, smart cards, password and biometrics to ensure user anonymity and defend several types of attacks. This method is claimed to be lightweight and cost-effective. [PERSON] et al. [81] improved [PERSON] and [PERSON]'s method in [80], claiming that it is vulnerable to the stolen smart card attack and the denial-of-service attack. The improved method can prevent adversaries from obtaining the previously established session keys from the stolen smart card, while keeping the merits of [PERSON] and [PERSON]'s method (e.g., user anonymity and low computational cost). [PERSON] et al. [82] designed a privacy protection scheme, which can provide biometric authentication at the server side and make the biometric template unknown to the server in the e-health environment. In this way, user privacy is preserved in the authentication and key agreement process. _Group-based biometric authentication and key agreement_: Group-based authentication and key agreement is a promising technique to tackle issues such as congestion and overburden. [PERSON] and [PERSON] [83] proposed a lightweight group-based authentication and key agreement protocol using elliptic-curve Diffie-Hellman cryptography. With this protocol, the server can authenticate devices in the group simultaneously in wireless networks, while utilizing bandwidth efficiently by reducing congestions. Cryptanalysis and performance evaluation of the proposed protocol show favorable outcomes. [PERSON] et al. [84] introduced a group-based lightweight authentication and key agreement to provide mutual authentication for a large number of heterogeneous mobile devices. Because the proposed scheme involves only hash functions rather than symmetric or asymmetric encryption operations, it achieves considerably better performance than the existing methods in terms of network overheads. The use of biometrics in group-based authentication and key agreement heightens the security level. [PERSON] et al.