# Biometrics for Internet-of-Things Security: A Review
## 1 Introduction  
The Internet of Things (IoT) contains a variety of devices, such as wearable devices, smartphones, computers, personal digital assistants (PDAs), and tablets. These devices, which consist of embedded sensors and processors that can handle their internal states or the external environment around them have become part of people's daily necessities because of their decreasing cost, mobility and increasing computational capability. IoT includes a great diversity of smart devices collaborating to bring convenience and accessibility to people's lives [1]. The benefits of IoT are immense and its applications are revolutionizing the manner in which we work and live. It also generates new opportunities for innovation, growth and knowledge sharing between different entities [2]. With a sharp increase in the number of IoT devices, these interconnected smart devices can be deployed in a variety of fields and their applications include but are not limited to smart homes, smart cities, environment, agriculture, smart grid, industry, healthcare, and transport. Application domains of the IoT are illustrated in Figure 1.  
However, the low power and limited computing capacity constraints do not allow sophisticated security policies on IoT devices. The large number of interconnected IoT devices provokes a rapid increase in attacks from adversaries. With far inadequate awareness of IoT device users and vendors on the perils of IoT security, these IoT devices, in turn, are becoming a source of potential risks. Attackers can gain control of certain internal and open environments by accessing and probing into IoT devices (e.g., water outages,shortage of public electronic supply and tampering with the functionality of devices). Such security threats are concerning [3]; a house attached to any IoT device is an open invitation to attackers. In light of the above-mentioned security risks for IoT devices, it is vital to have proper access control in order to protect user privacy and prevent on-device data from being leaked [4]. Passwords used to be the only way of user authentication in the IoT, but times have changed. In the past decade, biometric technology has developed in leaps and bounds and has swiftly spread to almost every corner of our daily lives as a more reliable method of authentication. With the popularity of smartphones, it is a winning combination of mobile phones and biometrics in the consumer market, allowing biometric authentication to be more widely accepted. Since Apple started its incredibly usable biometric recognition, named Touch ID, in 2013 [5], the application of biometrics has expanded rapidly. Currently, IoT devices mounted with biometric modules are standalone products in the market. A recent biometric technology market data report published by ABI Research forecast that biometric recognition systems in smartphones would grow significantly to make a 95 percent penetration rate of smartphone shipments by 2022 [6]. Biometric recognition uses physical traits of human beings (e.g., fingerprint and face) for identification or verification. It overcomes the drawback of password-based authentication [8] and is becoming more prevalent with advancements in sensing technologies. Although biometric systems are advantageous over traditional password-based authentication, biometric information stored as template data in central databases or smart devices is vulnerable because any individual's biometric traits cannot be changed or reissued, similar to passwords. Once biometric template data are compromised, the effect is forever, and privacy infringement and security breaches are likely to occur. If an adversary gains access to IoT devices using stolen biometric templates, it can put sensitive data or records stored in the devices at serious risk. Therefore, the importance of protecting biometric template data is twofold. First, user identity should be protected such that original biometric information cannot be retrieved.