# A PUF- and Biometric-Based Lightweight Hardware Solution to Increase Security at Sensor Nodes
## 7 Conclusions  
Security at sensor nodes is increased by means of a dual-factor authentication based on the unique physical identity of the node and the physical presence of the legitimate user. SRAM PUFs extracted from commercial BLE communication modules allow obfuscation of sensitive data into non-sensitive Helper and Salted Data. In the one side, only the trusted sensor node is able to recover from the Helper Data the 128-bit secret keys used to provide confidentiality and integrity to the transmitted messages as well as to derive fresh session keys. In the other side, only with the physical presence of the legitimate user, the trusted sensor node is able to recover from the Salted Data the secret set of 1024-bit fingerprint features whose hash is transmitted to provide non-repudiation. The proposed lightweight communication protocol reduces the possibilities of remote attacks to recover the sensitive information. Results from the BLE PUFs and the fingerprints of the public and standard databases FVC 2000 DB2a and FVC 2002 DB1a show that even stealing the sensor node, the probability of successful impersonation attacks is low. Besides, if an attacker accesses the Salted Data in two different sensor nodes, he/she is not able to discover if they have been generated by the same or different individuals because they show high unlinkability. Implementation results show that the fingerprint recognition of the user (which is computationally more costly than the hardware recognition of the PUF) can be executed as software in microcontroller units, featuring power consumptions of only a few milliwatts, feature extraction times of only a few seconds, and matching times below the millisecond. Hence, hardware required is so lightweight that the proposed security solution can be fully implemented in the sensor node.  
**Author Contributions:** [PERSON] proposed and evaluated the fingerprint feature and its combination with SRAM PUFs and contributed to the design of the dual-factor authentication protocol. [PERSON]-D. performed the extraction of SRAM PUFs from the BLE module, proposed the secret key obfuscation scheme, and designed the dual-factor authentication protocol. [PERSON] designed the dual-factor authentication protocol and implemented the fingerprint  
Figure 12: Fractional Hamming Distances obtained for sequences generated by RND cells.  
recognition solution in the microcontroller platforms selected. [PERSON] contributed to the design of the complete solution, the selection of the algorithms and the experiments, and coordinated the team. All authors contributed to writing the paper.  
This work was supported in part by TEC2014-57971-R project and TEC2017-83557-R from Ministerio de Economia, Industria y Competitividad of the Spanish Government (with support from the PO FEDER-FSE) and 201750E010 (HW-SEEDS) project from CSIC. The work of [PERSON] was supported by a Post-Doc Fellowship from the Spanish National Cybersecurity Institute (INCIBE). The work of [PERSON] was supported by V Plan Propio de Investigacion through the University of Seville.  
The authors would like to thank [PERSON] for the first experiments with BLE chips.  
The authors declare no conflict of interest.