# A PUF- and Biometric-Based Lightweight Hardware Solution to Increase Security at Sensor Nodes
## 6 Experimental Results and Discussion
### Dual-Factor Authenticated Sensor Nodes  
Another question addressed was to evaluate if a sensor node can be identified unequivocally by its SRAM PUFs and its user, that is, if the sensor node D used by the individual X is the unique node that can obtain the Helper Data \(\left\{HD_{K}^{D}\right\}=\left\{ID_{x}^{D}\oplus\ Koded_{x}\right\}\) and \(\left\{SD_{X}^{D}\right\}=\left\{ID_{x}^{D}\oplus\ QFM_{x}^{X}\right\}\) or similar at registration. Any other node used by another individual cannot be registered with similar Helper and Salted Data. Hence, the node D used by the individual X is the unique node that can provide the required response using the Helper Data \(\left\{HD_{K}^{D}\right\}=\left\{ID_{x}^{D}\oplus\ Koded_{x}\right\}\) and the Salted Data \(\left\{SD_{X}^{D}\right\}=\left\{ID_{x}^{D}\oplus\ QFM_{x}^{X}\right\}\) stored in its non-volatile memory.  
Figure 8a,b illustrate at the left part the genuine distribution of matching scores obtained when the node D used by the individual X (using two fingers and three samples per finger at registration and two fingers and two samples per finger at verification) employs its associated Helper and Salted Data (which means calculation of Equation (7) with the original \(QFM_{x}^{X}\) of user X correctly recovered).  
The impostor distributions shown at the right of Figure 8a,b represent the matching scores obtained when the Helper and Salted Data of one node used by one individual are used by a different node and individual (which means calculation of Equation (7) with QFM-based features incorrectly recovered). Although these impostor distributions are not centered exactly in 0.5 because the bits which compose the QFM-based features are not fully independent, authentication can be carried out without error because the maximum Hdist of the genuine distribution is smaller than the minimum Hdist of the impostor distribution.  
In order to obtain QFM-based features from fingerprints, public and standard databases were employed. In this case, the FVC 2000 DB2a (which includes captures from a capacitive sensor) and the FVC 2002 DB1a (with fingerprints acquired by an optical sensor) were considered. Both fingerprint databases are composed of 800 fingerprint images (100 different fingers from 100 different individuals and eight samples per finger). A virtual database was created with real fingerprints from these databases associated with real SRAM PUFs from measurements of the commercial CC2541 BLE chips. The impostor distributions were determined by the three first samples of a finger (taken as registered data) compared to the two first samples of the rest of individuals (taken as data to match). The genuine distributions were determined by all the possible combinations of three samples (taken as registered data) compared to the rest of combinations of one or two samples (taken as data to match) for the same individual. Each individual is assumed to be recognized by using two fingers (taken consecutively from the database).  
Since the steps of the solution proposed to obtain the QFM-based features allow estimating the quality of the fingerprint sample acquired, the sample is not considered for recognition if it is estimated as a bad-quality acquisition. In addition, two QFM-based features are compared if the recognition area is sufficient. If such fingerprints are not considered, the number of different impostor recognition attempts is: 1315 and 1987, for FVC 2000 DB2a and FVC 2002 DB1a, respectively. The number of different genuine recognition attempts is 2450 and 5160, for FVC 2000 DB2a and FVC 2002 DB1a, respectively. When a QFM is obtained with a recognition area smaller than 1024 bits, padding is applied to reach the fixed length of 1024 bits.