  With the emergence of the Internet-of-Things (IoT), there is a growing need
for access control and data protection on low-power, pervasive devices.
Biometric-based authentication is promising for IoT due to its convenient
nature and lower susceptibility to attacks. However, the costs associated with
biometric processing and template protection are nontrivial for smart cards,
key fobs, and so forth. In this paper, we discuss the security, cost, and
utility of biometric systems and develop two major frameworks for improving
them. First, we introduce a new framework for implementing biometric systems
based on physical unclonable functions (PUFs) and hardware obfuscation that,
unlike traditional software approaches, does not require nonvolatile storage of
a biometric template/key. Aside from reducing the risk of compromising the
biometric, the nature of obfuscation also provides protection against access
control circumvention via malware and fault injection. The PUF provides
non-invertibility and non-linkability. Second, a major requirement of the
proposed PUF/obfuscation approach is that a reliable (robust) key be generated
from the users input biometric. We propose a noiseaware biometric quantization
framework capable of generating unique, reliable keys with reduced enrollment
time and denoising costs. Finally, we conduct several case studies. In the
first, the proposed noise-aware approach is compared to our previous approach
for multiple biometric modalities, including popular ones (fingerprint and
iris) and emerging cardiovascular ones (ECG and PPG). The results show that ECG
provides the best tradeoff between reliability, key length, entropy, and cost.
In the second and third case studies, we demonstrate how reliability, denoising
costs, and enrollment times can be simultaneously improved by modeling subject
intra-variations for ECG.
