BLOcKeR: A Biometric Locking Paradigm for IoT and the Connected Person

• Published in: Journal of hardware and systems security Vol. 5; no. 3-4; pp. 223 - 236
• Main Authors: Shomaji, Sumaiya, Guo, Zimu, Ganji, Fatemeh, Karimian, Nima, Woodard, Damon, Forte, Domenic
• Format: Journal Article
• Language: English
• Published: Cham Springer International Publishing 01-12-2021; Springer Nature B.V
• Subjects: Access control; Biometrics; Circuits and Systems; Computer Hardware; Cybersecurity; Engineering; Hardware; Information Systems Applications (incl.Internet); Internet of Things; Locking; Privacy; Systems and Data Security; Theft; Biometrics; Internet of things; Physically unclonable functions; Hardware obfuscation
• ISSN: 2509-3428; 2509-3436
• DOI: 10.1007/s41635-021-00121-5

As the internet-of-things (IoT) era begins, there is a significant need for low-cost access control schemes that allow humans to activate and maintain IoT systems.Traditional biometric access control systems remain, however, vulnerable to physical attacks resulting in template theft/privacy, illegal access, etc. This paper aimed to address this by expanding on a proposal called BLOcKeR, which combines biometrics with two recent advances in hardware security—physically unclonable functions (PUFs) and hardware obfuscation. Hardware obfuscation is a technique to protect electronic hardware against access control circumvention attacks through locking mechanisms. A PUF is incorporated to tie the biometrics of the owner to the system. Combining these advances with biometrics, BLOcKeR protects a biometric system from physical attacks by locking its functionality and aims at ensuring successful activation of the locked system unlike the authentication /matching in biometric systems. In addition, unlike various existing approaches, BLOcKeR does not store the raw biometric of users while providing irreversibility, unlinkability, and revocability to the templates. We present a security analysis and experiments with more than 45,000 attack variants to evaluate BLOcKeR’s security against unauthorized access.