Thank you for visiting nature.com. You are using a browser version with limited support for CSS. To obtain the best experience, we recommend you use a more up to date browser (or turn off compatibility mode in Internet Explorer). In the meantime, to ensure continued support, we are displaying the site without styles and JavaScript.
Advertisement
Scientific Reports volume 15, Article number: 5464 (2025)
Metrics details
The Internet of Things refers to networks of physical, technological devices connected via the Internet, allowing them to communicate and exchange data. Such environments face security issues like verifying users using Internet of Things devices, for example, in a company or hospital or properly securing user communication. Communication security largely relies on the security of symmetric keys, which we use to encrypt messages. This paper introduces a novel approach to verifying the identity of users of Internet of Things environments and generating symmetric keys between two users to communicate between them. The verification system identifies users using images captured from the camera. Thus, the proposed symmetric keys generation method uses biometric parameters representing the coordinates of a triangle from the two users’ faces biometry and the time factors. The triangle coordinates are located between the corners of the left and right eyes and the chin. Then, these coordinates and time factors undergo mathematical processing to obtain an alphanumeric symmetric session key. We tested the entire system, obtaining a high precision score regarding user identity verification, and additionally examined the possibility of breaking the generated symmetric keys. All keys were characterised by high entropy and resistance to brute-force attacks.
The Internet of Things (IoT) is an emerging technological phenomenon with significant promise. IoT refers to a network that includes physical, intelligent items interconnected over the Internet, enabling them to communicate and exchange data. These devices are equipped with sensors, actuators, and processors, enabling them to gather environmental data, react to events, and execute targeted actions depending on the gathered and processed data1,2. Therefore, it is possible to identify numerous solutions in which IoT devices are employed. IoT has been effectively utilized for various purposes such as managing lighting3, heating, ventilation, and air conditioning, monitoring of security4, intelligently managing road traffic5, automating production processes, and monitoring machines and devices6. Healthcare is a significant domain in which IoT devices find applications. In this context, the solutions are predominantly employed to monitor patients’ health, facilitate remote diagnostics and treatment, and serve as threat warning systems7,8.
Intelligent technologies can simplify daily tasks and enhance overall convenience. Nevertheless, IoT solutions possess various benefits, drawbacks, and obstacles. The indisputable benefit of this technology is its ability to automate processes and tasks, resulting in substantial time and cost reductions. Therefore, optimising energy and resource usage can yield concrete financial advantages. Conversely, adopting and overseeing IoT systems can be intricate, and implementing such systems might incur significant expenses, particularly for small enterprises and institutions. Consequently, the requirement for standardised solutions and compatibility among devices produced by various manufacturers might provide challenges to integrating systems1,2.
Security is a crucial aspect of IoT technology, encompassing its applications for security purposes and the security of the technology itself. IoT allows for the monitoring and analysis of data, which can be used to prevent failures and accidents9. However, the accessibility of IoT device data from anywhere and at any time presents challenges regarding data security, device and user security, and network security. Collecting and processing personal data may compromise privacy, and IoT devices are vulnerable to cyberattacks10,11.
Security in IoT environments should primarily focus on verifying users’ identities and generating symmetric keys for communication between them. User identity verification can be done in many ways, which may provide different levels of security and be susceptible to various breaches. The safest way to confirm a user’s identity is to use multi-factor authentication, which involves several elements, the so-called factors. Knowledge factor refers to the user’s knowledge (for example, password, PIN code, answer to a security question). The possession factor refers to what the user physically has (for example, a mobile phone from which he will read an SMS or generate an authentication code, hardware token, access card, or USB key with an authentication function). The inherence factor refers to what the user is – his or her biometric features (for example, fingerprint, facial recognition, iris scanning).
The possession factor is the most commonly used authentication factor and is more vulnerable to internet attacks. Multi-factor authentication greatly increases security because an attacker would need to access several different forms of authentication, which is much more complex than getting just the password. This makes user accounts much more resistant to phishing, brute force, and other identity theft attacks.
The second significant security concern in IoT contexts is the creation of symmetric keys that are either long-term or short-term. The users use symmetric keys to secure communication. Symmetric key generation is a crucial component of security in cryptographic systems. Keys that are produced incorrectly can result in significant security problems. Multiple issues can be discerned in the context of producing symmetric keys. One requirement is the necessity for increased randomization. To guarantee sufficient security, symmetric keys must possess a random nature. An attacker can crack the key and access protected data if the key is predictable. The key’s length, which directly impacts the level of security, requires revision. Keys with shorter lengths are more vulnerable to being broken. Hence, selecting a key length that matches the desired level of security for the application is crucial12,13.
At every stage of communication, it is imperative to ensure that the symmetric key remains confidential and is securely stored, as any mishandling or unauthorized exposure of the key could result in a security breach. Another issue associated with symmetric keys is the procedure of generating them. The procedure of generating the key must be conducted to ensure high security. Weak or insecure key generators can lead to predictable keys, a significant security threat. For instance, symmetric keys are susceptible to attacks that exploit traffic analysis. An adversary may attempt to gather information about the key by monitoring traffic patterns or analyzing data streams14,15,16.
Based on the findings of these investigations, this work introduces a biometry-based verification system with a novel approach for generating symmetric keys between two users of IoT devices. The proposed verification system employs Artificial Intelligence methods to verify IoT environment users correctly. Thus, the key generation method allows for preparing symmetric keys using biometric data, which consists of the coordinates of a triangle formed by the left and right eye corners and the tip of the chin. Subsequently, these coordinates undergo mathematical processing. The outcome is a symmetric key that consists of both letters and numbers. Our primary contributions are as follows:
the assumptions of the communication and verification system,
the proposition of the biometry-based symmetric key generation method for IoT solutions,
preliminary tests of the proposed methods using real and generated photos.
The rest of this paper is organised as follows. Section Methods presents the communication flow and assumptions of the proposed system. Also, it describes the assumptions of the verification system, explains the proposed approach for generating symmetric keys based on biometry, and provides an illustrative example of its use. Section Results and Discussion discussed the initial test results of the proposed approach. The article’s concluding section provides a comprehensive summary, presents the research findings, and delineates our future objectives.
This section presents our considerations regarding communication security and using symmetric keys, a significant aspect in IoT environments. We will introduce the proposed system’s assumptions, including the concept of Artificial Intelligence-based verification. We will also describe a biometry-based symmetric key generation method.
Symmetric keys are employed for the encryption and decryption of data. As previously stated, symmetric keys must possess sufficient length and randomness to render them challenging for potential attackers to guess. Furthermore, utilising algorithms acknowledged as secure and safeguarding keys from loss, duplication, or unwanted entry is vital. Commonly employed methods for generating symmetric keys include Password-Based Key Derivation Function algorithms such as PBKDF217and bcrypt18. They enable the generation of cryptographic keys by combining a password with a randomly generated data string called a salt. This enhances the level of difficulty for assaults that rely on dictionary-based methods.
Additionally, hash functions are employed to generate keys. As an illustration, SHA-119produces keys that are 160 bits in length. Although it may be implemented quickly and easily, this technique is less secure than other algorithms. SHA-256 produces cryptographic keys that consist of 256 bits. While SHA-1 is less secure, it is also faster than the method mentioned in20. The HMAC (Hash-based Message Authentication Code) approach21 utilizes a hash function to derive a key from a secret key and a random value. While it offers enhanced security compared to SHA-1 and SHA-256, it is also characterized by slower processing speeds.
An efficient method for generating symmetric keys involves utilizing a random number generator. To prevent prediction attacks, it is necessary to ensure high-quality randomization. Algorithms such as Yarrow, Fortuna, or ANSI X9.31 can produce keys with varying lengths. Although they offer both safety and speed, these methods necessitate a substantial quantity of entropy22. Hardware Random Number Generators enhance the security of specific systems by providing a physical foundation for generating random numbers. This hardware-based approach significantly strengthens the system’s defence against computer attacks, particularly those targeting the software-based random number generator23.
Symmetric keys in Elliptic Curve Cryptography procedures are derived from mathematical operations on points on the elliptic curve. Algorithms such as the Elliptic Curve Diffie-Hellman or the Elliptic Curve Digital Signature Algorithm produce keys with varying lengths. Additionally, they possess high security and efficiency, although they necessitate substantial entropy. Only Key Expansion Algorithms can be mentioned. Symmetric encryption systems, like AES (Advanced Encryption Standard), employ methods to extend a short key into a longer key during the initialization process. As an illustration, AES-256 employs a 256-bit key, but it internally creates a more extensive set of keys for the rounds of encryption24. The Diffie-Hellman Key Exchange protocol generates symmetric keys by utilizing a shared secret key acquired through the exchange of public keys25.
Other solutions for symmetric key generation were proposed by Sarkar et al.26,, Sahin et al. in27or Odeh et al. in28. We analysed these methods and compared them with our solution.
Sarkar et al. in26 proposed a biometric feature-based method of cryptographic key generation and sharing, in which minutiae are extracted from the fingerprints of both parties that are going to communicate with each other. A key was generated by transforming the biometric data into cancelable templates and shares between parties to obtain a standard symmetric key. It included extracting minutiae, transforming them into irreversible templates, exchanging the encrypted templates, and finally generating the symmetric key by a zero threshold. Although interesting and secured against biometric data compromise by using irreversible templates, this method is more complicated and resource-intensive in the context of its potential application in IoT. The method here encounters limitations resulting from small device resources.
Sahin et al. in27 proposed a key generation algorithm for Orthogonal Frequency-Division Multiplexing systems that uses Channel State Information data to extract randomness from the wireless channel. Keys are generated based on fading trends, while the algorithm avoids disclosing sensitive data in the open medium. This method may be less robust to attacks in environments with rapid channel variability (IoT). Due to the requirements on channel coherence and the number of transmitted packets, its application in resource-constrained IoT devices may be problematic. This means that limitations in power, CPU, memory, and channel dynamics in IoT environments make this algorithm less efficient in practical use, especially when compared to the biometrics-based method, which requires less network traffic and is more adaptive to the heterogeneity of IoT environments.
Odeh et al. in28 presented a cryptographic algorithm based on generating public and private keys using binary images. The algorithm has three phases: key generation, data encryption and decryption. Generating keys from an image requires processing binary matrices (16×16) and performing arithmetic operations (division, sum, concatenation). This process can be challenging in IoT devices with limited resources (CPU, RAM), especially with many operations. Storing and transmitting binary images requires additional memory resources and network bandwidth, which can be challenging in IoT devices with limited memory. The algorithm assumes that the sender and the recipient have the same binary image. The entire cryptographic system loses effectiveness if this image is intercepted or compromised. The public and private keys are generated from the same image. Lack of rotation or dynamic key generation can lead to vulnerabilities (e.g. brute force attacks or image reconstruction based on key analysis). Moreover, introducing bit grouping, matrix calculations, or key generation can increase processing time in low-computing environments. The binary image-based algorithm is an interesting concept, but it is not optimal for IoT environments. The main issues are high resource requirements, dependence on image synchronization, and potential security risks in case of image compromise.
Comparing the approaches we have presented to generating keys with our approach, we can point out several essential advantages. In our solution, we operate on lightweight and straightforward mechanisms that do not require intensive data processing, as in the case of binary images, nor do we require additional mathematical operations on matrices or dividing data into groups of bits, significantly reducing the load on the processor and memory. For this reason, our approach is suitable for implementation in IoT environments. Our approach is optimized for IoT devices, which often have limited hardware capabilities and are not equipped with advanced graphical mechanisms.
Symmetric keys are essential in cryptography as they provide confidentiality, integrity, and data availability. They are a fundamental cryptographic tool that offers numerous advantages, including data encryption, efficiency, speed, and ease of administration. Despite their shortcomings, such as their vulnerability to man-in-the-middle attacks, they are extensively employed in diverse domains to guarantee data security and secrecy.
We can identify several security and privacy concerns associated with generating symmetric keys from the information provided. Key generation methods that are predictable or lack adequate randomness might result in weak keys that are readily guessed or cracked. To prevent the development of predictable keys, it is essential to utilize a dependable random number generator or source of entropy when creating symmetric keys. This is because the absence of actual randomness can result in keys that are more vulnerable to attacks. If the symmetric key is stolen or released, anyone who possesses it can decode all encrypted data. This vulnerability is exacerbated when the same key is utilized for various reasons. Individuals with malicious intent with authorized access to the encryption key can decipher and alter confidential information. To ensure the secure storage of the key, it is often necessary to use specific hardware security modules (HSMs) or implement strong encryption while the key is at rest. Inadequate storage, such as plaintext on a standard drive, can leak the encryption key. Ensuring the secure transmission of the key over communication channels can be difficult, particularly in large-scale deployments. Unsecured transmission systems can result in interception and compromise. A consistent practice of periodically changing encryption keys and securely disposing of outdated ones is essential to reduce the potential dangers of unauthorized access over time effectively. Symmetric key encryption usually lacks strong authentication capabilities and requires additional procedures to authenticate the parties’ identities. Although quantum computers are nascent, their development presents a theoretical threat to the security of current symmetric encryption techniques.
This section will outline the proposed system’s communication process and underlying assumptions. The system assumes a single role: the User of an intelligent IoT device equipped with a camera, wireless communication modules like Bluetooth, Wi-Fi, or LTE, and a client application. The client application provides comprehensive system functionality for devices operating within the IoT environment. The client application facilitates safe communication by enabling the sharing of face parameters and the production of symmetric session keys. Figure 1 shows the communication flow of the concept of the proposed system.
Proposed system communication flow. Various users operate in the selected IoT environment (company, hospital, etc.). Data about them is stored in a database. The scope of data stored depends on the specific IoT environment. The most critical data stored in the database is the User’s portrait photo, which enables verification. Mechanisms to verify user identities are necessary to secure access to resources or specific rooms in a building where the IoT environment has been implemented. In addition, users of the IoT environment may need to communicate with each other and send some data. In such situations, a symmetric session key is required. First, each User takes a self-portrait photo using the client application. Then, the application detects the necessary coordinates and transmits them to the second User, for example, via Bluetooth. Facial parameters are encrypted using asymmetric cryptography. Both users’ devices process the incoming parameters and independently generate an identical symmetric session key. The key will be used for one session, so it is assigned an expiration time. The default expiration number is one hour; however, users have the control to increase or decrease it in the app, empowering them to manage their security settings, for example, if one session will be longer than one hour.
The concept of a system for users’ identity verification will be based on deep learning techniques such as Convolutional Neural Networks. It will be necessary to prepare a set of training, validation, and testing data, which will then be used to train the created system and analyze and verify the correct operation of the system. The system should detect a face in the photo and match it to the user’s face pattern saved in the database. This mechanism will enable verification of the identity of users of a given environment and allow them to proceed to the next stage of system operation.
The possible architectures for detecting and recognizing objects in real-time are the YOLO v429and MobileNetV330,31 architectures. The YOLO v4 model is trained using an extensive dataset encompassing many object categories. The YOLO v4 architecture incorporates the following components. The backbone component is tasked with extracting features from input photos. The neck component consolidates multi-scale characteristics extracted from the backbone. The head component of the system is responsible for estimating the probability of different object classes, determining the coordinates of the bounding boxes, and calculating objectness scores. MobileNetV3 is a neural network architecture designed for mobile devices and other systems with limited computing resources. This architecture uses depthwise separable convolution blocks, which divide the convolution operations into two stages: depthwise convolution and pointwise convolution. This allows for a significant reduction in the number of parameters and calculations.
Our method for recognizing the user will consist of the following stages. In the first stage, the system will acquire input images from devices connected to the network. Next, the system will apply adaptive histogram equalization and Gaussian filtering-based preprocessing of the received images. The system will perform object detection and recognition and calculate the uncertainty associated with each bounding box prediction during the next stage. Next, the system will exclude inaccurate forecasts by applying a threshold for uncertainty and integrate data from several sources by employing a probabilistic graphical model. As an output, the system will develop an in-depth understanding of the seen situation, encompassing identified objects and their respective positions.
To improve our method, we will consider the following assumptions. We utilize adaptive histogram equalization and Gaussian filtering techniques on the input photos to account for different lighting conditions and sensor noise. By performing this preprocessing step, the contrast is heightened, and noise is diminished, resulting in an overall enhancement of the input data’s quality for object detection. We integrate an uncertainty modelling method into the YOLO v4 and MobileNetV3 architectures to manage imprecise input effectively. This process entails the computation of the uncertainty linked to each bounding box prediction. This uncertainty is determined by merging the objectness score and the probabilities of each class. Uncertainty values are subjected to a threshold to exclude incorrect predictions. To enhance the resilience of our approach, we utilize data fusion methodologies to amalgamate data from many sources, including security cameras and drones. The fusion method entails aligning spatial and temporal data and utilizing a probabilistic graphical model32 to merge the information and generate a cohesive comprehension of the observed scene.
The proposed system will be integrated seamlessly with the available IoT environment. Surveillance cameras, drones, and mobile devices would be used as data sources that send biometric data through secure communication protocols. To protect this data’s privacy and security, all transmitted data shall be encrypted using dynamically generated symmetric keys during verification. Compatibility of the system with IoT frameworks further enables real-time identity verification in a distributed network.
System performance shall be tested based on key metrics such as verification time, True Positive Rate (TPR), False Positive Rate (FPR), and accuracy. Testing in different environmental conditions-such as variation in lighting, device quality, and network latency-shall be performed so that the system proves strong and reliable in real-world deployments.
The system can be applied in various domains. Subsequent system enhancement may entail integrating blockchain technology to bolster the confidentiality of transmitted data and incorporating sophisticated neural network designs to augment detection accuracy. Alternative approaches involve enhancing the system’s capabilities to identify and assess user emotions or behaviors for more thorough identification verification.
Diagram of YOLO v4-based verification system (based on29). The exemplary face used in this figure is a fake face created by the Midjourney bot33.
Figure 2shows a verification diagram using YOLO v4 based on29.
Triangle with coordinates on the face. This exemplary face is a fake face created by the Midjourney bot33.
The proposed approach to generating symmetric keys is based on biometrics. The client application generates an identical key on both devices using the biometric data of the two users. After one User takes a selfie, the system calculates the coordinates of the left corner of the eye, the right corner of the eye and the chin. These points are shown in Figure 3. This exemplary face was created by the Midjourney bot33. The coordinates of these locations typically depend on several aspects, such as image dimensions, resolution, the position of the face in the image, and the angle and orientation of the face. This is especially important due to the different devices used by users. We assumed that the application would record images of the same size and resolution regardless of the instrument used by the User. This assumption will also reduce the communication load when sending too large photos.
Additionally, the application will indicate a specific frame in which the User’s face should be located. This assumption will guarantee accurate positioning of the face, the angle at which it is captured and its orientation within the image. The system then sends the coordinates to the second User. The system encrypts messages containing coordinates using asymmetric cryptography. Additionally, both messages contain timestamps informing about the generation of facial coordinate values. The system starts the session key generation procedure when both users have complete information.
Mixing the coordinates of face parameters. The mixing of the coordinates of face parameters (step 5b) works in such a way that we save parameter values alternately from both users but in different order. We gather parameters from the first User (U1) in the order LE(x), LE(y), RE(x), RE(y), C(x), C(y), and from the second User (U2) in the order N(y), N(x), RE(y), RE(x), LE(y), LE(x). So, for six exemplary numbers: 1, 2, 3, 4, 5, 6, the new order will be as follows: 1, 6, 2, 5, 3, 4.
The key generation method occurs as follows:
Convert all face coordinates of both users into a binary value.
Combine them according to the scheme shown in Figure 4 into one binary number BN.
Convert both timestamps into a binary value.
Combine them into one binary number TS.
Perform BN using TS in ten identical rounds:
Divide BN and TS into blocks of four bits.
Rearrange the blocks of BN (similarly as in Figure 4).
Negate every tenth bit.
Move the last BN’s block to the beginning of the block sequence.
Execute XOR function on first BN’s block and first TS block.
Move the first TS’s block to the end of the block sequence.
Combine blocks into new BN value.
Divide the processed number into blocks of eight bits.
Replace each block with its decimal representation.
Convert decimal values to ASCII characters.
Return the symmetric key.
The process of generating a session symmetric key. The first stage here is for two users to take a selfie. Then, the supporting application collects the coordinates of the indicated points on the face and sends them between users, encrypting messages using asymmetric cryptography. After receiving this information, the application processes the obtained coordinates and generates a symmetric session key. The exemplary face used in this figure is a fake face created by the Midjourney bot33.
Figure 5 shows a diagram of the subsequent steps of the symmetric session key generation process.
Table 1 displays all processes performed during the key generation process.
Adapted to IoT environments, the proposed biometric identity verification system can be implemented in various real-world scenarios. We can use the proposed system in corporate environments, smart homes, medical and healthcare environments, or industrial IoT. Each of these systems requires appropriate access control. Only authorized users can have physical access to specific places, devices, or information. Additionally, in more critical infrastructures, where it is necessary to transmit confidential data (for example, about patients’ health), it is essential to ensure a high level of security both in the process of user verification and in the process of their communication, i.e. to encrypt the communication appropriately. Examples of applications of this system include:
Activating a workstation in a corporate environment, where the employee’s identity can be verified before starting work or logging into IoT-enabled devices.
In medical environments, biometric verification can secure patient data on medical devices worn or supporting IoT, ensuring data privacy and integrity. Medical personnel can also safely communicate or transfer data between IoT devices using symmetric keys generated by the system.
In industrial IoT, verifying the identity of employees before operating heavy equipment or entering hazardous areas is crucial for employee safety. In addition, establishing encrypted communication between critical industrial IoT devices and their operators, which different users may operate, will affect the security of instructions sent to devices and thus protect them from executing incorrect instructions.
Nevertheless, the proposed system offers several benefits that significantly enhance IoT security. The first benefit is strong identity verification. By leveraging biometrics in the IoT authentication mechanism, the system ensures that only authorized users can access sensitive resources or data. This adaptability, combined with session-specific encryption based on specially generated symmetric keys using biometrics and timestamps, ensures secure communication between devices and users, minimizing the risk of key theft or reuse. Furthermore, leveraging biometric processing and key generation on devices reduces the dependency on centralized infrastructure, increasing resilience to large-scale breaches.
The proposed method has many benefits for verifying users using facial biometrics but also introduces potential threats and limitations. In the proposed system, we can use various IoT devices characterized by different hardware parameters that can affect the system’s performance and the verification process. However, with the development of smartphone technology, we know that these devices’ technical parameters do not have to be the system’s weak link. The element that should be mainly considered are industrial cameras, whose task will be to take pictures, in the case of using this system to verify the identity of employees. In Table 2, we have collected and discussed the most critical aspects of the proposed system, which result in potential limitations and threats to the operation of the system.
The proposed biometric-based identity verification system for IoT environments provides robust solutions to address the growing security requirements in IoT ecosystems. It enhances security with strong user authentication, session-specific encryption, and decentralized key management. However, resource constraints, privacy concerns, and environmental variability must be carefully mitigated by leveraging lightweight algorithms, edge computing, and advanced privacy techniques. With proper optimizations and safeguards, the system not only overcomes these challenges but also has the potential to serve as a scalable and secure foundation for IoT deployments across domains, offering a promising future for IoT security.
Based on the considerations, the proposed system addresses several key challenges in IoT security and fills gaps in this scope. Many IoT systems rely on static credentials (for example, default passwords) or weak authentication schemes that are easily exploitable. In the proposed solution, by integrating biometric-based authentication, we introduce a robust, user-centric solution that eliminates the need for easily compromised static credentials. Our system uses biometric features for authentication and as a foundation for symmetric key generation, creating a unique, session-specific encryption layer.
Centralized key distribution models also have a gap. They are resource-intensive and vulnerable to single points of failure. Our system generates symmetric keys dynamically using biometric data and timestamps, eliminating reliance on centralized key distribution mechanisms. This approach significantly enhances scalability and resilience.
The next challenge is related to cyberattacks. Facial recognition systems are prone to spoofing attacks (for example, using photos, masks, or deepfakes). Our system incorporates liveness detection and timestamp-based session keys, ensuring that only real-time, legitimate users can interact with IoT devices. Combining liveness detection with biometric-driven cryptographic mechanisms provides a multi-layered defense not extensively explored in prior research.
Our system uses biometric authentication and real-time cryptographic key generation to develop a better solution than authentication, previous key approaches, key management, privacy, and resource optimization. Therefore, the system is considered a significant improvement over the existing solutions. Unlike traditional static credentials or centralized key distribution mechanisms, susceptible to credential leakage or single points of failure, our approach dynamically generates symmetric keys based on biometric data and time factors. This ensures session-specific security and resilience to key-reuse attacks. Furthermore, it eliminates the overhead of managing centralized infrastructure, reducing attack surfaces and improving efficiency in distributed IoT environments.
Leveraging decentralized key generation ensures the system’s scalability and reduces dependency on centralized infrastructure. By distributing the biometric key generation process to individual IoT devices or edge nodes, the system can efficiently handle large-scale deployments without creating bottlenecks or single points of failure. The method cuts down on hardware costs by using smart processing techniques and taking advantage of new tech in smartphones and IoT cameras. Also, choosing to use cloud or edge computing can handle complex calculations, which means some IoT devices do not need such powerful hardware. Also, the modular design of the proposed system allows it to integrate seamlessly with existing IoT infrastructures.
We tested our system in two stages. First, we checked the user identity verification process. We prepared a set of 5000 images depicting people to evaluate our approach. We generated photos using a Midjourney bot (3000 photos), and the website Random Face Generator34(1000 photos). Also, we used 1000 photos from the Human Faces dataset35. We stored 4,000 photos in the database and marked them with random identifiers. The images used in the experiment had a variety of technical and demographic characteristics. The images used in the experiment had a uniform resolution of 512×512 pixels, regardless of their source (Random Face Generator, Midjourney, or Human Faces dataset). All images were in color, which increased the amount of visual information available for biometric key generation. This ensured that differences in the quality of the input data did not distort the experimental results. Demographically, the images represented people of different ages and ethnicities. Such diversity allows a better understanding of the system’s performance in real-world IoT applications. Although demographic data is not available, using multiple image sources increased the inherent visual variation in the dataset. The dataset was divided into a training set and a test set in an 80% to 20% ratio to evaluate the system’s effectiveness in user identification and verification under different scenarios.
Then, we loaded the database of photos and identifiers into the system to teach the system. In the next step, we checked the operation of the verification system using the collected photos. All photos were correctly distinguished, meaning that photos of people in the database were connected to the appropriate identifier, i.e., identity verification was successful. Photos from outside the database were not connected to the appropriate identifier, i.e. they were not verified correctly. Next, we tested our system in real-time. We saved several photos of people from a group of living people in the database and then asked all of them to approach a camera connected to the system. All the people were correctly distinguished, meaning the people whose photos were in the database were connected to the appropriate name, i.e., identity verification was successful. The people whose photos were not in the database were not connected to the appropriate name, i.e. they were not verified correctly. The system analyzed the biometric features of people and people in the photos, such as the arrangement of facial features, proportions, or characteristic points (face landmarks). Test results showed high system efficiency: True Positive Rate 99.99%, False Positive Rate 0.01%, Precision 99.99%, Recall 99.99%, Accuracy 99.99%.
Tests in real-time were done in an already existing IoT infrastructure. As edge devices, cameras capture and feed data to the verification system, designed as a centralized IoT service. Seamless integration was achieved, demonstrating the system’s utility in environments using IoT devices for biometric authentication.
Next, we tested the generation of symmetric keys based on stored photos. To evaluate our approach, we have developed Python code encompassing all necessary capabilities, including reading triangle coordinates from the photo and mathematical processing of these coordinates.
We tested our method using all stored photos. Table 3 displays the first forty-eight results. The pair of columns Coordinates and Key present data regarding the coordinates of facial features and the computed symmetric keys. The coordinate values obtained from the images have been standardized, resulting in a triangle with the following characteristics:
minimum side length of the triangle = 100,
maximum side length of the triangle = 1000,
maximal angle = 60,
width = 450,
height = 550.
The width and height represent the measurements of the area where the triangle is located, known as the centroid of the triangle. Each pair generated integers within the range of [0, width] and [0, height].
The biometric key generation process involved the following stages:
Image Reading: Facial images in 512×512 pixel format were loaded into the system.
Coordinate Extraction: The system extracted the coordinates of key facial landmarks, such as eyes, nose, and mouth, using a machine learning-based facial detection model.
Mathematical Processing of Coordinates: The coordinates were processed using mathematical algorithms to generate 32-bit values.
Key Generation: The generated values were encoded into a unique symmetric key used for encrypting and decrypting data.
Our research findings indicate that the image’s size and resolution significantly impact the coordinates. As the size of the image increases and the resolution improves, the coordinate values also increase. Furthermore, the placement of the face inside the image and the angle and alignment of the face also impact the values. The coordinates will vary based on the facial position within the image. Likewise, the inclination or rotation of the head will impact the coordinates of the landmarks. Nevertheless, adding a frame within the application will resolve the last two issues by providing a visual guide for appropriately positioning the face on the screen.
Ensuring resilience against brute force assaults is essential to securing cryptographic key creation. To demonstrate the ability to withstand brute force attacks within the framework of the suggested key generation technique, we can examine the subsequent procedures: key length, entropy, and time limitations. Selecting the correct cryptographic key length directly impacts the resistance level against brute force assaults. Generally, the greater the length of the key, the more challenging it becomes to execute a brute-force attack. Entropy denotes the level of unpredictability associated with the key. As entropy increases, the predictability of subsequent key bits decreases, increasing the complexity of a brute-force assault. Additionally, it is essential to evaluate the time required to execute a brute-force assault on the key produced by the suggested approach.
All coordinate values analyzed during the research were 32-bit. First, to evaluate the security of the keys, we decided to check their entropy, which refers to the measure of their randomness and strength. The higher entropy makes cracking the key more difficult. So we decided to treat generated keys as passwords and employ the https://www.security.org/how-secure-is-my-password/ website to estimate the likelihood of successfully guessing the key by brute force techniques. This website employs multiple techniques to evaluate the strength of passwords, such as considering their length, complexity, avoidance of common words, and cross-referencing them with a database of leaked passwords. The tested keys all had a breaking time above 1 billion years, indicating the high level of security provided by the suggested method.
In addition, we employed the NIST RNG Test Suite tool36 to assess the level of randomness shown by our keys. The tool successfully implemented tests for various key properties, including frequency, block frequency, runs, longest run of ones, matrix rank, discrete Fourier transform, non-overlapping template matchings, overlapping template matchings, universal, linear complexity, serial, approximate entropy, cumulative sums, and random excursions.
Subsequently, we employed the hashcat tool37 to assess the feasibility of brute force techniques to crack the keys. Hashcat has the potential to compromise the AES-256-ECB NOKD algorithm. The AES-256-ECB NOKDF mode can decrypt AES-256 encrypted passwords in ECB mode using NOKDF. NOKDF is an acronym that stands for Non-Key-Derived Function. This procedure produces an encryption key by combining a password and a salt. NOKDF does not depend on a hash function that can be executed multiple times with the same input to provide the same output. Instead, it employs unidirectional and stochastic hash functions to enhance resilience against side-channel and brute-force assaults.
The bundle of ciphertext for these tests was constructed using the AES-256-ECB NOKDF technique with generated keys. Based on the described technique, each key was treated as a password and processed by the algorithm into key and salt components. We activated the hashcat utility on a Kali Linux operating system computer with an Intel Core i7 processor and 32 GB of RAM. The ciphertext consisted of a single word, ten words, and one hundred words. None of the examined ciphertexts were successfully decrypted using a hashcat program.
For estimation of breaking time for brute-force attacks, we have considered the computation power of modern GPU-based systems, which can make roughly (10^9) guesses per second, as estimated from the performance of high-end GPUs like Nvidia RTX 4090. For a 256-bit key, the average number of attempts to break the key is (2^{255}), and the theoretical breaking time is roughly (10^{66}) years. This estimation does not incorporate possible progress in distributed or quantum computing; however, it illustrates the impracticality of brute-force attacks given the existing technological limitations. Furthermore, the NIST RNG test suite validated the randomness of the produced keys, guaranteeing elevated entropy and unpredictability, further hindering brute-force endeavours.
Simulations of the real-time biometric verification system. The graph depicts the performance testing of the biometric verification system in a live environment that depicts periodic cases where users are visiting the system for their verification at shorter intervals from each other. On the x-axis, you have time in seconds, and on the y-axis, the time since the system was successfully verified. Every verification attempt is a point on the graph, and differences in response time illustrate dynamic elements such as database size and system load. This study was performed with emulated IoT infrastructure, repeating verification attempts at a database with different amounts of entries (100, 500 and 1000) in real-world scalability scenarios. The graphs show the system can keep consistent verification times under 1sec on all database sizes, proving its performance and scalability. There were slight differences in time response as we increased the database size. This was thought to be due to the extra work done in feature matching. Results show the viability of using this system in real-time IoT environments, providing accuracy whilst matching high performance.
Further, we simulated the real-time biometric verification system by emulating users coming near the camera at a regular cadence in the latter part. We also measured the response time of our system for a range of database sizes to evaluate how well it works and scales, in reality, IoT infrastructure scenarios. Figure 6 shows the results.
We also performed tests to compare the proposed key generation method with the methods mentioned. Table 4 shows obtained results.
This study introduces a novel approach for generating symmetric keys between two users of IoT devices without the need for contact with a server. The suggested method allows for the production of symmetric keys utilizing biometric parameters represented by the coordinates of a triangle formed by the left and right eye corners and the nose tip. The received coordinates were subjected to mathematical processing, resulting in the generation of an alphanumeric symmetric key. We evaluated both the verification and generation methods using a specially collected dataset. The verification method correctly recognises whether a user is real or not. We also conducted tests of our keys to assess their vulnerability to brute-force attacks. The tested keys exhibited a breaking time above 1 billion years, enabling us to assess the security of the suggested technique.
Resisting brute force attacks is vital for secure cryptographic key generation. To showcase the safeguarding against brute force attacks inside the proposed key generation process, we can proceed with the following sequence of actions: Factors to include the length of the key, the level of entropy, and the time constraints. Choosing an appropriate cryptographic key length considerably impacts the capacity to resist brute force attacks. Increasing the length of a key enhances the intricacy of a brute-force attack. Entropy quantifies the level of unpredictability associated with a key. Heightened entropy results in heightened unpredictability of succeeding key bits, hence augmenting the intricacy of a brute force attack. Assessing the time needed to carry out a brute-force attack on the key generated by the proposed method is crucial.
Our research findings suggest that the image’s dimensions and clarity substantially affect the coordinates. Enlarging the image and enhancing its resolution leads to greater coordinate values. The position, angle, and orientation of the face in the shot can also influence the values. The coordinates will differ depending on the position of the face inside the image. The head’s orientation, whether tilted or rotated, will affect the coordinates of the landmarks. By including a frame in the application, the final two issues can be resolved by clearly expressing the precise position where the face should be on the screen.
The proposed biometric identity verification system uses biometric-based authentication and timestamp-driven symmetric key generation to significantly improve traditional approaches in IoT environments. Unlike easily compromised static credentials, the system ensures dynamic session-specific security, reducing the risk of key reuse. Furthermore, it obviates the necessity for centralized key management, enhancing scalability and fortifying resilience against extensive breaches. The system’s versatility enables deployment in many IoT contexts, ranging from resource-limited medical devices to industrial IoT configurations. Moreover, lightweight algorithms and edge computing provide efficient functioning despite constrained computational resources, ensuring requisite scalability. The modular design and adherence to defined communication protocols facilitate the integration of current IoT devices, offering a cost-effective and scalable solution for improving security in IoT.
Our future efforts will prioritize two primary areas of concentration. The initial phase will involve executing and evaluating this system within the natural IoT environment. We will also conduct penetration tests on well-established networks to determine the feasibility of eavesdropping, intercepting communication messages, and attempting to decipher and compromise encryption keys. Furthermore, we will apply this approach to IoT solutions like the Industrial Internet of Things. In this scenario, a user would attempt to transmit data, utilizing an industrial camera to capture a photograph.
The datasets used and/or analysed during the current study are available from the corresponding author upon reasonable request.
Nassereddine, M. & Khang, A. Applications of internet of things (iot) in smart cities. In Advanced IoT Technologies and Applications in the Industry 4.0 Digital Economy, 109–136 (CRC Press, 2024).
Rath, K. C., Khang, A. & Roy, D. The role of internet of things (iot) technology in industry 4.0 economy. In Advanced IoT Technologies and Applications in the Industry 4.0 Digital Economy, 1–28 (CRC Press, 2024).
Mohammadian, N. et al. A wrist worn internet-of-things sensor node for wearable equivalent daylight illuminance monitoring. IEEE Internet of Things Journal (2024).
Sayeduzzaman, M., Hasan, T., Nasser, A. A. & Negi, A. An internet of things-integrated home automation with smart security system. Automated Secure Computing for Next-Generation Systems 243–273 (2024).
Jabbar, W. A., Tiew, L. Y. & Shah, N. Y. A. Internet of things enabled parking management system using long range wide area network for smart city. Internet of Things and Cyber-Physical Systems 4, 82–98 (2024).
Article Google Scholar
Yamini, R., Nassa, V. K., Rajkumar, M. & Nidhya, M. Internet of things (iot)-integrated technologies in the agriculture sector. In Agriculture and Aquaculture Applications of Biosensors and Bioelectronics, 193–209 (IGI Global, 2024).
Srivastava, M., Siddiqui, A. T. & Srivastava, V. Application of artificial intelligence of medical things in remote healthcare delivery. In Handbook of Security and Privacy of AI-Enabled Healthcare Systems and Internet of Medical Things, 169–190 (CRC Press, 2024).
Mathkor, D. M. et al. Multirole of the internet of medical things (iomt) in biomedical systems for managing smart healthcare systems: An overview of current and future innovative trends. Journal of Infection and Public Health (2024).
Szymoniak, S., Depta, F., Karbowiak, Ł & Kubanek, M. Trustworthy artificial intelligence methods for users’ physical and environmental security: A comprehensive review. Applied Sciences 13, 12068 (2023).
Article CAS Google Scholar
Szymoniak, S. & Kesar, S. Key agreement and authentication protocols in the internet of things: A survey. Applied Sciences 13, 404 (2022).
Article MATH Google Scholar
Szymoniak, S. Key distribution and authentication protocols in wireless sensor networks: A survey. ACM Computing Surveys 56, 1–31 (2024).
Article Google Scholar
Xia, E., Hu, B.-J. & Shen, Q. A survey of physical layer secret key generation enhanced by intelligent reflecting surface. Electronics 13, 258 (2024).
Article MATH Google Scholar
Althamir, M., Alabdulhay, A. & Yasin, M. M. A systematic literature review on symmetric and asymmetric encryption comparison key size. In 2023 3rd International Conference on Smart Data Intelligence (ICSMDI), 110–117 (IEEE, 2023).
Barker, E., Barker, W., Burr, W., Polk, W. & Smid, M. Nist special publication 800–57. NIST Special publication 800, 1–142 (2007).
Google Scholar
Thabit, F., Can, O., Aljahdali, A. O., Al-Gaphari, G. H. & Alkhzaimi, H. A. A comprehensive literature survey of cryptography algorithms for improving the iot security. Internet of Things 100759 (2023).
Prabha, C., Sharma, N., Singh, J., Sharma, A. & Mittal, A. A review of cyber security in cryptography: Services, attacks, and key approach. In 2023 Third International Conference on Artificial Intelligence and Smart Energy (ICAIS), 1300–1306 (IEEE, 2023).
Choi, H. & Seo, S. C. Optimization of pbkdf2 using hmac-sha2 and hmac-lsh families in cpu environment. IEEE Access 9, 40165–40177 (2021).
Article MATH Google Scholar
Touil, H., El Akkad, N., Satori, K., Soliman, N. F. & El-Shafai, W. Efficient braille transformation for secure password hashing. IEEE Access (2024).
STEVENS, M. Cryptanalysis of sha-1. Symmetric Cryptography, Volume 2: Cryptanalysis and Future Directions 181 (2024).
Rahul, B., Kuppusamy, K. & Senthilrajan, A. Dynamic dna cryptography-based image encryption scheme using multiple chaotic maps and sha-256 hash function. Optik 289, 171253 (2023).
Article CAS Google Scholar
Umamaheswari, S., Vishal, N., Pragadesh, N. & Lavanya, S. Secure data transmission using hybrid crypto processor based on aes and hmac algorithms. In 2023 2nd International Conference on Advancements in Electrical, Electronics, Communication, Computing and Automation (ICAECA), 1–6 (IEEE, 2023).
Abhishek, K. et al. On random number generation for kernel applications. Fundamenta Informaticae 185 (2022).
Tkacik, T. E. A hardware random number generator. In International Workshop on Cryptographic hardware and embedded systems, 450–453 (Springer, 2002).
Heron, S. Advanced encryption standard (aes). Network Security 2009, 8–12 (2009).
Article MATH Google Scholar
Diffie, W. & Hellman, M. New directions in cryptography. IEEE Transactions on Information Theory 22, 644–654 (1976).
Article MathSciNet MATH Google Scholar
Sarkar, A. & Singh, B. K. Cancelable biometric based key generation for symmetric cryptography. In 2017 International Conference on Inventive Communication and Computational Technologies (ICICCT), 404–409 (IEEE, 2017).
Sahin, C., Katz, B. & Dandekar, K. R. Secure and robust symmetric key generation using physical layer techniques under various wireless environments. In 2016 IEEE radio and wireless symposium (RWS), 211–214 (IEEE, 2016).
Odeh, A., Abu-Errub, A. & Awad, M. Symmetric key generation method using digital image. International Journal of Computer Science Issues (IJCSI) 12, 254 (2015).
Bochkovskiy, A., Wang, C.-Y. & Liao, H.-Y. M. Yolov4: Optimal speed and accuracy of object detection. arXiv preprint[SPACE]arXiv:2004.10934 (2020).
Pujara, A. Image classification with mobilenet. Analytics Vidhya (2020).
Kubanek, M., Bobulski, J. & Karbowiak, Ł. Intelligent identity authentication, using face and behavior analysis. ETHICOMP 2022, 42 (2022).
MATH Google Scholar
Koller, D. & Friedman, N. Probabilistic graphical models: principles and techniques (MIT press, 2009).
Midjourney, I. Midjourney – an independent research lab. https://www.midjourney.com.
Generator, R. F. Random face generator. this-person-does-not-exist.com.
Gupta, A. Human faces. https://www.kaggle.com/datasets/ashwingupta3012/human-faces.
NIST. Nist rng test suite. https://csrc.nist.gov/projects/random-bit-generation.
Hashcat. Hashcat – advanced password recovery. https://hashcat.net/hashcat/.
Download references
S. Szymoniak, M. Kubanek: these authors contributed equally to this work.
Czestochowa University of Technology, Czestochowa, 42-201, Poland
Sabina Szymoniak & Mariusz Kubanek
You can also search for this author in PubMed Google Scholar
You can also search for this author in PubMed Google Scholar
Conceptualization, S.S., and M.K.; Methodology, S.S., and M.K.; Software, S.S., and M.K; Validation, S.S., and M.K; Writing original draft, S.G.; Writing review & editing, S.S., and M.K; Funding acquisition, M.K. All authors reviewed the manuscript.
Correspondence to Sabina Szymoniak or Mariusz Kubanek.
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Open Access This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc-nd/4.0/.
Reprints and permissions
Szymoniak, S., Kubanek, M. Biometry-based verification system with symmetric key generation method for internet of things environments. Sci Rep 15, 5464 (2025). https://doi.org/10.1038/s41598-025-89226-3
Download citation
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s41598-025-89226-3
Anyone you share the following link with will be able to read this content:
Sorry, a shareable link is not currently available for this article.
Provided by the Springer Nature SharedIt content-sharing initiative
Advertisement
© 2025 Springer Nature Limited
Sign up for the Nature Briefing: AI and Robotics newsletter — what matters in AI and robotics research, free to your inbox weekly.
About The Author
More Stories
Carrying the Light of the Internet Forward: A Farewell Message from Board Chair Ted Hardie
Defending the Open Internet: Why Italy’s Content Delivery Network Decision Matters
Community Snapshot—June