The fingerprint has long been used as one of the most important biological features in the field of biometrics. It is person-specific and remain identical though out one’s lifetime. Physically uncloneable functions (PUFs) have been used in authentication protocols due to the unique physical feature of it. In this paper, we take full advantage of the inherent security features of user’s fingerprint biometrics and PUFs to design a new user authentication and key agreement scheme, namely Bio-AKA, which meets the desired security characteristics. To protect the privacy and strengthen the security of biometric data and to improve the robustness of the proposed scheme, the fuzzy extractor is employed. The scheme proposed in the paper can protect user’s anonymity without the use of password and allow mutual authentication with key agreement. The experimental results show superior robustness and the simplicity of our proposed scheme has been validated via our performance and security analysis. The scheme can be an ideal candidate for real life applications that requires remote user authentication.

指纹长期以来一直被用作生物识别领域中最重要的生物学特征之一。它是针对特定人的，并且一生都保持相同。由于物理上不可克隆的功能（PUF）的独特物理特性，因此已在身份验证协议中使用。在本文中，我们充分利用了用户指纹生物识别技术和PUF的固有安全特性，设计了一种新的用户认证和密钥协商方案，即Bio-AKA，它可以满足所需的安全特性。为了保护隐私并增强生物识别数据的安全性并提高所提出方案的鲁棒性，采用了模糊提取器。本文提出的方案可以在不使用密码的情况下保护用户的匿名性，并允许与密钥协议进行相互认证。实验结果表明，该算法具有出色的鲁棒性，并且通过性能和安全性分析验证了所提出方案的简单性。对于需要远程用户身份验证的实际应用，该方案可能是理想的选择。