Method and system for authenticating a user

A system for authenticating a user, comprising:

• an authentication server which hosts an authentication service, and
• a mobile terminal which is configured to communicate with the authentication server,
• wherein the authentication server comprises a memory containing identification data for identification of the user, an address of the mobile terminal linked with the identification data, and generator means to generate a transaction identifier,
• wherein the mobile terminal is configured to verify a biometric security feature and comprises a memory containing a private key protected by the biometric security feature,
• wherein the mobile terminal is configured to perform an enquiry for input of the biometric security feature upon receipt of a request comprising the generated transaction identifier from the authentication service, to grant access to the private key upon input of an authorized security feature, to sign the generated transaction identifier using the private key, and to transmit the signed generated transaction identifier back to the authentication service, wherein the access to the private key is granted only after input of an authorized biometric security feature;
• wherein the authentication service is configured to perform an authentication;
• and
• wherein the authentication service verifies the signed generated transaction identifier using a public key which is linked with the identification data.

An initialization method comprising:

• generating a private key at a mobile terminal, the private key coupled with a biometric security feature to be authorized, thereby initializing an authentication method for authenticating a user,
• wherein the authentication method for authenticating the user comprises:
• an application transmitting a query comprising identification data to an authentication service,
• the authentication service determines an address of a mobile terminal linked to the user by the identification data, generates a transaction identifier, and transmits a request comprising the generated transaction identifier to the mobile terminal, wherein said mobile terminal has been initialized with the initialization method,
• the mobile terminal performs an enquiry for input of a biometric security feature, grants access to a private key saved on the mobile terminal upon input of a valid security feature, signs the generated transaction identifier with a signature using the private key and transmits the signed generated transaction identifier back to the authentication service, wherein the access to the private key is granted only after input of an authorized biometric security feature;
• the authentication service performs an authentication, wherein the authentication comprises:
• verifying the signature of the signed generated transaction identifier and,
• transmitting a confirmation of the query back to the application in the case of an authentic signature;
• wherein the authentication service verifies the signed generated transaction identifier using a public key which is linked with the identification data.