Trusted key server

A method performed by a second client device of enabling authentication of a user of a first client device at the second client device based on biometric data captured by the first client device, comprising:

• receiving, from a 3rd party network node for authentication of the user of the second client device, encrypted biometric data of the user and an authentication token, wherein the first client device:
• (i) generates at least one secret key, (ii) submits the generated at least one secret key to a trusted network node over a secure communication channel for registering the at least one secret key with the trusted network node, (iii) receives reference information associated with the at least one secret key from the trusted network node, (iv) captures the biometric data of the user, (v) encrypts the captured biometric data using the generated at least one secret key, and (vi) creates the authentication token based on the reference information;
• submitting the authentication token to the trusted network node over a secure communication channel, the authentication token indicating the secret key previously registered with the trusted network node by the first client device, wherein the biometric data captured by the first client device is encrypted by the first client device with the secret key;
• and
• receiving the secret key from the trusted network node when the trusted network node authenticates the authentication token, wherein the encrypted biometric data can be decrypted using the received secret key.

A method performed by a trusted network node of enabling authentication of a user of a second client device based on biometric data captured by a first client device, comprising:

• receiving at least one secret key from the first client device over a secure channel, wherein the at least one secret key is used by the first client device to encrypt the biometric data of the user captured by the first client device;
• associating the received at least one secret key with reference information;
• storing the reference information and the at least one secret key in a key repository;
• submitting the reference information to the first client device;
• receiving, from the second client device, an authentication token created by the first client device based on the received reference information, the authentication token indicating the at least one secret key previously registered with the trusted network node;
• authenticating the received authentication token;
• acquiring the at least one secret key indicated by the authentication token from the key repository;
• and
• submitting the acquired at least one secret key to the second client device, wherein the second client device utilizes the at least one secret key to decrypt the encrypted biometric data of the user to enable authentication of the user.

A trusted network node configured to enable authentication of a user of a second client device based on biometric data captured by a first client device, the trusted network node comprising one or more processors being configured to:

• receive at least one secret key from the first client device over a secure channel, wherein the at least one secret key is used by the first client device to encrypt the biometric data of the user captured by the first client device;
• associate the received at least one secret key with reference information;
• store the reference information and the at least one secret key in a key repository;
• submit the reference information to the first client device;
• receive, from the second client device, an authentication token created by the first client device based on the received reference information, the authentication token indicating the at least one secret key previously registered with the trusted network node;
• authenticate the received authentication token;
• acquire the at least one secret key indicated by the authentication token from the key repository;
• and
• submit the acquired at least one secret key to the second client device, wherein the second client device utilizes the at least one secret key to decrypt the encrypted biometric data of the user to enable authentication of the user.