Methods and devices of enabling authentication of a user of a client device over a secure communication channel based on biometric data

A method performed by a client device of enabling authentication of a user of the client device based on biometric data enrolled at a trusted network node, comprising:

• submitting, to the trusted network node, a request to authenticate the user of the client device, the authentication request comprising a user identifier;
• receiving, from the trusted network node, at least one set of transformed biometric data corresponding to the user identifier submitted with the authentication request and the secret feature transform key with which the received biometric data was transformed at enrolment of the transformed biometric data at the network node;
• capturing biometric data of the user;
• transforming the biometric data into non-invertible biometric data using the received feature transform key;
• and
• comparing the transformed biometric data with the at least one set of transformed biometric data received from the trusted network node;
• and if there is a match:
• authenticating the user at the client device.

A network node configured to enable authentication of a user of a client device based on biometric data captured by the client device, the trusted network node comprising a processing unit being configured to:

• receive, from the client device, a request to authenticate a user of the client device, the authentication request comprising a user identifier;
• fetch, from the secure end-user repository, at least one set of enrolled transformed biometric data corresponding to the user identifier received from the client device and a secret feature transform key with which the biometric data was transformed at enrolment of the transformed biometric data at the network node;
• and
• submit the transformed biometric data and the secret feature transform key over a secure communication channel to the client device, wherein the submitted transformed biometric data is compared at the client device with biometric data being captured at the client device and transformed with the secret feature transform key and if there is a match, the user is authenticated.