# US 11,115,215 B2 · Methods and devices of enabling authentication of a user of a client device over a secure communication channel based on biometric data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,215 B2 - Document ID: US11115215B2 - Status: Granted - Kind: B2 - Application number: 16/623,240 - Filed: 2018-07-05 - Published: 2021-05-20 - Granted: 2021-09-07 - Earliest claimed: 2017-07-27 - Assignees: Fingerprint Cards AB - Applicants: Fingerprint Cards AB - Inventors: Christian Gehrmann - Web page: https://patentgrep.com/patent/US11115215B2 ## CPC - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06V 40/50: Maintenance of biometric data or enrolment thereof - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3247: {involving digital signatures} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract In an aspect of the invention, a network node configured to enable authentication of a user of a client device based on biometric data captured by the client device is provided, which network node receives a request to authenticate a user of a client device, the authentication request comprising a user identifier, fetch at least one set of enrolled transformed biometric data corresponding to the user identifier and a secret feature transform key with which the biometric data was transformed at enrolment of the transformed biometric data at the network node, and submit the transformed biometric data and the secret feature transform key over a secure communication channel to the client device. ## Claims ### Claim 1 A method performed by a network node of enabling authentication of a user of a client device based on biometric data captured by the client device, comprising: receiving, from the client device, a request to authenticate a user of the client device, the authentication request comprising a user identifier; fetching, from the secure end-user repository, at least one set of enrolled transformed biometric data corresponding to the user identifier received from the client device and a secret feature transform key with which the biometric data was transformed at enrolment of the transformed biometric data at the network node; and submitting the transformed biometric data and the secret feature transform key over a secure communication channel to the client device, wherein the submitted transformed biometric data is compared at the client device with biometric data being captured at the client device and transformed with the secret feature transform key and if there is a match, the user is authenticated. ### Claim 2 (depends on 1) The method of claim 1, wherein a plurality of sets of enrolled transformed biometric data corresponding to the user identifier received from the client device are fetched from the secure end-user repository and submitted to the client device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving, from the client device, at least one digitally signed set of transformed biometric data; verifying said at least one digitally signed set of transformed biometric data; and if the verification is successful: submitting an authentication grant to the client device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: associating each set of transformed biometric data stored in the secure end-user repository with an index number, wherein the submitting of the plurality of sets of transformed biometric data corresponding to the user identifier received from the client device further comprises: submitting the index number associated with each set of transformed biometric data, wherein the receiving, from the client device, of at least one digitally signed set of transformed biometric data further comprises: receiving an index number for each digitally signed set of transformed biometric data; and the verifying of said at least one digitally signed set of transformed biometric data further comprises: verifying that each index number received from the client device complies with the previously submitted corresponding index number for each set of transformed biometric data. ### Claim 5 (depends on 1) A computer program product comprising a non-transitory computer readable medium, the computer readable medium having a computer program embodied thereon, the computer program comprising computer-executable instructions for causing a trusted network node to perform the method of claim 1 when the computer-executable instructions are executed on a processing unit included in the trusted network node. ### Claim 6 A method performed by a client device of enabling authentication of a user of the client device based on biometric data enrolled at a trusted network node, comprising: submitting, to the trusted network node, a request to authenticate the user of the client device, the authentication request comprising a user identifier; receiving, from the trusted network node, at least one set of transformed biometric data corresponding to the user identifier submitted with the authentication request and the secret feature transform key with which the received biometric data was transformed at enrolment of the transformed biometric data at the network node; capturing biometric data of the user; transforming the biometric data into non-invertible biometric data using the received feature transform key; and comparing the transformed biometric data with the at least one set of transformed biometric data received from the trusted network node; and if there is a match: authenticating the user at the client device. ### Claim 7 (depends on 6) The method of claim 6, wherein a plurality of sets of transformed biometric data are received from the trusted network node and compared to the biometric data transformed at the client device, wherein the user is authenticated if the biometric data transformed at the client device matches each one of the sets of transformed biometric data received from the trusted network node. ### Claim 8 (depends on 6) The method of claim 6, further comprising: digitally signing the at least one received set of transformed biometric data for which there is a match; submitting the digitally signed biometric data to the trusted network node; receiving, from the trusted network node in case the trusted network node successfully verifies the digitally signed biometric data, an authentication grant, wherein the user is authenticated at the client device. ### Claim 9 (depends on 8) The method of claim 8, wherein the receiving of the plurality of sets of transformed biometric data corresponding to the user identifier received from the client device (500) further comprises: receiving an index number associated with each set of transformed biometric data, and wherein the submitting of at least one digitally signed set of transformed biometric data further comprises: submitting the index number for each digitally signed set of transformed biometric data. ### Claim 10 (depends on 6) The method of claim 6, wherein the client device requesting authentication is different from the client device requesting enrolment. ### Claim 11 (depends on 6) A computer program product comprising a non-transitory computer readable medium, the computer readable medium having a computer program embodied thereon, the computer program comprising computer-executable instructions for causing a biometric data sensing system to perform the method of claim 6 when the computer-executable instructions are executed on a processing unit included in the biometric data sensing system. ### Claim 12 A network node configured to enable authentication of a user of a client device based on biometric data captured by the client device, the trusted network node comprising a processing unit being configured to: receive, from the client device, a request to authenticate a user of the client device, the authentication request comprising a user identifier; fetch, from the secure end-user repository, at least one set of enrolled transformed biometric data corresponding to the user identifier received from the client device and a secret feature transform key with which the biometric data was transformed at enrolment of the transformed biometric data at the network node; and submit the transformed biometric data and the secret feature transform key over a secure communication channel to the client device, wherein the submitted transformed biometric data is compared at the client device with biometric data being captured at the client device and transformed with the secret feature transform key and if there is a match, the user is authenticated. ### Claim 13 (depends on 12) The network node of claim 12, being configured to fetch a plurality of sets of enrolled transformed biometric data corresponding to the user identifier received from the client device are from the secure end-user repository and to submit the fetched plurality of sets of enrolled transformed biometric data to the client device. ### Claim 14 (depends on 12) The network node of claim 12, the processing unit further being configured to: receive, from the client device, at least one digitally signed set of transformed biometric data; verify said at least one digitally signed set of transformed biometric data; and if the verification is successful: submit an authentication grant to the client device. ### Claim 15 (depends on 12) The network node of claim 12, the processing unit further being configured to: associate each set of transformed biometric data stored in the secure end-user repository with an index number, and further being configured to, when submitting the plurality of sets of transformed biometric data corresponding to the user identifier received from the client device: submit the index number associated with each set of transformed biometric data, and further being configured to, when receiving the at least one digitally signed set of transformed biometric data from the client device: receive an index number for each digitally signed set of transformed biometric data; and further being configured to, when verifying said at least one digitally signed set of transformed biometric data: verify that each index number received from the client device complies with the previously submitted corresponding index number for each set of transformed biometric data.