Biometric template handling

A method for handling biometric templates for an authenticating device applying biometric authentication, the method comprising:

• acquiring, via a biometric reader, a set of biometric data associated with a prospect user of the authenticating device;
• acquiring a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
• retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user;
• decrypting the retrieved part of the biometric template using the acquired decryption key;
• performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template;
• and
• when the attempt to authenticate the prospect user as the enrolled user is successful:
• locally storing the decrypted part of the biometric template;
• allowing further attempts to authenticate the prospect user as the enrolled user based on the locally stored decrypted part of the biometric template;
• and
• discarding the locally stored decrypted part of the biometric template when a discarding event occurs.

An arrangement for handling biometric templates for an authenticating device applying biometric authentication, the arrangement comprising a controller configured to cause:

• acquisition, via a biometric reader, of a set of biometric data associated with a prospect user of the authenticating device;
• acquisition of a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
• retrieval, from a storage medium, of at least a part of the encrypted biometric template associated with the enrolled user;
• decryption of the retrieved part of the biometric template using the acquired decryption key;
• and
• performance of an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template,
• wherein the authenticating device keeps a communication key pair comprising a public communication key and a private communication key, and wherein the controller is configured to cause acquisition of the decryption key by causing:
• transmission of the public communication key to the key carrying device;
• reception of a challenge message from the key carrying device;
• transmission of a response message to the key carrying device;
• reception of the decryption key from key carrying device when the transmitted response message is correct, wherein the decryption key is encrypted by the public communication key;
• and
• decryption of the decryption key using the private communication key.

An arrangement for handling biometric templates for an authenticating device applying biometric authentication, the arrangement comprising a controller configured to cause:

• acquisition, via a biometric reader, of a set of biometric data associated with a prospect user of the authenticating device;
• acquisition of a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device;
• retrieval, from a storage medium, of at least a part of the encrypted biometric template associated with the enrolled user;
• decryption of the retrieved part of the biometric template using the acquired decryption key;
• performance of an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template;
• and
• responsive to the attempt to authenticate the prospect user as the enrolled user being successful:
• local storing of the decrypted part of the biometric template;
• allowance of further attempts to authenticate the prospect user as the enrolled user based on the locally stored decrypted part of the biometric template;
• and
• discarding of the locally stored decrypted part of the biometric template when a discarding event occurs.