# US 11,308,190 B2 · Biometric template handling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,190 B2 - Document ID: US11308190B2 - Status: Granted - Kind: B2 - Application number: 16/763,620 - Filed: 2018-11-09 - Published: 2020-11-19 - Granted: 2022-04-19 - Earliest claimed: 2017-11-24 - Assignees: Fingerprint Cards Anacatum IP AB - Applicants: Fingerprint Cards AB - Inventors: Markus Andersson; Jan Nilsson; Anders Khullar - Web page: https://patentgrep.com/patent/US11308190B2 ## CPC - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - H04L 9/3271: {using challenge-response} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 2463/062: applying encryption of the keys - H04W 12/069: using certificates or pre-shared keys - H04W 12/47: using near field communication [NFC] or radio frequency identification [RFID] modules - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method for handling biometric templates is disclosed for an authenticating device applying biometric authentication. The method comprises acquiring a set of biometric data associated with a prospect user, and acquiring a decryption key (associated with an encrypted biometric template associated with an enrolled user of the authenticating device) from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device. The method also comprises retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user, decrypting the retrieved part of the biometric template using the acquired decryption key and performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template. ## Claims ### Claim 1 A method for handling biometric templates for an authenticating device applying biometric authentication, the method comprising: acquiring, via a biometric reader, a set of biometric data associated with a prospect user of the authenticating device; acquiring a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device; retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user; decrypting the retrieved part of the biometric template using the acquired decryption key; and performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template, wherein the authenticating device keeps a communication key pair comprising a public communication key and a private communication key, and wherein acquiring the decryption key comprises: transmitting the public communication key to the key carrying device; receiving a challenge message from the key carrying device; transmitting a response message to the key carrying device; receiving the decryption key from the key carrying device when the transmitted response message is correct, wherein the decryption key is encrypted by the public communication key; and decrypting the decryption key using the private communication key. ### Claim 2 (depends on 1) The method of claim 1 wherein the decryption key comprises an open identifier of the key carrying device and wherein acquiring the decryption key comprises reading the open identifier from the key carrying device. ### Claim 3 (depends on 1) The method of claim 1 wherein the decryption key comprises a protected key and wherein acquiring the decryption key comprises: providing a password to the key carrying device; and in response thereto, receiving the protected key from the key carrying device. ### Claim 4 A method for handling biometric templates for an authenticating device applying biometric authentication, the method comprising: acquiring, via a biometric reader, a set of biometric data associated with a prospect user of the authenticating device; acquiring a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device; retrieving, from a storage medium, at least a part of the encrypted biometric template associated with the enrolled user; decrypting the retrieved part of the biometric template using the acquired decryption key; performing an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template; and when the attempt to authenticate the prospect user as the enrolled user is successful: locally storing the decrypted part of the biometric template; allowing further attempts to authenticate the prospect user as the enrolled user based on the locally stored decrypted part of the biometric template; and discarding the locally stored decrypted part of the biometric template when a discarding event occurs. ### Claim 5 (depends on 1) The method of claim 1 further comprising transferring at least a portion of the encrypted biometric template to: one or more other authenticating devices; and/or a biometric template server for retrieval by one or more other authenticating devices. ### Claim 6 (depends on 1) The method of claim 1 wherein the biometric template is a fingerprint template and the acquired set of biometric data is indicative of one or more fingerprint features. ### Claim 7 (depends on 1) The method of claim 1 wherein the biometric template is an iris template and the acquired set of biometric data is indicative of one or more iris features. ### Claim 8 (depends on 1) The method of claim 1 further comprising discarding the acquired decryption key as soon as the attempt to authenticate the prospect user as the enrolled user is completed. ### Claim 9 (depends on 1) The method of claim 1 wherein the storage medium is comprised in the authenticating device. ### Claim 10 (depends on 1) The method of claim 1 wherein the storage medium is comprised in a cloud-based server external to the authenticating device. ### Claim 11 (depends on 1) The method of claim 1 wherein the part of the biometric template comprises the entire biometric template. ### Claim 12 (depends on 1) The method of claim 1 further comprising enrolling a user of the authenticating device by: acquiring, via the biometric reader, an enrolment set of biometric data associated with the user to be enrolled; acquiring an encryption key from the key carrying device associated with the user to be enrolled, wherein the encryption key is associated with the decryption key of the key carrying device; encrypting, using the acquired encryption key, a biometric template created based on the acquired enrollment set of biometric data; and storing the encrypted biometric template in the storage medium. ### Claim 13 (depends on 1) A computer program product comprising a non-transitory computer readable medium, having thereon a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause execution of the method according to claim 1 when the computer program is run by the data processing unit. ### Claim 14 An arrangement for handling biometric templates for an authenticating device applying biometric authentication, the arrangement comprising a controller configured to cause: acquisition, via a biometric reader, of a set of biometric data associated with a prospect user of the authenticating device; acquisition of a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device; retrieval, from a storage medium, of at least a part of the encrypted biometric template associated with the enrolled user; decryption of the retrieved part of the biometric template using the acquired decryption key; and performance of an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template, wherein the authenticating device keeps a communication key pair comprising a public communication key and a private communication key, and wherein the controller is configured to cause acquisition of the decryption key by causing: transmission of the public communication key to the key carrying device; reception of a challenge message from the key carrying device; transmission of a response message to the key carrying device; reception of the decryption key from key carrying device when the transmitted response message is correct, wherein the decryption key is encrypted by the public communication key; and decryption of the decryption key using the private communication key. ### Claim 15 (depends on 14) The arrangement of claim 14 wherein the decryption key comprises an open identifier of the key carrying device and wherein the controller is configured to cause acquisition of the decryption key by causing reading of the open identifier from the key carrying device. ### Claim 16 (depends on 14) The arrangement of claim 14 wherein the decryption key comprises a protected key and wherein the controller is configured to cause acquisition of the decryption key by causing: provision of a password to the key carrying device; and in response thereto, reception of the protected key from the key carrying device. ### Claim 17 An arrangement for handling biometric templates for an authenticating device applying biometric authentication, the arrangement comprising a controller configured to cause: acquisition, via a biometric reader, of a set of biometric data associated with a prospect user of the authenticating device; acquisition of a decryption key from a key carrying device external to the authenticating device responsive to the key carrying device being in a vicinity of the authenticating device, wherein the decryption key is associated with an encrypted biometric template associated with an enrolled user of the authenticating device; retrieval, from a storage medium, of at least a part of the encrypted biometric template associated with the enrolled user; decryption of the retrieved part of the biometric template using the acquired decryption key; performance of an attempt to authenticate the prospect user as the enrolled user based on a comparison between the acquired set of biometric data and the decrypted part of the biometric template; and responsive to the attempt to authenticate the prospect user as the enrolled user being successful: local storing of the decrypted part of the biometric template; allowance of further attempts to authenticate the prospect user as the enrolled user based on the locally stored decrypted part of the biometric template; and discarding of the locally stored decrypted part of the biometric template when a discarding event occurs. ### Claim 18 (depends on 14) The arrangement of claim 14 wherein the controller is further configured to cause transfer of at least a portion of the encrypted biometric template to: one or more other authenticating devices; and/or a biometric template server for retrieval by one or more other authenticating devices. ### Claim 19 (depends on 14) The arrangement of claim 14 wherein the biometric template is a fingerprint template and the acquired set of biometric data is indicative of one or more of fingerprint features. ### Claim 20 (depends on 14) The arrangement of claim 14 wherein the biometric template is an iris template and the acquired set of biometric data is indicative of one or more iris features. ### Claim 21 (depends on 14) The arrangement of claim 14 wherein the controller is further configured to cause discarding of the acquired decryption key as soon as the attempt to authenticate the prospect user as the enrolled user is completed. ### Claim 22 (depends on 14) The arrangement of claim 14 wherein the storage medium is comprised in a cloud-based server external to the authenticating device. ### Claim 23 (depends on 14) The arrangement of claim 14 further comprising the storage medium. ### Claim 24 (depends on 14) The arrangement of claim 14 wherein the controller is further configured to cause enrollment of a user of the authenticating device by causing: acquisition, via the biometric reader, of an enrolment set of biometric data associated with the user to be enrolled; acquisition of an encryption key from the key carrying device associated with the user to be enrolled, wherein the encryption key is associated with the decryption key of the key carrying device; encryption, using the acquired encryption key, of a biometric template created based on the acquired enrollment set of biometric data; and storing of the encrypted biometric template in the storage medium. ### Claim 25 (depends on 14) An authenticating device comprising the arrangement of claim 14. ### Claim 26 (depends on 25) An authentication system comprising the authenticating device of claim 25 and the key carrying device.