Use of biometrics and privacy preserving methods to authenticate account holders online

A user device comprising:

• one or more biometric capture devices;
• one or more processors;
• and
• one or more memories comprising computer-executable instructions, wherein executing the computer-executable instructions by the one or more processors causes the user device to:
• during an enrollment process using an authentication application on the user device, wherein the authentication application is in direct communication with an authentication computer:
• initiate, by the authentication application on the user device, the enrollment process for enrolling a user in an authentication program;
• capture a biometric enrollment sample of the user using the user device;
• generate, by the authentication application, a biometric enrollment template using the biometric enrollment sample of the user;
• store the biometric enrollment template locally or at the authentication computer;
• inform, by the authentication application, the authentication computer of the biometric enrollment template;
• during an authentication process initiated by a resource provider application on the user device, wherein the user device interacts directly with a resource provider via the resource provider application:
• confirm, by the resource provider application on the user device, with an authentication gateway computer that the biometric enrollment template of the user is managed by the authentication computer via the authentication application, wherein the authentication gateway computer is in communication with the authentication computer;
• obtain, by the resource provider application operating on the user device, a biometric authentication sample from the user using the user device;
• generate, by the resource provider application, a biometric authentication template from the biometric authentication sample;
• obtain, by the resource provider application, biometric matching information related to the biometric authentication template wherein the biometric matching information comprises the biometric enrollment template;
• authenticate, by the resource provider application, the user of the user device based on the biometric authentication template, the biometric matching information, and a cryptographic comparison protocol, the cryptographic comparison protocol including one or more of:
• secure multi-party computation, homomorphic encryption, or a fuzzy extractor, the fuzzy extractor being configured to:
• generate two cryptographic keys from the biometric authentication template and the biometric enrollment template, and
• use the two cryptographic keys to authenticate the user,
• wherein the cryptographic comparison protocol of the resource provider application is configured to compare a first cryptographic key representing the biometric authentication template to a second cryptographic key representing the biometric enrollment template without retrieving the biometric enrollment sample of the user;
• and
• authorize, by the resource provider application, access to a resource provided by the resource provider in response to the user being authenticated.