Biometric authentication system, enrollment terminal, authentication terminal and authentication server

An enrollment terminal in a biometric authentication system that authenticates a user based on biometric data, comprising:

• a generation unit that generates a conversion parameter;
• a verification information creation unit that creates conversion parameter verification information;
• an enrollment biometric data conversion unit that converts biometric data captured during enrollment based on the conversion parameter to create enrollment data;
• a signature creation unit that creates first signature data for assuring the integrity of pair data of the enrollment data and the conversion parameter verification information;
• and
• a transmission unit that transmits the pair data of the enrollment data and the conversion parameter verification information and the first signature data to the authentication server.

An authentication terminal in the biometric authentication system including an authentication server that authenticates a user based on biometric data, comprising:

• a capture unit that captures biometric data;
• a conversion unit that converts the captured biometric data based on a conversion parameter;
• a transmission unit that transmits converted biometric data converted by the conversion unit to the authentication server;
• and
• a conversion parameter proof unit that proves knowledge about the conversion parameter without disclosing it to the authentication server.

An authentication server in a biometric authentication system that authenticates a user based on biometric data captured by an authentication terminal, comprising:

• a receiving unit that receives converted biometric data converted by a conversion parameter in the authentication terminal;
• a conversion parameter verification unit that verifies that the authentication terminal knows the conversion parameter, based on communication with the authentication terminal and the conversion parameter verification information;
• and
• a matching unit that compares the converted biometric data with the stored enrollment data to check similarities,
• wherein when the verification of the converted parameter by the conversion parameter verification unit succeeds, and the checking of similarities between the converted biometric data and the enrollment data by the matching unit succeeds, the authentication server determines that the authentication has succeeded.