Two-step central matching

A method performed by a network node of enrolling biometric data of a user of a client device over a secure communication channel, comprising:

• receiving, from the client device, an enrolment request comprising encrypted first and a second sets of transformed biometric data of the user, the first set of biometric data having been transformed by a first feature transformation key, and an encrypted second feature transformation key having been used to transform the second set of transformed biometric data, along with user profile data;
• decrypting the encrypted second feature transformation key;
• generating a user index for the received second feature transformation key;
• storing the second feature transformation key, the user profile data and the user index;
• and
• submitting, to a biometric data verification node, the encrypted first and second sets of transformed biometric data, the user profile data and the user index.

A method performed by a biometric data verification node of enrolling biometric data of a user of a client device over a secure communication channel, comprising:

• receiving, from a network node configured to communicate with the client device, an enrolment request comprising encrypted first and second sets of transformed biometric data of the user of the client device, the sets of biometric data having been transformed by feature transformation keys not being accessible to the biometric data verification node, user profile data and a user index associated with the received data;
• decrypting the encrypted first and second sets of transformed biometric data;
• and
• storing the first and second sets of transformed biometric data, the user profile data and the user index for subsequent authentication of the user.

A method performed by a client device of enabling authentication of a user of the client device with a network node over a secure communication channel based on biometric data, comprising:

• receiving, from the network node, a session value;
• capturing the biometric data of the user;
• transforming the biometric data into a first set of transformed biometric data using a first feature transformation key shared with a client device having enrolled biometric data against which authentication is to be performed;
• encrypting the first set of transformed biometric data and the received session value with an encryption key shared with a biometric data verification node at which the user is to be authenticated;
• encrypting the session value with an encryption key shared with the network node;
• submitting the encrypted first set of transformed biometric data, the two encrypted session values and user profile data to the network node;
• receiving at least one encrypted second feature transformation key and an encrypted copy of the session value, the at last one second feature transformation key and the session value having been encrypted with a key shared with the network node;
• decrypting the encrypted at least one second feature transformation key and the encrypted session value and verifying that the decrypted session value complies with the previously received session value;
• transforming the biometric data into at least one second set of transformed biometric data using the at least one second feature transformation key shared with the network node;
• encrypting the at least one second set of transformed biometric data and the session value with a key shared with the biometric data verification node;
• and
• submitting the encrypted at least one second set of transformed biometric data and the encrypted session value to the network node, wherein the network node forwards the submitted data to the biometric data verification node for authentication of the client device.

A method performed by a network node of enabling authentication of a user of a client device with a biometric data verification node over a secure communication channel based on biometric data, comprising:

• submitting a session value to the client device;
• receiving, from the client device, an encrypted first set of transformed biometric data of the user, the first set of biometric data having been transformed by a first feature transformation key and encrypted with key shared between the client device and the biometric data verification node, the session value encrypted with a key shared with the client device, along with user profile data, and the session value encrypted with the key shared between the client device and the biometric data verification node;
• decrypting the received encrypted session value and verifying that the decrypted session value complies with the session value that previously was sent;
• submitting the encrypted first set of transformed biometric data and user profile data, the session value and the session value having been encrypted with the key shared between the client device and the biometric data verification node;
• receiving, from the biometric data verification node, a user index associated with each of at least one set of transformed biometric data having been previously enrolled at the biometric data verification node and which transformed biometric data matches the submitted first set of transformed biometric data, and the session value;
• verifying that the session value complies with the session value that previously was sent to the biometric data verification node;
• fetching, for each received user index, a previously enrolled second feature transformation key;
• encrypting the fetched at least one second feature transformation key and the session value with a key shared with the client device;
• submitting the encrypted second feature transformation key and session value to the client device;
• receiving, from the client device, encrypted at least one second set of transformed biometric data having been transformed with the at least one second feature transformation key, and an encrypted copy of the session value, the at least one second set of transformed biometric data and the session value having been encrypted with a key shared with between the client device and the biometric data verification node;
• submitting, to the biometric data verification node, the encrypted at least one second set of transformed biometric data, the session value and the encrypted session value;
• and
• receiving, from the biometric data verification node, the user index associated with each of the at least one previously enrolled second feature transformation key, as well as the session value in case the biometric data verification node matches the at least one second set of transformed biometric data to at least one set of transformed biometric data having been previously enrolled for the user index, wherein the user is considered authenticated.

A method performed by a biometric data verification node of enabling authentication of a user of a client device over a secure communication channel based on biometric data, comprising:

• receiving, from a network node configured to communicate with the client device, an encrypted first set of transformed biometric data, a session value and the session value having been encrypted with a key shared with the client device, as well as user profile data;
• decrypting the encrypted first set of transformed biometric data and the encrypted session value and verifying that the decrypted session value complies with the received session value;
• matching the decrypted first set of transformed biometric data to at least one set of transformed biometric data having been previously enrolled for the received user profile data;
• submitting, to the network node, a user index associated with each of the previously enrolled at least one set of transformed biometric data for which there is match, and the session value;
• receiving, from the network node, encrypted at least one second set of transformed biometric data, an encrypted session value and a clear-text copy of the session value;
• decrypting the encrypted at least one second set of transformed biometric data and the encrypted session value and verifying that the decrypted session value complies with the clear-text session value;
• matching the decrypted at least one second set of transformed biometric data to at least one set of transformed biometric data having been previously enrolled;
• and
• submitting, to the network node, at least one user index for which there is match, along with the session value, wherein the user is considered authenticated.