Biometric authentication of a user

Abstract

There is provided techniques for biometric authentication of a user. A method is performed by a first communication device (200a). The method comprises receiving (S102) a biometric input of the user. The method comprises obtaining (S108) a non-secret transformation parameter of a transformation, wherein the non-secret transformation parameter is associated with a second communication device (200b). The method comprises performing (S114) the transformation on the biometric input using the non-secret transformation parameter. The method comprises sending (S118) the transformed biometric input towards the second communication device (200b) for biometric authentication of the user by the second communication device (200b). The method comprises receiving (S120) a result of the biometric authentication of the user from the second communication device (200b).

Description

[0001] BIOMETRIC AUTHENTICATION OF A USER

[0002] TECHNICAL FIELD

[0003] Embodiments presented herein relate to methods, communication devices, computer programs, and a computer program product, for biometric authentication of a user.

[0004] BACKGROUND

[0005] In general terms, biometric authentication involves verifying, or recognizing, the identity of a person based on biometric characteristics. Non-limiting examples of such characteristics of a person are fingerprints, palm veins, face, DNA, palm print, hand geometry, iris, retina, voice, shape of ears, etc.

[0006] Identification through fingerprints and facial scans is a common security feature on devices such as mobile phones, tablet computers, laptop computers, etc. Fingerprints and facial scans can also be used in access control systems. Fingerprints or facial scans can, for example, be used as complement or replacement for passwords or security codes. The common name for such techniques is biometric security.

[0007] When a biometric input, e.g., a fingerprint, is supplied to the device, the fingerprint is captured by a fingerprint reader which digitalizes the input. After digitalization, the data is processed by an algorithm which extracts a set of features (sometimes called minutiae). A feature can have many properties, e.g., a shape, a size, an exact position, a relative position, its nearest neighboring features, etc. The feature algorithm decides what to look for and how it should be encoded. Prior to first time usage of biometric security on a device, the user supplies several feature sets which are combined into a biometric template for the user. The biometric template represents, or defines, a set of unique features which are likely to be present in the user’s biometric input. The process of registering a biometric template is called enrollment. Since the biometric template contains sensitive information, the biometric template is usually not stored in clear-text. It can either be stored encrypted and / or transformed.

[0008] Biometric data is valuable since it is semi-permanent in nature, and once leaked it cannot be cancelled. To thwart this, cancelable biometric authentication uses transformation parameters with a random parameter to make stolen biometric templates worthless without the accompanying transformation parameter, and vice versa. An example of a device 100 for biometric authentication based on transformation is illustrated in Fig. 1. The device 100 comprises a biometric reader 102 configured to receive biometric input no of a user. The biometric input no is transformed by a transformer 104. The thus transformed biometric input is compared, by an authenticator 106, to a transformed biometric template 108. The device 100 in Fig. 1 can successfully protect authentication as performed locally on the device 100. However, the risk of the biometric data being leaked still persists in multi-user scenarios, disaggregated device scenarios, as well as scenarios where a given user uses several devices for authentication based on a biometric template stored on one device.

[0009] Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first having to decrypt it. Homomorphic encryption can be regarded as a form of encryption with an additional capability where it is possible to perform computations on encrypted data without access to the secret key based on which the data was encrypted. The result of the computation remains encrypted and can only be decrypted by a party holding the secret key. The result, when decrypted, is ideally identical to that produced had the operations been performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced computation. This allows data to be encrypted and outsourced, e.g., to commercial cloud environments for processing, all while encrypted. One issue with homomorphic encryption is that it is very computationintensive and thereby orders of magnitudes slower than regular, secure processing schemes, such as trusted execution environments (TEE) and secure enclaves. This property makes homomorphic encryption too slow to be used in most scenarios.

[0010] In a recent paper entitled “Hybrid biometric template protection” by A. Bassit et al, published as an open access article in IET Biometrics, as per August 25, 2023, available here: https: / / ietresearch.onlinelibrary.wiley.com / doi / pdfdirect / 10. iO49 / bme2.12075, a hybrid approach to biometric templates, where both Bloom filters and homomorphic encryption are used, is presented. The approach uses two different transformations functions, where each function has its own key / parameter. The first transformation being local in the device, the second being performed in a cloud environment, and the authentication in a different server. Hence, the approach requires three different entities: a user equipment, a database server, and an authentication server. This increases the risks of man-in-the-middle attacks. There is therefore still a need for an improved authentication of a user.

[0011] SUMMARY

[0012] An object of embodiments herein is to address the above issues.

[0013] A particular object is to provide authentication of a user which does not suffer from the above issues, or at least are mitigates or reduces the above issues.

[0014] A particular object is to provide authentication of a user where the risk of man-in- the-middle attacks is reduced.

[0015] In general terms, biometric authentication depends on three sensitive pieces of information: the biometric input, the transformation parameter, and the biometric template. Neither should be exposed, which is difficult when it comes to remote or decentralized biometric authentication. A particular object is therefore to enable remote, or decentralized, biometric authentication of a user to be performed without having to expose an untransformed biometric template or any transformation parameters.

[0016] According to a first aspect there is presented a method for biometric authentication of a user. The method is performed by a first communication device. The method comprises receiving a biometric input of the user. The method comprises obtaining a non-secret transformation parameter of a transformation. The non-secret transformation parameter is associated with a second communication device. The method comprises performing the transformation on the biometric input using the non-secret transformation parameter. The method comprises sending the transformed biometric input towards the second communication device for biometric authentication of the user by the second communication device. The method comprises receiving a result of the biometric authentication of the user from the second communication device.

[0017] According to a second aspect there is presented a computer program for biometric authentication of a user. The computer program comprises computer code which, when run on processing circuitry of a first communication device, causes the first communication device to perform actions. One action comprises the first communication device to receive a biometric input of the user. One action comprises the first communication device to obtain a non-secret transformation parameter of a transformation. The non-secret transformation parameter is associated with a second communication device. One action comprises the first communication device to perform the transformation on the biometric input using the non-secret transformation parameter. One action comprises the first communication device to send the transformed biometric input towards the second communication device for biometric authentication of the user by the second communication device. One action comprises the first communication device to receive a result of the biometric authentication of the user from the second communication device.

[0018] According to a third aspect there is presented a first communication device 200a for biometric authentication of a user. The first communication device comprises processing circuitry. The processing circuitry is configured to cause the first communication device to receive a biometric input of the user. The processing circuitry is configured to cause the first communication device to obtain a non-secret transformation parameter of a transformation. The non-secret transformation parameter is associated with a second communication device. The processing circuitry is configured to cause the first communication device to perform the transformation on the biometric input using the non-secret transformation parameter. The processing circuitry is configured to cause the first communication device to send the transformed biometric input towards the second communication device for biometric authentication of the user by the second communication device. The processing circuitry is configured to cause the first communication device to receive a result of the biometric authentication of the user from the second communication device.

[0019] According to a fourth aspect there is presented a method for biometric authentication of a user. The method is performed by a second communication device. The method comprises receiving a transformed biometric input of the user from a first communication device. The transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter. The non-secret transformation parameter is associated with the second communication device. The method comprises obtaining a transformed biometric template for the user. The method comprises authenticating the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template. The method comprises sending a result of having biometrically authenticated the user towards the first communication device.

[0020] According to a fifth aspect there is presented a computer program for biometric authentication of a user. The computer program comprises computer code which, when run on processing circuitry of a second communication device, causes the second communication device to perform actions. One action comprises the second communication device to receive a transformed biometric input of the user from a first communication device. The transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter. The non-secret transformation parameter is associated with the second communication device. One action comprises the second communication device to obtain a transformed biometric template for the user. One action comprises the second communication device to authenticate the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template. One action comprises the second communication device to send a result of having biometrically authenticated the user towards the first communication device.

[0021] According to a sixth aspect there is presented a second communication device 200b for biometric authentication of a user. The second communication device comprises processing circuitry. The processing circuitry is configured to cause the second communication device to receive a transformed biometric input of the user from a first communication device. The transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter. The non-secret transformation parameter is associated with the second communication device. The processing circuitry is configured to cause the second communication device to obtain a transformed biometric template for the user. The processing circuitry is configured to cause the second communication device to authenticate the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template. The processing circuitry is configured to cause the second communication device to send a result of having biometrically authenticated the user towards the first communication device.

[0022] According to a seventh aspect there is presented a computer program product comprising a computer program according to at least one of the second aspect and the fifth aspect and a computer readable storage medium on which the computer program is stored. The computer readable storage medium could be a non-transitory computer readable storage medium.

[0023] Advantageously, these aspects provide authentication of a user which does not suffer from the above issues, or which at least are mitigates or reduces the above issues.

[0024] Advantageously, these aspects provide authentication of a user which reduces the risk of man-in-the-middle attacks.

[0025] Advantageously, these aspects enable remote, or decentralized, biometric authentication of a user to be performed without having to expose an untransformed biometric template or any transformation parameters.

[0026] The transformation parameters have a non-secret part and a secret part. The nonsecret part can be used to protect the biometric input in transit from the first communication device to the second communication device whilst the secret part is assumed to not leave the (second) communication device and is used to protect the biometric template. Advantageously, by dividing the transformation parameter into a non-secret and a secret part, it is possible to expose the transformation parameter to protect the biometric input without exposing the transformation used for the biometric template.

[0027] The biometric template can be protected using the non-secret and the secret transformation parameters. Advantageously, the biometric input is only exposed to a trusted external device (i.e., the second communication device) and sent encrypted, whereas the biometric input is never exposed in clear-text. Consequently, an eavesdropping adversary cannot directly use it to produce a replica of the user’s biometric input.

[0028] Other objectives, features and advantages of embodiments will be apparent from the following detailed disclosure, from the attached claims, as well as from the drawings.

[0029] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the element, apparatus, component, means, module, step, etc." are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, module, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

[0030] BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The inventive concept is now described, by way of example, with reference to the accompanying drawings, in which:

[0032] Fig. i is a schematic illustration of a device according to an example;

[0033] Fig. 2 is a schematic illustration of a communication device according to embodiments;

[0034] Fig. 3 is a schematic illustration of communication devices according to embodiments;

[0035] Figs. 4 and 5 are flowcharts of methods according to embodiments;

[0036] Fig. 6 is a schematic diagram showing structural units of a communication device according to an embodiment;

[0037] Fig. 7 is a schematic diagram showing functional modules of a communication device according to an embodiment; and

[0038] Fig. 8 shows one example of a computer program product comprising computer readable means according to an embodiment. DETAILED DESCRIPTION

[0039] The inventive concept will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the inventive concept are shown. This inventive concept may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of the inventive concept to those skilled in the art. Like numbers refer to like elements throughout the description. Any step or feature illustrated by dashed lines should be regarded as optional.

[0040] As disclosed above, there still a need for an improved biometric authentication of a user.

[0041] Further in this respect, in ISO / IEC 24745 the privacy requirements for biometric authentication in terms of irreversibility, unlinkability, and confidentiality, have been defined. With respect to irreversibility, for a fixed pre-defined usage (such as recognition), the raw biometric data must be transformed into an irreversible representation that precisely fits the task of the pre-defined usage. With respect to unlinkability, there must be no relationship between two or more stored biometric templates, neither across applications nor databases.

[0042] This should hold not only for two or more stored biometric templates for the same user, but it should in general not be possible to obtain any relation between two templates as such (e.g., that two templates (potentially from different users) are similar to each other). With respect to confidentiality, the biometric template must be preserved and not exposed to unauthorized parties trying to gain unauthorized accesses. It is an object of at least some of the herein disclosed embodiments to fulfil these requirements when providing authentication of a user based on biometric input.

[0043] Many scenarios require external validation of the biometric input. In one nonlimiting example, the user of the device comprising the biometric input sensor is not the owner of this device, but would still like to use the device for biometric authentication. This requires either sending the biometric input untransformed to another device (where the authentication is performed), which, if exposed, is irrevocable, or sending / receiving the transformation parameter (to / from the aforementioned device), which, if exposed, puts the biometric template at risk, or receiving the biometric template, which requires the transformation parameter, thereby being the worst alternative of the three. Furthermore, different biometric readers have different characteristics, and even if a user has registered a biometric template using a first biometric reader, it is not certain that the user will be authenticated correctly using a second biometric reader. It is an object of at least some of the herein disclosed embodiments to address these issues.

[0044] Reference is made to the communication device 200a illustrated in Fig. 2. The communication device 200a comprises a biometric reader 202 for receiving biometric input 216 from a user. Non-limiting examples of biometric input 216 are fingerprints, palm veins, face, DNA, palm print, hand geometry, iris, retina, voice, shape of ears, etc. The communication device 200a comprises a first transformer (Transformer 1) 204 for transforming the biometric input 216. Examples of the first transformer 204 will be disclosed below. The communication device 200a comprises a second transformer (Transformer 2) 206 for transforming the transformed biometric input (i.e., the output of the first transformer 206 in Fig. 2). Examples of the second transformer 206 will be disclosed below. The communication device 200a comprises an authenticator 208 for comparing the output of the second transformer 206 to a fully-transformed biometric template 210. Possibly, the comparison is made after the output of the second transformer 206, the output of the first transformer 204 or the input of the first transformer 204 has been subjected to a format translator 212. The communication device 200a comprises a cryptographic (crypto) engine 214 for encrypting and decrypting data and information processed by the communication device 200a. Further details about how the communication device 200a can be used for authentication of a user will be disclosed below.

[0045] Reference is made to the communication devices 200a, 200b illustrated in Fig. 3. Hereinafter, communication device 200a is denoted a “first” communication device 200a, and the communication device 200b is denoted a “second” communication device 200b. However, this does not imply that there is any hierarchical relationship between these two communication devices 200a, 200b. According to the illustration in Fig. 3, the first communication device 200a is identical to the communication device 200a illustrated in Fig. 2. Further, according to the illustration in Fig. 3, the second communication device 200b is identical to the first communication device 200a, except that the communication devices 200a, 200b possibly might have different types of biometric readers 202a, 202b.

[0046] The communication devices 200a, 200b in Fig. 3 can be used in a collaborative manner for remote authentication of a user. In this respect, and as will be further disclosed below, biometric input 216 is received at the biometric reader 202a of the first communication device 200a, and then the biometric input 216 is subjected to transformation using the first transformer 204a before being encrypted (using the cryptographic engine 214a in the first communication device 200a) and sent to the second communication device 200b, where it is decrypted (using the cryptographic engine 214b in the second communication device 200b). The second communication device 200b can then, in one alternative, subject the received transformed biometric input to transformation using the second transformer 206b before comparing, in an authenticator 208b, the thus fully-transformed biometric input to the fully- transformed biometric template 210b, and report a result of the comparison back to the first communication device 200a. Further aspects of how the communication devices 200a, 200b can be used for remote authentication of a user will be disclosed below.

[0047] Reference is now made to Fig. 4 illustrating a method for (remote) biometric authentication of a user as performed by the first communication device 200a according to an embodiment.

[0048] In general terms, the first communication device 200a is configured for remote authentication of user using a second communication device 200b, where the first communication device 200a transforms biometric input using a non-secret parameter and then sends the thus transformed biometric input to the second communication device 200b for authentication.

[0049] S102: The first communication device 200a receives a biometric input of the user.

[0050] Examples of biometric input and how the biometric input can be received by the first communication device 200a are disclosed below. Sio8: The first communication device 200a obtains a non-secret transformation parameter of a transformation. The non-secret transformation parameter is associated with a second communication device 200b. The fact that the non-secret transformation parameter is non-secret does not require it to be public, but rather that it is not required to be secret. The non-secret transformation parameter does not need to represent the transformation itself. Rather, the non-secret transformation parameter might identify a parameter used by the transformation or which type of transform that is to be performed.

[0051] S114: The first communication device 200a performs the transformation on the biometric input using the non-secret transformation parameter. In the examples of Figs. 2 and 3, this transformation is performed using the first transformer (Transformer 1) 204a in the first communication device 200a.

[0052] S118: The first communication device 200a sends the transformed biometric input towards the second communication device 200b for biometric authentication of the user by the second communication device 200b.

[0053] As will be disclosed below, the second communication device 200b then performs authentication of the user using the transformed biometric input.

[0054] S120: The first communication device 200a receives a result of the biometric authentication of the user from the second communication device 200b.

[0055] Embodiments relating to further details of (remote) biometric authentication of a user as performed by the first communication device 200a will now be disclosed with reference to Fig. 4.

[0056] There maybe different ways for the first communication device 200a to receive the biometric input. In some embodiments, the first communication device 200a comprises a biometric reader 202a and the biometric input is captured by the biometric reader. This could be the case where the first communication device 200a is a constrained device which only is configured to perform above steps S102, S108, S114, S118, i.e., where the first communication device 200a does not have any other purpose than to assist the second communication device 200b in remote biometric authentication of the user. The first communication device 200a can, e.g., be used to allow access to company premises and let the biometric input to be sent to a communication device (i.e., the second communication device 200b) belonging to the user for authentication of the user.

[0057] In other embodiments, the biometric input is received by a communication interface at the first communication device 200a, e.g., a wired or wireless communication interface (see, Fig. 6). As a non-limiting example, in case the communication interface is wired, the biometric input could be received from a peripheral device, such as a storage device, a (dedicated) biometric reader, or the like. As a non-limiting example, in case the communication interface is wireless, the biometric input could be received from a peer communication device, a (dedicated) biometric reader, or the like.

[0058] In some aspects, first communication device 200a might have access to a database comprising identities of a set of second communication devices 200b and information of which of the second communication devices 200b that have access to biometric templates of which users. The first communication device 200a might then select the second communication device 200b from this set. Hence, in some embodiments, the first communication device 200a is configured to perform (optional) step Sio6.

[0059] Sio6: The first communication device 200a selects the second communication device 200b from the set of second communication devices 200b that has access to the biometric template of the user to be authenticated.

[0060] There maybe different ways for the first communication device 200a to obtain the non-secret transformation parameter. In some embodiments, the non-secret transformation parameter is obtained from the second communication device 200b or from a third communication device. Further aspects of the third communication device will be disclosed below. One benefit with obtaining the non-secret transformation parameter from the second communication device 200b is that the second communication device 200b is the device where the authentication is to be performed (see below) and that the second communication device 200b thereby can select the non-secret transformation parameter so that it best fits the type of authentication that will be performed. One benefit with obtaining the non-secret transformation parameter from a third communication device is that the authentication procedure can be set up ad hoc without any previous knowledge of what type of second communication device 200b will be to use for performing the authentication.

[0061] Support for format translations, i.e., to enable different biometric readers to be used, as well as a reconfiguration of the transformation function, enabling different transformations to be applied, is usable for scenarios where the first communication device 200a and / or the second communication device 200b support more than one biometric format. Therefore, in some aspects, the biometric input in the first communication device 200a is translated, by a format translator 212a, from the format of the biometric reader 202a of the first communication device 200a into a format produced by a biometric reader 202b of the second communication device 200b. Hence, in some embodiments, the first communication device 200a is configured to perform (optional) steps S110, S112, S116.

[0062] S110: The first communication device 200a receives information of a biometrics format supported by the second communication device 200b.

[0063] S112, S116: The first communication device 200a performs a format translation either on the biometric input 216 to the biometrics format before performing the transformation on the biometric input, or on the transformed biometric input before sending the transformed biometric input towards the second communication device 200b.

[0064] It is here noted that the format translation thus could be performed either before the transformation in step S114 (as in step S112) or after the transformation in step S114 (as in step S116).

[0065] There can be different types of format translations. In some non-limiting examples, the biometrics format defines at least one of: alignment of the biometric input, feature representation in the biometric input, scaling of the biometric input, rotation of the biometric input, translation (e.g., translation process specifications) of the biometric input.

[0066] In some embodiments, the transformation performed on the biometric input using the non-secret transformation parameter is non-reversible. In other embodiments, the transformation performed on the biometric input using the non-secret transformation parameter is reversible. Examples of both reversible and non- reversible transforms will be disclosed below.

[0067] In some aspects, the first communication device 200a is also configured to perform local biometric authentication, in an authenticator 208a, of the user, using locally stored non-secret and secret transformation parameters (by means of performing a first transformation by the first transformer 204a using the non-secret parameter and a second transformation by a second transformer 206a using the secret parameter), with a comparison to a locally stored fully transformed biometric template 210a of the user, but selects to use the remote authentication when some condition is fulfilled. Hence, in some embodiments, the first communication device 200a is configured to perform (optional) step S104.

[0068] S104: The first communication device 200a selects to send the transformed biometric input towards the second communication device 200b for biometric authentication of the user when a condition is fulfilled.

[0069] There could be different such conditions.

[0070] In some non-limiting examples, the condition is fulfilled by the first communication device 200a receiving user input from the user specifying that remote authentication is to be performed for a specific service, or device.

[0071] In some non-limiting examples, the condition is fulfilled when the user tries to access a service at the first communication device 200a, where access to the service requires remote authentication of the user. In some non-limiting examples, the condition is fulfilled when the user has been locally authenticated at the first communication device 200a. In some non-limiting examples, the condition is fulfilled by the first communication device 200a receiving a message instructing the first communication device 200a to perform remote authentication. The message might be received from the second communication device 200b or the third communication device, e.g., a wearable such as a smart ring or extended reality (XR) glasses. Combinations of the above examples are also possible. There might be different actions taken by the first communication device 200a upon having received the result of the biometric authentication of the user from the second communication device 200b in step S120.

[0072] For example, when the result indicates successful authentication, the first communication device 200a might create a secure virtual private network tunnel, or other type of secure communication channel, to the second communication device 200b. That is, in some embodiments, the first communication device 200a is configured to perform (optional) step S122 upon the biometric authentication of the user being successful.

[0073] S122: The first communication device 200a establishes, for the user, a secure communication channel with the second communication device 200b.

[0074] For example, when the result indicates successful authentication, the second communication device 200b might send a token, or other type of credential such as a decryption key, a password, or a personal identification number (PIN), which the user can use to, at least temporarily, access a user profile on the first communication device 200a. That is, in some embodiments, the first communication device 200a is configured to perform (optional) step S124 upon the biometric authentication of the user being successful.

[0075] S124: The first communication device 200a receives a credential from the second communication device 200b for the user to access a user profile on the first communication device 200a.

[0076] For example, when the result indicates unsuccessful authentication, the second communication device 200b might send an indication to the first communication device 200a that the authentication of the user failed.

[0077] Reference is now made to Fig. 5 illustrating a method for (remote) biometric authentication of a user as performed by the second communication device 200b according to an embodiment.

[0078] As disclosed above, the first communication device 200a sends a transformed biometric input of the user and the second communication device 200b authenticates the user using the received transformed biometric input. S206: The second communication device 200b receives a transformed biometric input of the user from a first communication device 200a. The transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter. The non-secret transformation parameter is associated with the second communication device 200b.

[0079] S208: The second communication device 200b obtains a transformed biometric template 210b for the user.

[0080] S210: The second communication device 200b authenticates (using the authenticator 208b) the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device 200b having performed a transformation (by the second transformer 206b) using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template.

[0081] S212: The second communication device 200b sends a result of having biometrically authenticated the user towards the first communication device 200a.

[0082] Embodiments relating to further details of (remote) biometric authentication of a user as performed by the second communication device 200b will now be disclosed with continued reference to Fig. 5.

[0083] In some aspects, the first communication device 200a already has access to the non- secret transformation parameter. However, in other aspects, the second communication device 200b needs to share the non-secret transformation parameter with the first communication device 200a. Hence, in some embodiments, the second communication device 200b is configured to perform (optional) step S202.

[0084] S202: The second communication device 200b sends the non-secret transformation parameter towards the first communication device 200a.

[0085] In some aspects, the first communication device 200a already has access to information about which one or more biometric formats is / are supported by the second communication device 200b. However, in other aspects, the second communication device 200b needs to share which one or more biometric formats is / are supported by the second communication device 200b with the first communication device 200a. Hence, in some embodiments, the second communication device 200b is configured to perform (optional) step S204.

[0086] S204: The second communication device 200b sends information of at least one biometrics format supported by the second communication device 200b towards the first communication device 200a.

[0087] This could, for example, be the case where the second communication device 200b supports several biometrics formats, thus each with its own templates 210a, 210b, and the first communication device 200a is allowed to select one of those biometrics formats (under the assumption that the first communication device 200a also supports the selected biometric format).

[0088] Further in this respect, as noted above, the biometric input might in the first communication device 200a be translated from the format of the biometric reader 202a of the first communication device 200a into the format produced by the biometric reader 202b of the second communication device 200b. However, in other aspects, for example when the translation is performed after the transformation by the first transformer 204a in the first communication device, the translation might be performed by a format translator 212b in the second communication device 200b before the transformation by the second transformer 206b in the second communication device 200b is performed.

[0089] In some aspects, the biometric template is created using a first transformation 204b using the non-secret transformation parameter and a second transformation 206b using the secret transformation parameter. That is, in some embodiments, obtaining the transformed biometric template 210b comprises performing a first transformation (by the first transformer 204b) on a clear-text biometrics template of the user using the non-secret transformation parameter and performing a second transformation (by the second transformer 206b) on the transformed clear-text biometrics template of the user using the secret transformation parameter.

[0090] In some aspects, the clear-text biometrics template is created from biometric input samples received at the biometric reader 202b of the second communication device 200b. That is, in some embodiments the second communication device 200b comprises a biometric reader 202b, and the clear-text biometrics template is generated based on biometric input samples of the user as received at the biometric reader 202b.

[0091] As disclosed above, the second communication device 200b performs a transformation using the secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template. Aspects where the transformation is performed on the transformed biometric input will be disclosed next. In this case, the second communication device 200b might perform the same transformation on the received transformed biometric input as on the transformed biometrics template. In the examples of Fig. 3, this transformation is performed using the second transformer (Transformer 2) 206b in the second communication device 200b. That is, in some embodiments, the transformation performed on the transformed biometric input using the secret transformation parameter is identical to the second transformation. In some non-limiting examples, the transformation performed on the transformed biometric input using the secret transformation parameter comprises at least one of: block substitution, permutation, and masking.

[0092] In order to be compliant with ISO / IEC 24745, at least one of the transformations should be non-reversible to fulfil the irreversibility requirement. Therefore, in some embodiments, when the transformation performed on the biometric input using the non-secret transformation parameter is invertible, the transformation performed on the transformed biometric input using the secret transformation parameter is non- reversible.

[0093] Aspects where the transformation is performed on the transformed biometric template will be disclosed next. In this case, in some embodiments, the transformation performed on the transformed biometric template using the secret transformation parameter is an inverse of the second transformation.

[0094] As disclosed above, upon successful authentication (i.e., when the result indicates successful authentication), the first communication device 200a might create a secure virtual private network tunnel, or other type of secure communication channel, to the second communication device 200b. Hence, in some embodiments, the second communication device 200b is configured to perform (optional) step S214 upon the biometric authentication of the user being successful. S214: The second communication device 200b establishes, for the user, a secure communication channel with the first communication device 200a.

[0095] As further disclosed above, upon successful authentication (i.e., when the result indicates successful authentication), the second communication device 200b might send a token, or other type of credential such as a decryption key, a password, or a PIN, which the user can use to, at least temporarily, access a user profile on the first communication device 200a. Hence, in some embodiments, the second communication device 200b is configured to perform (optional) step S216 upon the biometric authentication of the user being successful.

[0096] S216: The second communication device 200b sends a credential towards the first communication device 200a for the user to access a user profile on the first communication device 200a.

[0097] As is further disclosed above, upon unsuccessful authentication (i.e., when the result indicates unsuccessful authentication), the second communication device 200b might send an indication to the first communication device 200a that the authentication of the user failed.

[0098] Further aspects of (remote) biometric authentication of a user as performed by the first communication device 200a and the second communication device 200b will now be disclosed.

[0099] There might or might not be a pre-defined trust relationship between the first communication device 200a and the second communication device 200b. The second communication device 200b is assumed to store a biometric template 210b of a user. Furthermore, the first communication device 200a might store a biometric template 210a of another user. In some examples, the first and second communication devices 200a, 200b are configured for use by the same user. In this case, the second communication device 200b acts as a central authenticator for the first communication device 200a (and all other communication devices of the user). That is, the authentication is common for all communication devices of the user). In such an example the first communication device 200a does not need to store a biometric template 210a and hence does not need a private (i.e., secret) parameter. In any case, the embodiments disclosed herein are presented from the perspective where the second communication device 200b stores a biometric template 210b of the user. The biometric templates 210a, 210b should be of the same biometric input type (e.g., fingerprints, face scans, iris scans, retina scans, ear scans, etc.). In this respect, the herein disclosed embodiments are not dependent on the type of biometrics input 216 used, as long as there exist a transformation function (as provided by the format translators 212a, 212b) which enables biometric input to be authenticated against a biometric template 210a, 210b. Translation functions exist for, e.g., fingerprint authentication, face authentication, iris authentication, etc.

[0100] A biometric input 216 which has been transformed with the non-secret parameter can be referred to as a “public-parameter-transformed biometric input” and a biometric input transformed with both the non-secret parameter and the secret parameter as a “fully transformed biometric input”. The term ”non-secref ’ should in this context be understood as externally exposable, as it might be unwise from a privacy perspective to share the non-secret parameter with any non-trusted external device. That is, the non-secret parameter should only be shared with a device which the second communication device 200b has a trust relationship with.

[0101] In some examples, it is further assumed that the user is authorized to access the first communication device 200a after successful authentication, possibly with restrictions imposed by the first communication device 200a.

[0102] The first communication device 200a and the second communication device 200b might each comprise a biometric reader 202a, 2020b and a biometric authentication component (as represented by the authenticator 208a, 208b). The communication devices 200a, 200b might are further be equipped with transformation components (as represented by the transformers 204a, 204b, 206a, 206b), where the first communication device 200a is at least provided with a non-secret parameter (and thus a first transformer 204a) and the second communication device 200b is at least provided with a secret parameter (and thus a second transformer 206b). The parameters might be unique per communication device 200a, 200b or unique per biometric template (i.e., where either all biometric templates on one communication device 200a, 200b uses the same non-secret and secret pair of parameters, or each biometric template uses a unique pair of non-secret and secret parameters). At least the first communication device 200a has access to a database with identities and nonsecret parameters of the second communication device 200b.

[0103] The transformation components may be implemented using hardware (HW), programmable logic (PL) or software (SW). It may further be implemented as one component which is reconfigured with different parameters or as at least two different HW / SW / PL components.

[0104] Assume that the user selects a profile on the first communication device 200a and that the first communication device 200a has at least one trusted second communication device 200b defined in a database accessible to the first communication device 200a. In some examples, this can be automated by using either the second communication device 200b or a third communication device (e.g., a smart wearable communication device) in proximity of the first communication device 200a which can push identity information to the first communication device 200a.

[0105] The first communication device 200a might then query the second communication device 200b to determine if the second communication device 200b is ready to perform remote biometric authentication of the user. During this procedure, the first communication device 200a might further determine the identity of the second communication device 200b by requiring, e.g., a signed message with a private key belonging to the second communication device 200b. During this stage, the first communication device 200a may also establish a session key with the second communication device 200b.

[0106] In some examples, the first communication device 200a can require the second communication device 200b to be in proximity of the first communication device 200a by the first communication device 200a sending out the request on, e.g., a short-range (radio) interface, using a tactile surface, light fidelity (LiFi), visible light communication (VLC), Mobile Device Light Communications (LED), and / or audio communication.

[0107] If the authentication of the user, for example, is the first remote authentication where the first communication device 200a is using the second communication device 200b, or, e.g., the second communication device 200b has updated its transformation parameters, the second communication device 200b supplies its nonsecret transformation parameter, transformation configuration parameters (optionally), and local biometric reader configuration (optionally), to the first communication device 200a.

[0108] The first communication device 200a sets up the transformation component according to the transformation configuration, loads the non-secret transformation parameter into the configured first transformation 204a, and, optionally, biometric configuration into a format translator 212a.

[0109] The user activates the biometric reader 202a at the first communication device 200a and the first communication device 200a receives biometric input 216 therefrom.

[0110] Optionally, the first communication device 200a supplies the biometric input 216 to the format translator 212a which translates the format from the biometric reader 202a at the first communication device 200a to the format of the biometric reader 202b at the second communication device 200a. This may include updates in how the detected features are represented, scaling, rotation, etc. The format translator 212a may further receive an alignment indication which instructs how to align the biometric input to fit the biometric template 210a, 210b. This can, e.g., comprise an expected width and length of a face, a rotation of the eye surrounding the iris. It may further include traits which are a part of biometric input 216 but not a part of the biometric template 210a, 210b, e.g., minutiae in a fingerprint where defined distances and angles between at least two minutiae can be used to support alignment.

[0111] The first communication device 200a transforms the biometric input 216 as received from the biometric reader 202a using the non-secret parameter. The transformation depends on the non-secret parameter and should preferably be non-reversible to make it impossible for an eavesdropper to restore it to its original form. Security considerations regarding different transformation functions will be provided below.

[0112] In some examples, the format translation and the first transformation are performed in opposite order, i.e., the transformation is performed before the format translation. This may be relevant in scenarios where the transformation keeps certain properties of the biometric input post-transformation. As remote authentication is to be performed, the public-parameter-transformed biometric input is encrypted (optionally) by the cryptographic engine 214a and sent to the second communication device 200b. The encryption might be performed using a public key of the second communication device 200b or with the aforementioned session key.

[0113] The first communication device 200a sends the (encrypted) public-parameter- transformed biometric input to the second communication device 200b. The second communication device 200b decrypts (if needed) it using the cryptographic engine 214b and (optionally) validates the format to be consistent with the expected format after the transformation, had the transform been performed locally.

[0114] The second communication device 200b sets up the second transformation 206b with the secret parameter and transforms the public-parameter-transformed biometric input to a fully transformed biometric input. The second communication device 200b validates the fully transformed biometric input against the fully transformed biometric template 210b. In some examples, if the validation is successful, the second communication device 200b produces a signed message that it vouches for the identity of the user and sends it to the first communication device 200a.

[0115] Alternatively, the public-parameter-transformed biometric input in the second communication device 200b is not transformed using the second transformation 206b. Instead, a reverse transformation is applied to the biometric template, 210b removing the private-parameter-transformation from the biometric template. This enables the biometric template and the biometric input to be validated in the public-parameter-transformed domain. Such an alternative might require the second transformation 206b to be invertible since it is first applied to the biometric template and then its inverse is applied to the transformed biometric template 210b. Again, in some examples, if the validation is successful, the second communication device 200b produces a signed message that it vouches for the identity of the user and sends it to the first communication device 200a.

[0116] The first communication device 200a receives the message, validates it using the private key of the first communication device 200a, and unlocks the functionality allowed to be accessed by the user. Further aspects of the transformation functions used to perform the transforms will be disclosed next.

[0117] In some examples, the first transformation function, as used by the first transform 204a in the first communication device 200a, is selectable from several components, e.g., software components, programmable logic components and / or hardware components. Each component or combination of components might implement one type of biometric transformation, either invertible or non-invertible. The transformation configuration (as received by the first communication device 200a from the second communication device 200b) might cause the first communication device 200a to activate the relevant components according to the received transformation configuration. In other examples, this transformation function is a single component (SW / PL / HW) and the transformation configuration instead causes a reconfiguration of the component. For example, the reconfiguration might change an input signal which causes the transformation function to be performed using one of several supported algorithms. In yet other examples, the transformation configuration comprises a SW or PL component which can be used directly by the first communication device 200a. In this case, the first communication device 200a does have to support the algorithm locally prior to receiving the transformation configuration. The transformation configuration might be required to have a trusted signature of the second communication device 200b to ensure the first communication device 200a that any received transformation configuration indeed is trustworthy.

[0118] Furthermore, the output of the first transformation 204a should be in a format which is acceptable by a second transformation function, as used by the second transformer 206b in the second communication device 200b (and also the by the second transformer 206a in the first communication device 200a). Hence, not all combinations of transformation functions might be realizable, as certain transformation functions might require raw biometric readings as input, as a nonlimiting illustrative example, if the biometric input 216 is stored as a two-dimensional map of the detected minutiae and the second transformation function, e.g., a surface folding transformation, expects a two-dimensional map of the detected minutiae, the first transformation function must preserve the format of the biometric readings during the transformation. In some examples, the second transformation function maybe of a type which can function with many different types of input. For example, the second transformation function might be a block substitution and / or permutation function which divides the input into several subsets and permutes the order of subsets or substitutes elements in said subset according to a secret parameter. This enables a communication device with knowledge of the permutation and / or substitution to measure distance within the subsets. As an example, if the first transformation function projects the minutiae onto an orthogonal matrix, the second transformation function could be a substitution of matrix elements and / or a permutation of columns or rows in the matrix. The substitution may change the alignment, type, or size of the minutiae.

[0119] In other examples, the first transformation function is a Bloom filter, an orthogonal projection, or another transformation, creating a data structure which is suitable to use as input for an error-tolerant second transformation. Examples of such are fuzzy extractor or bio-hashing transformation, i.e., a transformation function where input with low inter-differences have a high probability of producing the same output.

[0120] In yet other examples, where the first transformer 204a outputs a series distances, e.g., Hamming distance or Euclidean distance, the second transformation function may be a masking function which alters each distance with a variable defined by the secret parameter.

[0121] Further aspects of usage of invertible and non-invertible transformations will be disclosed next.

[0122] In case the first transformer 204a uses an invertible function, the transformation parameter should be protected by both the first communication device 200a and the second communication device 200b (using the cryptographic engines 214a, 214b). The needed level of protection could be indicated by metadata to inform the respective communication devices 200a, 200b of protection requirements for the parameter during data-at-rest, data-in-transit, and data-in-use respectively. The second transformation function can be either invertible or non-invertible, depending on what is used in the first transformation function. To be compliant with ISO / IEC 24745, at least one of the transformation functions should be non-invertible to fulfill the irreversibility requirement. Examples of biometric transformation functions will be disclosed next.

[0123] A biometric template transformation might be regarded as representing one methodology for biometric template protection, where the biometric template, consisting of the features extracted from the biometric trait, is transformed using parameters derived from a user specific password or key.

[0124] In general terms, transformation functions for biometric input can be divided into two main categories: invertible and non-invertible. The former enables a communication device 200a, 200b which knows the transformation function and the transformation parameter (if any) to restore something at least close to the original biometric input. With non-invertible transformation functions it is not possible to restore the original biometric input, even with the transformation parameter.

[0125] Therefore, the parameters for any non-invertible transformations might generally require less protection than the parameters for any invertible transformations as the attacker directly can revert the biometric input 216 to its original state if having access to the parameters of the invertible transformation. However, the non- invertible parameters are not insensitive per se. If the non-invertible parameters are used solely to encrypt the biometric template, an attack can mount a so-called hillclimbing attack (i.e., making small adjustments to synthetic biometric input and determine if the distance between the input and the biometric template increases or decreases.

[0126] Random Orthonormal Projection is a technique that utilizes an orthonormal matrix (i.e., a matrix which transpose is equal to its inverse) to project a set of points into other space while preserving the distances between points. It meets the cancelability requirement by mapping a biometric feature into a secure domain through an orthonormal matrix. The distance between the biometric template and the biometric input is then measured in the secure domain.

[0127] Surface folding is a non-invertible transformation method. In a surface folding transformation, both the position and the orientation of the minutiae are changed by some parametric transfer function. Conceptually, the minutiae are embedded in a sheet which is then crumpled. Yet another non-invertible transformation method is Bloom filters. A standard Bloom filter is a data structure that can be used to verify whether an element belongs to a set or not. Each detected element / minutiae can be hashed with a series of differently configured hash functions, and the result of each function represents an index in the data structure which is marked as non-zero. Bloom filters can be used in biometrics data processing not only as a space-efficient data structure but also for its invariant property with respect to element insertion since the Bloom filter of a set of elements is identical to the Bloom filter of any permutation of the same set of elements.

[0128] Yet another non-invertible transformation method is Fuzzy extractors. Fuzzy extractors are a biometric tool that allows for user authentication, using a biometric template constructed from the user's biometric data as the key, by extracting a uniform and random string R from an input w, with a tolerance for noise. If the input changes to w' but is still close to w, the same string R will be re-constructed. To achieve this, during the initial computation of R the process also outputs a helper string P which will be stored to recover R later and can be made public without compromising the security of R. The security of the process is also ensured when an adversary modifies P. Once the fixed string R has been calculated, it can be used, for example, for key agreement between a user and a server based only on a biometric input.

[0129] Bio-hashing is an example of an invertible transformation, where the feature vector in the biometric input is transformed into a binary vector, where the binary vector is made unique by performing the transform in combination with a secret parameter. A communication device in possession of the secret parameter is able to invert the transformation and revert to the original data (possibly with some information losses depending on implementation).

[0130] Block substitution is another example of invertible transformations, where minutiae are grouped into different squares in a two-dimensional map and these squares are scrambled in a manner defined by a secret parameter.

[0131] Further aspects of utilizing a third communication device will be disclosed next.

[0132] In some examples, a third communication device, present in proximity of the first communication device 200a is used to assist in selecting the identity of the user to be authenticated. The third communication device may, e.g., send the identity and / or an address of the second communication device 200b over a short-range (radio) interface, using a tactile surface, LiFi, VLC, LED, and / or audio communication. This could automate the process of selecting a profile in the pre-authentication phase.

[0133] Some non-limiting examples of scenarios where the herein disclosed embodiments are applicable will be disclosed next.

[0134] A first example relates to biometric authentication for non-primary users.

[0135] Assume the first communication device 200a contains two profiles, one for a primary user and at least one for secondary users and that some services as provided by the first communication device 200a are accessible by at least some of the secondary users. Authentication is required for a secondary user to gain access to any these services. For example, a secondary user might temporarily use the first communication device 200a to interact with the second communication device 200b according to the following. First the secondary user is authenticated via the first communication device 200a (as described above). Upon successful authentication, the first communication device 200a creates a secure communication channel to the second communication device 200b. This allows the secondary user to use the first communication device 200a temporarily either to remotely resolve some technical issue in the second communication device 200b or have remote access to certain functions of the second communication device 200b.

[0136] A second example relates to central biometric authentication for all the user’s devices.

[0137] Assume that a user has access to several different communication devices, where each might have biometric readers, but only one stores a biometric template. In this case, those communication devices which do not have access to the biometric template will act as the first communication device 200a and the communication device with access to the biometric template will act as the second communication device 200b. In this way, the second communication device 200b can be used to authenticate the user on behalf of the rest of the communication devices.

[0138] A third example relates to biometric authentication using shared devices for temporary usage. Assume that the first communication device 200a is a device with no primary user, but rather is for temporary usage of certain, approved users. A profile belonging to a user can be downloaded to the first communication device 200a. The user provides biometric input to the first communication device 200a, and the second communication device 200b is used to authenticate the user, as described above. The second communication device 200b, could, upon successful authentication, provide a token to the first communication device 200a which the first communication device 200a can use to, temporarily, access the users profile on the first communication device 200a.

[0139] Fig. 6 schematically illustrates, in terms of structural units, the components of a communication device 200a, 200b according to an embodiment. Processing circuitry 285 is provided using any combination of one or more of a suitable central processing unit (CPU), multiprocessor, microcontroller, digital signal processor (DSP), etc., capable of executing software instructions stored in a computer program product 285 (as in Fig. 8), e.g., in the form of a storage medium 295. The processing circuitry 285 may further be provided as at least one application specific integrated circuit (ASIC), or field programmable gate array (FPGA).

[0140] Particularly, the processing circuitry 285 is configured to cause the communication device 200a, 200b to perform a set of operations, or steps, as disclosed above. For example, the storage medium 295 may store the set of operations, and the processing circuitry 285 maybe configured to retrieve the set of operations from the storage medium 295 to cause the communication device 200a, 200b to perform the set of operations. The set of operations may be provided as a set of executable instructions.

[0141] Thus, the processing circuitry 285 is thereby arranged to execute methods as herein disclosed. The storage medium 295 may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid state memory or even remotely mounted memory. The communication device 200a, 200b may further comprise a communications (comm.) interface 290 at least configured for communications with other devices, nodes, and entities, such as other communication devices. As such the communications interface 290 may comprise one or more transmitters and receivers, comprising analogue and digital components. The processing circuitry 285 controls the general operation of the communication device 200a, 200b, e.g., by sending data and control signals to the communications interface 290 and the storage medium 295, by receiving data and reports from the communications interface 290, and by retrieving data and instructions from the storage medium 295. Other components, as well as the related functionality, of the communication device 200a, 200b are omitted in order not to obscure the concepts presented herein.

[0142] Fig. 7 schematically illustrates, in terms of a number of functional modules, the components of a communication device 200a, 200b according to an embodiment. The communication device 200a, 200b of Fig. 7 comprises a number of functional modules.

[0143] The communication device 200a, 200b when configured to act as a first communication device 200a comprises a receive module 285a configured to perform step S102, an obtain module 283d configured to perform step S108, a transform module 285g configured to perform step S114, a send module 285! configured to perform step S118, and a receive module 285,] configured to perform step S120. The communication device 200a, 200b of Fig. 7, when configured to act as a first communication device 200a, may further comprise a number of optional functional modules, such as any of a select module 285b configured to perform step S104, a select module 285c configured to perform step S106, a receive module 285c configured to perform step S110, a translate module 28sf configured to perform step S112, a translate module 285b configured to perform step S116, an establish module 285k configured to perform step S122, and a receive module 285I configured to perform step S124.

[0144] The communication device 200a, 200b when configured to act as a second communication device 200b comprises a receive module 2850 configured to perform step S206, an obtain module 285P configured to perform step S208, an authenticate (Auth.) module 2854 configured to perform step S210, and a send module 28sr configured to perform step S212. The communication device 200a, 200b of Fig. 7, when configured to act as a second communication device 200b, may further comprise a number of optional functional modules, such as any of a send module 285m configured to perform step S202, a send module 28sn configured to perform step S204, an establish module 285s configured to perform step S214, and a send module 285! configured to perform step S216.

[0145] In general terms, each functional module 2853:2851 may in one embodiment be implemented only in hardware and in another embodiment with the help of software, i.e., the latter embodiment having computer program instructions stored on the storage medium 295 which when run on the processing circuitry makes the communication device 200a, 200b perform the corresponding steps mentioned above in conjunction with Figs. 4, 5. It should also be mentioned that even though the modules correspond to parts of a computer program, they do not need to be separate modules therein, but the way in which they are implemented in software is dependent on the programming language used. Preferably, one or more or all functional modules 2853:2851 maybe implemented by the processing circuitry 285, possibly in cooperation with the communications interface 290 and / or the storage medium 295. The processing circuitry 285 may thus be configured to from the storage medium 295 fetch instructions as provided by a functional module 2853:2851 and to execute these instructions, thereby performing any steps as disclosed herein.

[0146] Each communication device 200a, 200b maybe provided as a standalone device or as a part of at least one further device. A first portion of the instructions performed by the communication device 200a, 200b maybe executed in a first device, and a second portion of the of the instructions performed by the communication device 200a, 200b maybe executed in a second device; the herein disclosed embodiments are not limited to any particular number of devices on which the instructions performed by the communication device 200a, 200b maybe executed. Hence, the methods according to the herein disclosed embodiments are suitable to be performed by a communication device 200a, 200b residing in a cloud computational environment. Therefore, although a single processing circuitry 285 is illustrated in Fig. 6 the processing circuitry 285 maybe distributed among a plurality of devices, or nodes. The same applies to the functional modules 2853:2851 of Fig. 7 and the computer programs 820a, 820b of Fig. 8.

[0147] Fig. 8 shows one example of a computer program product 810a, 810b comprising computer readable means 830. On this computer readable means 830, a computer program 820a can be stored, which computer program 820a can cause the processing circuitry 285 and thereto operatively coupled entities and devices, such as the communications interface 290 and the storage medium 295, to execute methods according to embodiments described herein. The computer program 820a and / or computer program product 810a may thus provide means for performing any steps of the first communication device 200a as herein disclosed. On this computer readable means 830, a computer program 820b can be stored, which computer program 820b can cause the processing circuitry 285 and thereto operatively coupled entities and devices, such as the communications interface 290 and the storage medium 295, to execute methods according to embodiments described herein. The computer program 820b and / or computer program product 810b may thus provide means for performing any steps of the second communication device 200b as herein disclosed.

[0148] In the example of Fig. 8, the computer program product 810a, 810b is illustrated as an optical disc, such as a CD (compact disc) or a DVD (digital versatile disc) or a Blu- Ray disc. The computer program product 810a, 810b could also be embodied as a memory, such as a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), or an electrically erasable programmable read-only memory (EEPROM) and more particularly as a non-volatile storage medium of a device in an external memory such as a USB (Universal Serial Bus) memory or a Flash memory, such as a compact Flash memory. Thus, while the computer program 820a, 820b is here schematically shown as a track on the depicted optical disk, the computer program 820a, 820b can be stored in any way which is suitable for the computer program product 810a, 810b.

[0149] The inventive concept has mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the inventive concept, as defined by the appended patent claims.

Claims

CLAIMS1. A method for biometric authentication of a user, wherein the method is performed by a first communication device (200a), and wherein the method comprises: receiving (S102) a biometric input of the user; obtaining (S108) a non-secret transformation parameter of a transformation, wherein the non-secret transformation parameter is associated with a second communication device (200b); performing (S114) the transformation on the biometric input using the non- secret transformation parameter; sending (S118) the transformed biometric input towards the second communication device (200b) for biometric authentication of the user by the second communication device (200b); and receiving (S120) a result of the biometric authentication of the user from the second communication device (200b).

2. The method according to claim 1, wherein the first communication device (200a) comprises a biometric reader, and wherein the biometric input is captured by the biometric reader.

3. The method according to claim 1 or 2, wherein the first communication device (200a) has access to a database comprising identities of a set of second communication devices (200b) and information of which of the second communication devices (200b) that have access to biometric templates of which users, and wherein the method further comprises: selecting (S106) the second communication device (200b) from the set of second communication devices (200b) that has access to the biometric template of the user to be authenticated.

4. The method according to any of claims 1 to 3, wherein the non-secret transformation parameter is obtained by being receiving from the second communication device (200b) or from a third communication device (200c).

5. The method according to any of claims 1 to 4, wherein the method further comprises: receiving (S110) information of a biometrics format supported by the second communication device (200b); and performing (S112, S116) a format translation either on the biometric input to the biometrics format before performing the transformation on the biometric input, or on the transformed biometric input before sending the transformed biometric input towards the second communication device (200b).

6. The method according to claim 5, wherein the biometrics format defines at least one of: alignment of the biometric input, feature representation in the biometric input, scaling of the biometric input, rotation of the biometric input, translation of the biometric input.

7. The method according to any of claims 1 to 6, wherein the transformation performed on the biometric input using the non-secret transformation parameter is non-reversible.

8. The method according to any of claims 1 to 7, wherein the first communication device (200a) is configured to perform biometric authentication of the user, and wherein the method further comprises: selecting (S104) to send the transformed biometric input towards the second communication device (200b) for biometric authentication of the user when a condition is fulfilled.

9. The method according to any of claims 1 to 8, wherein the method, upon the biometric authentication of the user being successful, further comprises: establishing (S122), for the user, a secure communication channel with the second communication device (200b).

10. The method according to any of claims 1 to 8, wherein the method, upon the biometric authentication of the user being successful, further comprises: receiving (S124) a credential from the second communication device (200b) for the user to access a user profile on the first communication device (200a).n. A method for biometric authentication of a user, wherein the method is performed by a second communication device (200b), and wherein the method comprises: receiving (S206) a transformed biometric input of the user from a first communication device (200a), wherein the transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter, wherein the non-secret transformation parameter is associated with the second communication device (200b); obtaining (S208) a transformed biometric template for the user; authenticating (S210) the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device (200b) having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template; and sending (S212) a result of having biometrically authenticated the user towards the first communication device (200a).

12. The method according to claim 11, wherein the method further comprises: sending (S202) the non-secret transformation parameter towards the first communication device (200a).

13. The method according to claim 11 or 12, wherein the method further comprises: sending (S204) information of at least one biometrics format supported by the second communication device (200b) towards the first communication device (200a).

14. The method according to any of claims 11 to 13, wherein obtaining the transformed biometric template comprises performing a first transformation on a clear-text biometrics template of the user using the non-secret transformation parameter and performing a second transformation on the transformed clear-text biometrics template of the user using the secret transformation parameter.15- The method according to claim 14, wherein the second communication device (200b) comprises a biometric reader, and wherein the clear-text biometrics template is generated based on biometric input samples of the user as received at the biometric reader.

16. The method according to claim 14 or 15, wherein the transformation performed on the transformed biometric input using the secret transformation parameter is identical to the second transformation.

17. The method according to any of claims 11 to 16, wherein the transformation performed on the transformed biometric input using the secret transformation parameter comprises at least one of: block substitution, permutation, and masking.

18. The method according to any of claims 11 to 17, wherein, when the transformation performed on the biometric input using the non-secret transformation parameter is invertible, the transformation performed on the transformed biometric input using the secret transformation parameter is non- reversible.

19. The method according to any of claims 11 to 17, wherein the transformation performed on the transformed biometric template using the secret transformation parameter is an inverse of the second transformation.

20. The method according to any of claims 11 to 19, wherein the method, upon the biometric authentication of the user being successful, further comprises: establishing (S214), for the user, a secure communication channel with the first communication device (200a).

21. The method according to any of claims 11 to 19, wherein the method, upon the biometric authentication of the user being successful, further comprises: sending (S216) a credential towards the first communication device (200a) for the user to access a user profile on the first communication device (200a).

22. A computer program (820a) for biometric authentication of a user, the computer program comprising computer code which, when run on processing circuitry (285) of a first communication device (200a), causes the first communication device (200a) to: receive (S102) a biometric input of the user; obtain (S108) a non-secret transformation parameter of a transformation, wherein the non-secret transformation parameter is associated with a second communication device (200b); perform (S114) the transformation on the biometric input using the non-secret transformation parameter; send (S118) the transformed biometric input towards the second communication device (200b) for biometric authentication of the user by the second communication device (200b); and receive (S120) a result of the biometric authentication of the user from the second communication device (200b).

23. A computer program (820b) for biometric authentication of a user, the computer program comprising computer code which, when run on processing circuitry (285) of a second communication device (200b), causes the second communication device (200b) to: receive (S206) a transformed biometric input of the user from a first communication device (200a), wherein the transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter, wherein the non-secret transformation parameter is associated with the second communication device (200b); obtain (S208) a transformed biometric template for the user; authenticate (S210) the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device (200b) having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template; and send (S212) a result of having biometrically authenticated the user towards the first communication device (200a).

24. A computer program product (8ioa, 8iob) comprising a computer program (820a, 820b) according to at least one of claims 22 and 23, and a computer readable storage medium (830) on which the computer program is stored.

25. A first communication device (200a) for biometric authentication of a user, the first communication device (200a) comprising processing circuitry (285), the processing circuitry being configured to cause the first communication device (200a) to: receive a biometric input of the user; obtain a non-secret transformation parameter of a transformation, wherein the non-secret transformation parameter is associated with a second communication device (200b); perform the transformation on the biometric input using the non-secret transformation parameter; send the transformed biometric input towards the second communication device (200b) for biometric authentication of the user by the second communication device (200b); and receive a result of the biometric authentication of the user from the second communication device (200b).

26. The first communication device (200a) according to claim 26, further being configured to perform the method according to any of claims 2 to 10.

27. A second communication device (200b) for biometric authentication of a user, the second communication device (200b) comprising processing circuitry (285), the processing circuitry being configured to cause the second communication device (200b) to: receive a transformed biometric input of the user from a first communication device (200a), wherein the transformed biometric input is a result of a transformation having been performed on the biometric input using a non-secret transformation parameter, wherein the non-secret transformation parameter is associated with the second communication device (200b); obtain a transformed biometric template for the user;authenticate the user by comparing the transformed biometric input to the transformed biometric template upon the second communication device (200b) having performed a transformation using a secret transformation parameter of the transformation either on the transformed biometric input or on the transformed biometric template; and send a result of having biometrically authenticated the user towards the first communication device (200a).

28. The second communication device (200b) according to claim 27, further being configured to perform the method according to any of claims 12 to 21.

Images