Une fois l’authentification du serveur par la carte réalisée, le procédé comprend un enregistrement des données biométriques sur la carte, tel qu’illustré à la . Technical definitions CDCVM: Consumer Device Cardholder Verification Method BioManager : Biometric application installed on a Javacard integrated circuit card (banking card) and in charge of the enrollment procedure on the card. Issuer: (or card issuer) the bank Secure Channel Protocol (SCP): a protocol specified by Globalplatform and used to set up a secure link between a host device and a card to personalize issuer data into the card. SCP03 is an SCP based on AES cryptography. An SCP03 setup consists in exchanging 2 commands between the host device and the card: 1 st command is the INITIALIZE_UPDATE command With this command the host device indicates the key set to use and sends a host challenge The card selects the key set and generate session keys from it. The card then answers key information data to the host device (used to derive the card key from a master key) and also provides a card cryptogram to be verified by the host device once it has generated its session keys. 2 nd command is the EXTERNAL_AUTHENTICATE command The Host device after retrieving the card keys, generates the session keys, verifies the card cryptogram, generates a host cryptogram and a Message Authentication Code (MAC) and sends them back to the card The card verifies the MAC and host cryptogram and if both are successfully verified, then the host device and the card are mutually authenticated. Security Domain: a privileged application on a card (specified by Globalplatform), that holds cryptographic keys which can be used to support Secure Channel Protocol operations and/or to authorize card content management functions. On a card there is at least one Security Domain, the Issuer Security Domain (ISD) and there may be other Supplementary Security Domains (SSD). Security Level: level of protection established on a secure channel. KVN: Key Version Number, to identify a cryptographic key set of a Security Domain Detailed description of the invention An embodiment of the invention is a new solution to associate an enrollment at home with a cardholder authentication in a smooth user experience by making the most of an already existing security feature on the card (Globalplatform Secure Channel SCP03) and the bank application on an NFC smartphone (could be a tablet). The use case may be the following Material: NFC mobile device (smartphone or tablet) with a bank mobile application supporting biometric card enrollment and a biometric bank card The bank mobile application may already be installed on the NFC smartphone (could be also a tablet) and the user already has credentials to log in into the application (optional) Thanks to an NFC Tag application present on the card, when approaching the card to the NFC mobile device, the bank mobile application is launched on the NFC mobile device The cardholder authenticates him/herself by entering his/her credentials into the bank mobile application: the user is authenticated with the bank (secure link between the bank servers and the mobile application) The bank mobile application selects the biometric application (BioManager) on the card and initiates a secure channel session (SCP03) with this application. Since the keys used to setup this secure channel are not known by the mobile application but rather only by the bank server and the card, the mobile application acts as a proxy between the bank server and the card: the mobile application initiates the secure channel by sending the GP INITIALIZE_UPDATE command (this command could be prepared remotely by the bank server or locally by the mobile application) to the card and retrieves card information to retrieve the card SCP keys. The secure channel shall be established with a security level to AUTHENTICATED to avoid MAC or encryption of the enrollment APDUs. After receiving the response from the biometric card application, the bank mobile application forwards the response data to the bank server. Thanks to the received information data, the bank server retrieves the keys of the cards, generates the session keys, verifies the card cryptogram and prepares the EXTERNAL_AUTHENTICATE command (with a host cryptogram and MAC). It forwards this command to the bank mobile application (on the NFC mobile device) which then sends it to the card. If the card successfully processes the EXTERNAL_AUTHENTICATE, the bank (bank server) and the card are mutually authenticated. From that point on, all parties, issuer, cardholder, and card are mutually authenticated before starting the enrollment procedure. Now the user is prompted to start the enrollment of his/her fingerprints. At the end of the enrollment, the enrolled templates can be considered active since all parties are mutually authenticated. There is no need for supplementary authentication. And for the user experience, the whole authentication procedure is hidden: the user just needs to log in into the bank mobile application (that he/she might already uses for some bank operations) and carry on with the enrollment. No other dedicated passcode is required. Smooth user experience. An embodiment of the invention comprises advantageously using the SCP feature available on the card as a mutual authentication method to authenticate the cardholder during the biometric enrollment session and by consequence make the resulting biometric templates immediately activated without any need for a further authentication/activation. Advantages of the invention Enrollment + template activation done at once @home Bank mobile application is a secure application to manage the enrollment in a secure way Secure authentication between the card and the mobile application based on well-known standard Globalplatform secure channel protocol (SCP03 AES) Smooth user experience: from user point of view, only need to log in into the bank mobile application (as she/he may already do for other online bank operations), and process with fingerprint enrollment at home, then ready to use the biometric feature of her/his new card without any other prior authentication request. All the mutual authentication (bank + cardholder + card) is hidden from the cardholder.