A biometric authentication system in which a client, a first server, and a second server are coupled through a network, wherein the client includes: an input device for inputting an ID previously assigned to a user; a first sensor for obtaining biometric information of the user; a first feature quantity extraction unit for extracting, during an authentication session, a first feature quantity from biometric information of the user obtained by the first sensor; and a feature quantity conversion unit for converting the first feature quantity by a one-time parameter, that is valid only during the authentication session and is deleted when the authentication session has ended, to generate a converted feature quantity, wherein the first server includes: a parameter DB for storing a parameter in association with the ID; a parameter generation unit for generating a first additional parameter at random; and a data generation unit for generating and transmitting to the client the one-time parameter based on the parameter associated with the ID transmitted from the client through the network, and on the first additional parameter, and wherein the second server includes: a template DB storing, in association with the ID, a template to which a second feature quantity of biometric information of the user has been converted by the parameter prior to the authentication session; a template conversion unit for converting, using the first additional parameter transmitted from the first server, the template associated with the ID transmitted from the first server through the network, to generate a one-time template; and a match determination unit for comparing the converted feature quantity transmitted from the client through the network with the one-time template to determine whether they match or not, and for determining whether the comparison indicates a match between the second feature quantity, and the first feature quantity. an input device for inputting an ID previously assigned to a user; a first sensor for obtaining biometric information of the user; a first feature quantity extraction unit for extracting, during an authentication session, a first feature quantity from biometric information of the user obtained by the first sensor; and a feature quantity conversion unit for converting the first feature quantity by a one-time parameter, that is valid only during the authentication session and is deleted when the authentication session has ended, to generate a converted feature quantity, wherein the first server includes: a parameter DB for storing a parameter in association with the ID; a parameter generation unit for generating a first additional parameter at random; and a data generation unit for generating and transmitting to the client the one-time parameter based on the parameter associated with the ID transmitted from the client through the network, and on the first additional parameter, and a parameter DB for storing a parameter in association with the ID; a parameter generation unit for generating a first additional parameter at random; and a data generation unit for generating and transmitting to the client the one-time parameter based on the parameter associated with the ID transmitted from the client through the network, and on the first additional parameter, and wherein the second server includes: a template DB storing, in association with the ID, a template to which a second feature quantity of biometric information of the user has been converted by the parameter prior to the authentication session; a template conversion unit for converting, using the first additional parameter transmitted from the first server, the template associated with the ID transmitted from the first server through the network, to generate a one-time template; and a match determination unit for comparing the converted feature quantity transmitted from the client through the network with the one-time template to determine whether they match or not, and for determining whether the comparison indicates a match between the second feature quantity, and the first feature quantity. a template DB storing, in association with the ID, a template to which a second feature quantity of biometric information of the user has been converted by the parameter prior to the authentication session; a template conversion unit for converting, using the first additional parameter transmitted from the first server, the template associated with the ID transmitted from the first server through the network, to generate a one-time template; and a match determination unit for comparing the converted feature quantity transmitted from the client through the network with the one-time template to determine whether they match or not, and for determining whether the comparison indicates a match between the second feature quantity, and the first feature quantity.