Patent ID: 8443201

Claim:
A biometric authentication system comprising: an enrollment terminal that enrolls enrollment data (T); an authentication terminal that captures verification biometric data (X′); and an authentication server that authenticates a user, the authentication server being provided separately from the authentication terminal, wherein the enrollment terminal includes: a generation unit that generates a conversion parameter (K); an enrollment biometric data conversion unit that converts enrollment biometric data (X) of a user captured during enrollment based on the conversion parameter (K) to create the enrollment data (T=F(X,K)), a verification information creation unit that creates a public key (PK) of a secret key, the secret key corresponding to the conversion parameter (K), and a transmission unit that transmits the enrollment data (T) and the public key (PK) to the authentication server, without disclosing the conversion parameter (K) to the authentication server, wherein the authentication terminal includes: a conversion unit that converts the verification biometric data (X′) of the user based on the conversion parameter (K) to create converted biometric data (V=G(X′,K)); a transmission unit that transmits the converted biometric data (V) to the authentication server, without disclosing the conversion parameter (K) to the authentication server; and a conversion parameter proof unit that creates a signature using the secret key to prove knowledge about the conversion parameter (K), wherein the authentication server includes: a receiving unit that receives the enrollment data (T) from the enrollment terminal and the converted biometric data (V) from the authentication terminal; a conversion parameter verification unit that verifies that the authentication terminal knows the conversion parameter based on the signature received from the authentication terminal; and a matching unit that compares the converted biometric data (V) with enrollment data (T) to check similarities between the enrollment biometric data (X) and the verification biometric data (X′), and wherein when the conversion parameter verification unit of the authentication server verifies that the authentication terminal knows the conversion parameter (K), the authentication server creates random data (m) and transmits the random data (m) to the authentication terminal, the conversion parameter proof unit of the authentication terminal creates the signature for the random data (m) by using the secret key and returns the signature to the authentication server, and the conversion parameter verification unit of the authentication server verifies the signature for the random data (m) by using the public key (PK), and when the conversion parameter verification unit succeeds to verify the signature for the random data (m), the authentication server checks the similarities between the enrollment biometric data (X) and the verification biometric data (X′) by the matching unit.