Secure multi-user biometric template authentication

1 . A system, comprising:

one or more processors;

a memory; and

one or more programs stored in the memory, the one or more programs comprising instructions which, when executed by the one or more processors, are configured to:

receive a request to generate a biometric template associated with a first end user, wherein the request to generate the biometric template associated with the first end user is generated via a first mobile computing device associated with a multi-user biometric template authentication (MBTA) system;

in response to receiving the request:

collect biometric data associated with the first end user;

generate, based on the biometric data, the biometric template associated with the first end user;

generate a personal identification number (PIN), wherein the PIN is associated with the biometric template associated with the first end user;

store at least one of the biometric template or the PIN associated with the first end user in an active biometric template database or an active PIN database respectively, wherein the active biometric template database and the active PIN database are associated with the MBTA system; and

transmit MBTA data for storage on a plurality of mobile computing devices that are different than the first mobile computing device, wherein the MBTA data comprises at least one of data related to the active biometric template database or data related to the active PIN database.

2 . The system of claim 1 , wherein the one or more programs further comprise instructions configured to:

authenticate, based in part on a first interaction with a second mobile computing device of the plurality of mobile computing devices, the first end user,

wherein the first interaction with the second mobile computing device comprises collecting the biometric data associated with the first end user via the second mobile computing device and utilizing a biometric data matching algorithm to match the biometric data to the biometric template associated with the first end user, and

wherein the biometric template is comprised in the active biometric template database that has been stored on the second mobile computing device.

3 . The system of claim 2 , wherein the instructions configured to authenticate the first end user via the second mobile computing device further comprise instructions configured to:

authenticate, based in part on a second interaction with the second mobile computing device, the first end user,

wherein the second interaction with the second mobile computing device comprises receiving the PIN associated with the biometric template associated with the first end user via the second mobile computing device and verifying the PIN based in part on data associated with the active PIN database that has been stored on the second mobile computing device.

4 . The system of claim 1 , wherein the one or more programs further comprise instructions configured to:

cause at least one of encryption or decryption of one or more biometric templates based in part on a symmetric shared secret.

5 . The system of claim 4 , wherein the symmetric shared secret is generated by a secrets management system associated with the MBTA system, and wherein the secrets management system is configured to distribute the symmetric shared secret to each respective mobile computing device of the plurality of mobile computing devices.

6 . The system of claim 5 , wherein the symmetric shared secret is imported into a biometric trusted application comprised within a trusted execution environment (TEE) of each respective mobile computing device of the plurality of mobile computing devices, and

wherein the symmetric shared secret is associated with a hash-based message authentication code associated with each respective mobile computing device of the plurality of mobile computing devices.

7 . The system of claim 1 , wherein the instructions to transmit the MBTA data for storage on the plurality of mobile computing devices are further configured to:

notify, via a message queuing telemetry transport (MQTT) broker associated with the MBTA system, the plurality of mobile computing devices that at least one of the active biometric template database or the active PIN database have been updated; and

cause the plurality of mobile computing devices to obtain current data related to the at least one of the active biometric template database or the active PIN database.

8 . The system of claim 7 , wherein the instructions are further configured to:

remove at least one of one or more biometric templates or one or more PINs from the active biometric template database or the active PIN database respectively, wherein removing the at least one of the one or more biometric templates or the one or more PINs comprises:

notifying, via the MQTT broker associated with the MBTA system, the plurality of mobile computing devices that the at least one of the one or more biometric templates or the one or more PINs have been removed; and

causing the plurality of mobile computing devices to obtain the current data related to the at least one of the active biometric template database or the active PIN database.

9 . The system of claim 1 , wherein the one or more programs further comprise instructions configured to:

remotely enable or disable an MBTA authentication mode on at least one of the first mobile computing device or the plurality of mobile computing devices.

10 . The system of claim 1 , wherein the MBTA data further comprises one or more extensible markup language (XML) configuration documents, and

wherein the first mobile computing device and the plurality of mobile computing devices are configured in part by executing one or more commands associated with the one or more XML configuration documents.

11 . The system of claim 10 , wherein the one or more XML configuration documents are transmitted to the first mobile computing device and the plurality of mobile computing devices by a mobile device management tool associated with the MBTA system.

12 . The system of claim 10 , wherein the first mobile computing device and the plurality of mobile computing devices are configured to scan, via an optical engine, one or more barcodes associated with the one or more respective XML configuration documents,

wherein scanning the one or more barcodes causes the first mobile computing device and the plurality of mobile computing devices to execute the one or more commands associated with the one or more respective XML configuration documents.

13 . The system of claim 1 , wherein the one or more programs further comprise instructions configured to:

authenticate, based in part on a first interaction with a third mobile computing device of the plurality of mobile computing devices, a second end user,

wherein the first interaction with the third mobile computing device comprises collecting biometric data associated with the second end user via the third mobile computing device and utilizing a biometric data matching algorithm to match the biometric data associated with the second end user to a biometric template associated with the second end user,

wherein the biometric template associated with the second end user was generated in response to receiving, by the MBTA system, a request to generate the biometric template associated with the second end user from a fourth mobile computing device, and

wherein the biometric template associated with the second end user is comprised in the active biometric template database that has been stored on the third mobile computing device.

14 . The system of claim 13 , wherein the instructions configured to authenticate the second end user via the third mobile computing device further comprise instructions configured to:

authenticate, based in part on a second interaction with the third mobile computing device, the second end user,

wherein the second interaction with the third mobile computing device comprises receiving a PIN associated with the biometric template associated with the second end user via the third mobile computing device and verifying the PIN based in part on data associated with the active PIN database that has been stored on the third mobile computing device.

15 . A computer-implemented method, the computer-implemented method comprising:

receiving a request to generate a biometric template associated with a first end user, wherein the request to generate the biometric template associated with the first end user is generated via a first mobile computing device associated with a multi-user biometric template authentication (MBTA) system;

in response to receiving the request:

collecting biometric data associated with the first end user;

generating, based on the biometric data, the biometric template associated with the first end user;

generating a personal identification number (PIN), wherein the PIN is associated with the biometric template associated with the first end user;

storing at least one of the biometric template or the PIN associated with the first end user in an active biometric template database or an active PIN database respectively, wherein the active biometric template database and the active PIN database are associated with the MBTA system; and

transmitting MBTA data for storage on a plurality of mobile computing devices that are different than the first mobile computing device, wherein the MBTA data comprises at least one of data related to the active biometric template database or data related to the active PIN database.

16 . The computer-implemented method of claim 15 , further comprising:

authenticating, based in part on a first interaction with a second mobile computing device of the plurality of mobile computing devices, the first end user,

wherein the first interaction with the second mobile computing device comprises collecting the biometric data associated with the first end user via the second mobile computing device and utilizing a biometric data matching algorithm to match the biometric data to the biometric template associated with the first end user, and

wherein the biometric template is comprised in the active biometric template database that has been stored on the second mobile computing device.

17 . The computer-implemented method of claim 16 , wherein authenticating the first end user via the second mobile computing device further comprises:

authenticating, based in part on a second interaction with the second mobile computing device, the first end user,

wherein the second interaction with the second mobile computing device comprises receiving the PIN associated with the biometric template associated with the first end user via the second mobile computing device and verifying the PIN based in part on data associated with the active PIN database that has been stored on the second mobile computing device.

18 . The computer-implemented method of claim 15 , further comprising:

causing at least one of encryption or decryption of one or more biometric templates based in part on a symmetric shared secret.

19 . The computer-implemented method of claim 18 , wherein the symmetric shared secret is generated by a secrets management system associated with the MBTA system, and wherein the secrets management system is configured to distribute the symmetric shared secret to each respective mobile computing device of the plurality of mobile computing devices.

20 . A computer program product comprising at least one non-transitory computer-readable storage medium having program instructions embodied thereon, wherein the program instructions are executable by a processor to cause the processor to:

receive a request to generate a biometric template associated with a first end user, wherein the request to generate the biometric template associated with the first end user is generated via a first mobile computing device associated with a multi-user biometric template authentication (MBTA) system;

in response to receiving the request:

collect biometric data associated with the first end user;

generate, based on the biometric data, the biometric template associated with the first end user;

generate a personal identification number (PIN), wherein the PIN is associated with the biometric template associated with the first end user;

store at least one of the biometric template or the PIN associated with the first end user in an active biometric template database or an active PIN database respectively, wherein the active biometric template database and the active PIN database are associated with the MBTA system; and

transmit MBTA data for storage on a plurality of mobile computing devices that are different than the first mobile computing device, wherein the MBTA data comprises at least one of data related to the active biometric template database or data related to the active PIN database.