Authentication method for a client over a network

1. An authentication method for authenticating a client with service over a network of peer devices, the method comprising:

storing encrypted enrolled authentication data for the client in a storage that is accessible by means of an access privilege;

storing a decryption clue for the encrypted enrolled authentication data in a client data block chain;

receiving, by the network of peer devices, authentication information from the client;

generating, by a server connected to the client, a decryption key according to a contract involving the decryption clue stored in the client data block chain;

receiving, by the network of peer devices, the encrypted enrolled authentication data from the storage;

decrypting, by the network of peer devices, the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data;

comparing, by the network of peer devices, the decrypted enrolled authentication data with the authentication information received from the client for obtaining a match score based on a consensus of the peer devices of the network; and

storing the match score and a hash of a client identifier in a service data block chain.

2. The authentication method of claim 1 , wherein the contract is a machine dependent decryption key generation method generating the decryption key from the decryption clue depending on a hardware configuration of the server.

3. The authentication method of claim 1 , further comprising:

receiving, from the client, authentication data collected by the client to be used as the enrolled authentication data;

generating the decryption clue for the enrolled authentication data;

generating, by the server, an encryption key involving the decryption clue in a machine dependent encryption key generation method; and

encrypting, using the encryption key, the enrolled authentication data for obtaining the encrypted enrolled authentication data.

4. The authentication method of claim 1 , further comprising storing a hash of the enrolled authentication data with the decryption clue in the client data block chain.

5. The authentication method of claim 1 , further comprising:

generating, by the server, a re-encryption key involving the decryption key as a new decryption clue in a contract for generating an encryption key;

re-encrypting the decrypted enrolled authentication data using the re-encryption key for obtaining re-encrypted enrolled authentication data;

storing the decryption key as the new decryption clue in the client data block chain;

storing the re-encrypted enrolled authentication data in the storage; and

removing the encrypted enrolled authentication data from the storage.

6. The authentication method of claim 1 , further comprising:

receiving, from the service, an order for a registration token for a client registration;

generating, by the network of peer devices the registration token and storing the registration token in the storage or the service data block chain;

providing, to the service, the registration token;

receiving, from the client, a signed registration token;

updating the registration token in the storage or the service data block chain with the hash of the client identifier; and

providing, to the service, the hash of the client identifier.

7. The authentication method of claim 1 , further comprising:

receiving, from the service, a challenge request for the client, wherein the challenge request is associated with the hash of the client identifier;

storing the challenge request in the service data block chain;

providing, to the client, the challenge request; and

updating the challenge request with the match score in the service data block chain;

wherein receiving the authentication information by the network of peer devices comprises receiving an identifier of the challenge request from the client.

8. An authentication method for authenticating a client with a service over a network of peer devices, the method comprising:

processing an enrollment request of the client for storing encrypted enrolled authentication data in a storage that is accessible by means of an access privilege;

ordering a storing of a decryption clue for the encrypted enrolled authentication data in a client data block chain;

processing a verification request of the client for authenticating authentication information to be authenticated by the network of peer devices;

generating a decryption key according to a contract corresponding to the verification request, the contract involving the decryption clue stored in the client data block chain;

sending the decryption key for decrypting the encrypted enrolled authentication data to the network of peer devices; and

ordering the addition of a match score of a comparison of the authentication information with the encrypted enrolled authentication data with a hash of a client identifier to a service data block chain based on a consensus of the peer devices of the network.

9. An authentication method for authenticating a client with a service over a network of peer devices, the method comprising:

receiving authentication information of the client;

receiving encrypted enrolled authentication data from a storage that is accessible by means of an access privilege;

receiving a decryption key generated according to a contract involving a decryption clue stored in a client data block chain;

decrypting the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data;

comparing the decrypted enrolled authentication data with the authentication information for obtaining a match score based on a consensus of the peer devices of the network of peer devices; and

processing the match score for storing the match score and a hash of a client identifier in a service data block chain.

10. A system for authenticating a client with a service over a network of peer devices, comprising:

a server; and

a storage that is accessible via an access privilege, wherein the storage stores encrypted enrolled authentication data for the client;

wherein the server:

orders the addition of a decryption clue to a client data block chain;

generates a decryption key according to a contract involving the decryption clue stored in the client data block chain ( 28 ); and

wherein the network of peer devices:

receives the encrypted enrolled authentication data from the storage;

decrypts the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data; and

compares the decrypted enrolled authentication data with authentication information received from the client for obtaining a match score based on a consensus of the peer devices of the network to be stored with a hash of a client identifier in a service data block chain.

11. The system of claim 10 , wherein:

the server is further adapted to generate a re-encryption key involving the decryption key as an encryption clue involved in a contract for generating an encryption key; and

wherein the system is further adapted to:

re-encrypt the decrypted enrolled authentication data using the re-encryption key for obtaining re-encrypted enrolled authentication data;

store the decryption key as the new decryption clue in the client data block chain;

store the re-encrypted enrolled authentication data in the storage; and

remove the encrypted enrolled authentication data from the storage.

12. A distributed network of peer devices for authenticating a client with a service, the peer devices each comprising a processor and a memory, wherein the network of peer devices is adapted for communicating with a server and is further adapted to:

receive authentication information of the client;

receive encrypted enrolled authentication data from a storage that is accessible by means of an access privilege;

receive a decryption key for the encrypted enrolled authentication data generated by the server according to a contract involving a decryption clue stored in a client data block chain;

decrypt the encrypted enrolled authentication data using the decryption key to obtain decrypted enrolled authentication data;

compare the decrypted enrolled authentication data with the authentication information received from the client for obtaining a match score based on a consensus of the peer devices of the network; and

transmit the match store for storing the match score with a hash of a client identifier in a service data block chain.

13. A hardware server device for authenticating a client with a service over a network of peer devices, wherein the hardware server device is adapted to:

process an enrollment request of the client for storing encrypted enrolled authentication data in a storage that is accessible by means of an access privilege;

generate a decryption key according to a contract involving a decryption clue for the encrypted enrolled authentication data;

order the addition of the decryption clue to a client data block chain;

process a verification request of the client for authenticating authentication information to be authenticated by the network of peer devices; and

order the addition of a match score of a comparison of the authentication information with the encrypted enrolled authentication data with a hash of a client identifier to a service data block chain based on a consensus of the peer devices of the network.

14. The hardware server device of claim 13 , wherein the contract is a machine dependent decryption key generation method generating the decryption key from the decryption clue depending on a hardware configuration of the hardware server device.