LABMFA-MCC: A Lightweight, Risk-Adaptive, Biometric-Bound Multi-Factor Authentication Protocol for Mobile Cloud Computing

Mobile cloud computing enables resource-constrained devices to offload storage and computation to remote servers. It involves authentication over an unsecure wireless link, while meeting stringent energy and bandwidth constraints, often with different service providers. Often, the protocols that achieve security requirements are too heavy for mobile devices or are limited to a single server. However, the adaptive risk-aware processes required by mobile platforms typically run on the top of the cryptographic layer rather than within it. This paper presents LABMFA-MCC, a lightweight authentication and key-agreement protocol that binds the credential to a biometric during each login, builds an end-to-end session key between the device and the server using an edge proxy that is intentionally excluded from the key derivation, and permits access to multiple servers through a single offline registration. Contextual risk is scored at the edge and used to raise the authentication posture, demanding a fresh biometric; we present this as a tunable mechanism rather than a calibrated policy. We validated the protocol in ProVerif under three adversary models, complemented by a computational session-key security argument in the Real-or-Random model, and developed a prototype, tested on a standard mobile phone and an x86 host, requiring about 0.88 ms of total processing (including the measured fuzzy-extractor reproduction) and 1744 bits of communication per login, measured with one enrolled user, the server’s constant-time anonymous user search adds about 3.4 µs per enrolled user.