A multi-party security protocol that incorporates biometric-based
authentication and withstands attacks against any single party (e.g.,
mobile phone, cloud, or the user). The protocol involves the function split between mobile and cloud and the mechanisms to chain-hold the secrets. A
key generation mechanisms binds secrets to a specific device or URL (
uniform resource locator) by adding salt to a master credential. An inline
CAPTCHA (Completely Automated Public
Turing test to tell Computers and Humans Apart) handling mechanism uses the same sensor modality as the
authentication process, which not only improves the
usability, but also facilitates the
authentication process. This architecture further enhances existing overall
system security (e.g., handling untrusted or compromised cloud service, phone being lost, impersonation, etc.) and also improves the
usability by automatically handling the
CAPTCHA.