A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure

Abstract

The unauthorized usage of various services and resources in cloud computing is something that must be protected against. Authentication and access control are the most significant concerns in cloud computing. Several researchers in this field suggest numerous approaches to enhance cloud authentication towards robustness. User names and associated passwords have been a common practice for long as Single Factor Authentication. However, advancements in the speed of computing and the usage of simple methods, starting from the Brute Force technique to the implementation of advanced and efficient crytographic algorithms, have posed several threats and vulnerabilities for authentication systems, leading to the degradation of their effectiveness. Multi-factor authentication has emerged as a robust means of securing the cloud using simultaneous and multiple means of authentication factors. This employs multiple levels of cascaded authentication checks. This paper covers an extensive and systematic survey of various factors towards their adoption and suitability for authentication for multi-factor authentication mechanisms. The inference drawn from the survey is in terms of arriving at a unique authentication factor that does not require any additional, specialized hardware or software for multi-factor authentication. Such authentication also uses the distinct biometric characteristics of the concerned user in the process. This arrangement augments the secured and robust user authentication process. The mechanism is also assessed as an effective means against impersonation attacks.

1. Introduction

The US Census Bureau reports that the number of employees who worked mostly from home increased three folds between 2019 and 2021, from around 9 million to about 27 million. The COVID-19 pandemic is regarded as the main reason for such an increase [1]. The reaction to the pandemic has spurred hybrid work and the cloud-based digitization of corporate operations, both of which present new security issues [2]. It is a fact that various components tightly integrate into the currently used advanced Information Technology (IT)-enabled ecosystem. In a system like this, the constituent components’ functionalities are interdependent. Hence, their associated risk, threat, and vulnerability are also interdependent. The need for and the problems relating to the requirements of virtually unlimited IT resources are increasing daily. Cloud computing addresses such a need for vast and high-speed information processing. According to Boonkrong [3], users are vulnerable to various security issues, including access control, while accessing the system in an integrated and cloudified environment. A generic approach cannot address the associated risks, threats, and vulnerabilities in a heterogeneous environment like the cloud. Instead, specialized approaches can ensure safe and secure utilization of the cloud’s IT infrastructure and cyber systems. A typical access control mechanism is required to access and use such a system. Safe and secure accessing of a system of this nature needs a control mechanism consisting of four definite steps: identification, authentication, authorization, and auditing [4,5].

1.1. Research Background

The identification process confirms the identity legitimacy of the concerned user from the designated user name. Authentication is a definite and essential requirement of the security model to control access. The authentication process determines authorization and access permission for resources with a Boolean result method [6]. The user is prompted to input an attribute x. The system computes F(x) before comparing it with a stored corresponding value of y for the respective user following Equation (1).

$$F\left(x\right)=y$$

(1)

where x = Input credential, y = Verifiable parameter, and F = System function of Authentication.

The two processes, namely, identification and authorization [7,8,9,10,11] work hand in hand to confirm user identity. Next in the sequence is the process of authorization, which is responsible for handling restrictions and limitations or access rights for resources. The auditing process keeps track of user access for entering the system and when and what resources the identified and authenticated user has attempted to access in the form of the access log file. Considering the authentication process in more detail, it is the process responsible for validating and confirming the user’s identity. A claim for ownership over a user identity may not always be true regarding Boolean results [12]. Hence, to confirm user legitimacy and further grant access permissions to the resources, evidence for confirmation of legitimacy needs to be provided and proven. The associated evidence for proof of corresponding user name (User ID) in the authentication process is termed a ’credential’.

From the historical point of view, the first known example of unauthorized access is the accidental disclosure of secret phrases used by thieves for secured gate opening and closing of hidden storage for stolen valuables, committed by Ali Baba. Similarly, in the technical community, the password was used for the first time at MIT to control access to time-shared computers among the students and faculty. Since then, many technological advancements have taken place in this direction, using user credentials for authentication. After many developments, user authentication to a system is done using either of the four commonly known ways. They are something the ‘user knows’ (proof-of-knowledge), ‘user has’ (proof-of-ownership), ‘user is’ (proof-of-characteristic), or ‘where the user is’ (proof-of-location). Any of the mentioned things are called an authentication factor [13] as depicted in Figure 1.

The ‘user knows’ a password or code that can be used as evidence for user authenticity, which is most likely to be forgotten by the user and requires safe storage for referral if not remembered. The ‘user has’ a hardware key or software key, which can be produced as evidence for proof. However, the same physical entity may be lost or stolen and, hence, requires a safe and secured storage and referral mechanism. Similarly, ‘user is’ refers to the user having a unique biometric in terms of fingerprint or retina image that can be used as evidence. Located in a logical or geographical boundary, the user may provide proof of ‘where the user is’ as evidence of user legitimacy. However, the accuracy of the corresponding location factor is directly dependent on the accuracy of the location detection mechanism as well as the accuracy of the Global Positioning System (GPS). The requirement for mobility and computing has led to the cloudification of lightweight and resource-constrained devices in the ecosystem. Wang et al. [14] have described the four different authentication categories and generalized the authentication model using them. However, for user convenience, a password is the most common, well-established, and widely used method for authentication [15].

With the historical and technological genesis of the usage of passwords for authentication, the domain of IT over the years has seen many advancements in terms of speed of processing, size of storage, and high throughput networks. The advent of high-speed computing and the usage of algorithms like Brute Force have weakened authentication processes using the conventional means of a username and password. In turn, this has resulted in many data breaches, compromising volumes of critical information globally. Frequent re-occurrences of such incidents put a question mark on the system of usage of the user ID and password. It also highlights the weaknesses associated with providing a robust protection mechanism against unauthorized authentication leading to undesired access to restricted and protected data. The Identity Theft Resources Centre (ITRC), in its annual report for the year 2020 [16], has listed out the root causes of identity theft and its implications, showing that 38% of data breach occurrences are due to improper cloud security configuration. It also revealed that 36% of data breaches could have occurred due to pissing attacks and related disclosure of user credentials. Upon analysis of the National Vulnerability Database (NVD) (updated up to Dec 2022) with the Common Vulnerability Scoring System (CVSS) in accordance to the Cloud Security Alliance, The Treacherous 12 [17] as well as Security Guidance for Critical Areas of Focus in Cloud Computing v4.0 [18], it was observed that insufficient Identity and Access Management (IAM), as well as IAM, contribute cloud vulnerability by 23.6% and 45.3%, respectively, as depicted in Figure 2.

1.2. Research Motivation

The user authentication process has the sole aim of establishing user identity by means of verification of credentials of genuine users of the system. Single Factor Authentication (SFA) was popular due to its simplicity and user-friendliness [15,19]. Mujeye [20] observed that combining two or more strong authentication measures could increase the difficulty level for guessing and breaking the SFA type of authentication. Accordingly, to increase the degree of difficulty for the attacker, researchers developed the idea of using more than one factor in a cascading manner or using one factor within another factor of authentication. Such developments gave rise to the authentication method commonly known as Multi-Factor Authentication (MFA) [21,22]. Though the overhead associated with processing more than one credential or factor check was initially relatively high, the advancement of technology and processing speed has been leveraged with newer-generation IT devices. However, based upon the type and categories of factors adopted for MFA, in almost all cases, the system requires special purpose or additional hardware equipment and software drivers associated with their fundamental functioning. Though additional checks for authentication are frustrating for the users, the same overhead is worth the value for secure user authentication and further to the entitled IT resources. Saleem et al. [23] have conducted a detailed survey on user convenience vis-à-vis difficulty with the introduction of MFA. Otta et al. [24,25] have carried out extensive analysis on Authentication Management and Authorization Management with respect to Security As A Service, covering human users of the cloud network [26].

1.3. Outline and Contribution of Work

Biological characteristics provide uniqueness to the user. This could be used as a potential means to tackle a known threat to any authentication system called an impersonation attack, where a false user tries to act as a true user. Many surveys have been conducted covering factors of authentication. However, to the best of our knowledge and available literature, for the first time, this research work makes an effort to bring out the fact that, with no additional requirements other than the factory fitted System Accessories, biometric uniqueness of users can be used as a factor of authentication.

The broad guiding factors considered for the progress of this work are listed below, which are derived from the technological shortfalls associated with the adoption of authentication factors towards MFA and which signify the notable contributions of this research:

• It best utilizes only the Original Equipment Manufacturer (OEM)-fitted hardware and software without requiring additional or specialized Hardware and Software.
• Systematic analysis is conducted of various factors used for authentication in the light of multiple threats and vulnerabilities concerning user authentication for cloud environment.
• Systematic analysis is also conducted of available methods and means to be used to identify and make the best use of the least complex solution or combination of solutions towards implementing an efficient MFA for a Multi-Cloud scenario.

The organization of the rest of the paper is as follows: After introducing this topic in Section 1, Section 2 describes the aspects of the authentication process along with Cloud Authentication mechanisms. Section 3 dwells upon the various factors of authentication. Section 4 presents an extensive analysis of security aspects associated with authentication in light of facial recognition. Section 5 concludes the paper along with a brief insight into the future scope of this research work.

2. Authentication Process

Authentication is required to verify a user’s identity and prevent unauthorized individuals from accessing the system [27,28]. It differs from identification, which is the first step in confirming a user’s identity by requesting credentials. The second stage in the authentication process is authorization, which establishes the user’s credentials with the system. The NIST 800-63-B [29] provides recommendations on the types of authentication processes as well as the authenticator types. This process has been deliberated upon in detail by Otta et al. [25] for the cloud environment.

2.1. Traditional Authentication

It is an established fact that user verification is possible through four authentication types used for this purpose. However, Cloud Service Providers (CSPs) can combine these types to provide a more secure authentication method [30]. CSPs choose the different types based on their number of users, economic cost factors for the authentication process, a specific type or combination of their security requirements, and the cost of managing the authentication system storage of authentication credentials, to name a few [31]. The various types, along with their specific means of implementation desired for this work, are described as follows.

2.1.1. Proof-of-Knowledge

The knowledge, in this case, is best known as cognitive information because only a genuine user has access to the actual desired information for proof. This type of authentication has a prominent issue because it can be shared with others who can comfortably impersonate genuine users [32,33]. Another disadvantage is that it is simple to render it ineffective by employing various advanced guessing tools and technical methods such as Brute Force. This type of authentication also necessitates extensive character memorization and, as a result, is easily forgotten.

2.1.2. Proof-of-Ownership

This type of authentication is also known as authentication by ownership or authentication in possession. In this, the user has to be in possession of the device or object to strengthen the authentication process. In general, the owners of these objects must spend significant effort to ensure their safe custody. The replacement of lost, stolen, or damaged objects is expensive in this case and is thus regarded as a considerable weakness [34]. When used as standards, these objects have inherent flaws that expose them to other vulnerabilities like duplication, forgery, and manipulation [35].

2.1.3. Proof-of-Characteristic

This uses humanistic characteristics about a person to describe the user’s uniqueness. It is commonly referred to as biometric authentication. Such authentication is linked to a person, so forging or stealing an identity is more difficult. Furthermore, this type of authentication cannot be lost or stolen [36]. High-security systems and sites widely use this type of authentication because it is difficult to compromise. Such authentication does not necessitate human intervention because the process automatically determines the user’s identity [37]. Automated measurements compare the captured entity with the stored entity in real time. When compared to other types of authentications, this one is more robust.

2.1.4. Proof-of-Location

Such type of authentication records when and where the user logged in. This authentication process uses the user’s location to determine their identity. This type of authentication commonly uses a GPS [38], IP address, cell tower ID, and so on. The majority of Location-Based Authentication (LBA) implementations essentially require the use of a location signature (LS), which is generated with the assistance of a location signature sensor (LSS) [39]. The location signature describes the person’s physical location and the timestamp of the access request.

2.2. Cloud Authentication Mechanism

Four processes comprising the access control [40] mechanism are best described by identification, authentication, authorization, and accounting, as proposed by Ahmad et al. [41]. Identification refers to uniquely defining and describing each user of the cloud system with an associated set of credentials. An individual must provide a credential for establishing their identity in an authentication process. Different systems may necessitate various forms of credentials. An individual is frequently required to produce a credential as a password in today’s computer and communication networks. Some systems may even demand the individual to have more than one credential to be provided as proof of the user’s genuineness [42]. The entire cloud authentication mechanism for users can be broadly categorized into three phases as described by Rangwani et al. [43], namely, (i) Registration, (ii) Log-in, and (iii) Verification. The authentication process can involve two parties, the Supplicant and the Authenticator. However, depending on the presence of a Responder that represents a trusted third party (TTP) [44], the authentication system could have three essential components [45]. After authentication, authorization is the next phase. Authorization is a process that deals with access restrictions and limitations on resources. Authorization explicitly specifies what each user may and may not do or access. In other words, authorization grants or restricts users’ access to available resources. Accounting is the fourth component of access control [46]. Accounting keeps track of who enters the system, what they do, and at what time.

2.3. Threats towards Cloud Authentication

The system verifies the user’s credentials and confirms the user’s identity to authenticate the user. The system designers use several established methods to authenticate users of the system. Further access control measures for accessing system resources are enforced based on successful authentication [47]. The gravity of the situation has increased exponentially as nearly every system has been networked and connected to the internet. Passwords have traditionally been the most commonly used means of establishing identity and authorizing additional resources to the identified user. While the well-known and conventional methods give some convenience to users, they are also determined to be significantly susceptible variables that pose a significant threat to the system, user credentials, and system resources [48]. The following are some of the most well-known susceptibilities, triggering causes, and processes considering cloud authentication, as depicted in Figure 3:

• Account hijacking: The process of an attacker stealing or hijacking a cloud account is known as cloud account hijacking. In identity theft schemes, cloud account hijacking is a typical strategy in which the attacker utilizes stolen account information to carry out illegal or unauthorized behavior. In reality, the attacker usually impersonates the account owner using stolen credentials to hijack a cloud account [49]. Attackers might use stolen credentials to access sensitive sections of cloud computing systems, jeopardizing their security, integrity, and availability.
• Credential Stuffing: In several cases, hackers have posted hacked and compromised credentials on the dark web. For credential stuffing, the attacker searches the dark web for a password that has already been hacked. Then, an attempt is made to penetrate the system using the already-compromised password as a credential. Similar efforts are made with other accounts of the same user who have passwords that have been hacked to access the system. When a person has numerous accounts in the system, it is usual practice to share a single password for convenience. Users’ habits of not choosing separate passwords for multiple accounts and reusing a common password are exploited in this form of attack [50]. Organizations like the Open Web Application Security Project (OWASP) have proposed many techniques to combat credential-stuffing attacks. The most generally recommended methods include using separate passwords for various user accounts and using the CAPTCHA system for authentication.
• Default Passwords: A pre-installed and factory-configured password is known as a default password. The system administrator and users do not update the default password of the system being used for convenience and occasionally due to ignorance. The failure to consider this essential factor is seen as a matter of concern for rendering the system vulnerable to cyber-attacks [51]. As a remedy, the system urges the system user to change the default password at initial use and with similar redirections for routine password changes with a pre-defined level of difficulty. Password policies such as a minimum length, a mix of upper- and lowercase alphabets, digits, and special characters are imposed on the user.
• Eavesdropping: The attacker uses this approach to secretly listen to and sniff private conversations between two people without their consent or knowledge. It is thought to be more straightforward if the attacker controls the system’s networking equipment and network traffic [52]. Suppose that non-secured HTTP and FTP-like service traffic is sniffed using the default networking port, and data traffic are studied. In that case, an attacker can quickly uncover the password and credentials from the analyzed network’s plain-text data traffic using tools or software like Wireshark. However, employing encrypted services in conjunction with standard encryption techniques may alleviate this.
• Impersonation Attack: In such an attack, an unauthorized user or wrong user makes an attempt to act as a genuine user by fraudulently acquiring the credentials of the actual user [53]. Such attacks could lead to serious data breaches in highly secured working environments like bank and defense sectors where highly sensitive, crucial information and applications are handled. This can be controlled by using biological uniqueness associated with the user.
• Man-in-the-Middle Attacks: A man-in-the-middle attack can steal user credentials if the attacker can get inside the sender and the receiver. The attacker may now transmit and receive all data exchanges between the two computers. As a result, the attacker can pose as a sender to the recipient and vice versa [54]. The attacker has the power to modify and delete sections of the communications in transit in addition to sending and receiving messages. As a result, the attacker can collect sensitive information, such as the username and password, and use it for malicious purposes.
• Password Guessing: Password guessing is a technique in which an adversary attempts to guess the username and password of a legitimate user and then authenticate it as being such. The attacker merely guesses probable passwords that the user will likely use in a password-guessing attack. A brute-force attack is generally an exhaustive search that an adversary can use to guess a password. It is an attack in which the attacker attempts to generate all potential password combinations and then authenticates to the system using the username and various password combinations [55]. The time it takes to carry out this assault is determined by the password’s length. A dictionary attack is when an attacker tries each word in a dictionary as a password to breach a password-protected authentication system. A password dictionary attack is still classified as both a brute-force attack and a dictionary attack. Similarly, a password-spraying assault is a sort of attack that depends on a small number of frequently utilized passwords.
• Replay Attacks: Another prominent method of attacking authentication methods is a replay attack. The replay attack involves a hacker copying a password or credential from one organization and utilizing it to authenticate with another. The goal is to mimic the user whose credentials or passwords have been copied. The attacker replicates the message or credentials and transmits them to an authenticator, hoping they will be validated successfully [56].
• Social Engineering Attack: Using personal and interpersonal skills is common in social engineering approaches, although it is not always essential to apply information technology. When a user is subjected to a social engineering attack, the adversary tries to persuade them so that they are obliged to disclose certain information or even do a specific action [57]. In today’s world, social engineering may take three primary forms: in-person social engineering, phone social engineering, and digital social engineering.

Based on the facts mentioned above and their potential threat to the cloud in the matter of Confidentiality, Integrity, and Availability, several corrective measures are suggested as possible remedial measures. A summary of such corrective and restorative actions is described in

Table 1. Threats to Cloud Authentication and their Remedial Measures.

Potential Threat	Suggested Remedial Measures	Ref.
Account Hijacking	Use of MFA Use of One Time Password (OTP) Use of End-to-End Encryption	[21,49]
Credential Stuffing	Use of different passwords for different accounts Use of MFA	[23,50]
Default Passwords	Use of random and unique default passwords Prompting and forcing users for changing default passwords	[23,51]
Eavesdropping	Adopting strong and robust encryption mechanism	[25,52]
Impersonation Attack	Use of biometric means to uniquely identify the user Use of MFA	[53]
Man-in-the-Middle Attacks	Use of Virtual Private Network (VPN) Adopting strong and robust encryption mechanism	[25,54]
Password Guessing	Using long and strong passwords that are not obvious No reuse of same and already used password	[45,55]
Replay Attacks	Use of a strong and robust Challenge-Response means	[25,56]
Social Engineering Attack	Educating users on how to avoid being a victim of in-person, over-the-phone, and digital attacks such as phishing or e-mail attacks.	[25,57]

.

3. Factors of Authentication

When a user makes a genuine claim, they must furnish the desired information to demonstrate that they are who they claims to be. That desired information is an authentication factor. We dwell upon various factors as depicted in Figure 4 and analyze their strengths, weaknesses, and suitability for being used for a secured and robust authentication mechanism.

3.1. Knowledge Factors

This refers to the verification of users’ genuineness with the help of knowledge possessed by the user claiming to be genuine one. Passwords are the most commonly used means to verify a user using the knowledge factor. However, apart from forgetfulness by the human user, its safe storage and custody have always been a concern. A password is a combination of alphanumeric characters arranged in a designated sequence to act as a factor of authentication. Sometimes a specified set of some fixed number of numerical digits can be used as a Personal Identification Number (PIN) as a knowledge factor for authentication. It also uses means to accept and verify pre-stored answers submitted by users trying to authenticate into the system using the knowledge factor of the concerned user [58]. However, the related security aspect of storing the password or pre-stored answers is a concern for its storage in an unencrypted form. Moreover, the accessibility of such unencrypted storage space to users who could be unauthorized to have access to this part of storage is a notable vulnerability.

3.2. Ownership Factors

In this case, the user needs to own a device or specified object to prove genuineness in accessing the system resources. The most commonly used means in this category are photographic identity cards issued by a competent card issuing authority. An upgraded version of such a card may be a magnetic strip or chip-enabled smart card, which needs to be owned by the user to prove and establish identity to access the system. In addition, a hardware security key in the form of a dongle is one of the alternative objects that need to be owned by the user for system authentication [59]. However, the physical security of usage of such owned devices as an authentication factor is a concern since they are vulnerable to being lost or stolen and could potentially be mis-utilized by an unauthorized or malicious user.

3.3. Characteristic Factors

This factor primarily focuses on the user’s unique physical and other biometric characteristics. Fingerprints, palm prints, hand geometry, face, iris, and retina are all common biometric means used as an authentication factor. Such biometric authentication procedures are divided into two parts. The first step is to register or enroll the biometric. The second step involves verification. A specialized sensing device captures biometric data during the registration process. Then the data is processed to extract and translate into a template database, from which an authentication procedure may be performed later. The authentication process starts with acquiring and processing the user’s biometric data to extract and convert the person’s biometric information. Biometric authentication compares a user’s actual characteristics to stored data to see whether they are who they claim to be while accessing the system. Though it provides the mechanism for uniquely identifying users, it may require special hardware and corresponding software for its essential functioning [60]. The fact that human traits can change over time poses a problem for biometric authentication. These changes may result from aging, sickness, or an accident.

3.4. Location Factors

This authentication method uses the user’s location to determine their identity. This sort of authentication often involves using a Global Positioning System (GPS), an IP address, and the location data of the service provider’s point of presence (PoP). This authentication may also track where and when the user tries to log in. The majority of Location-Based Authentication (LBA) implementations require a location signature (LS), which is created using a location signature sensor (LSS) like a GPS. The person’s actual location and the time that person seeks access are described in the location signature. After the LS has been produced, it is sent to the mechanism that verifies the user’s identity. This form of authentication continues indefinitely. The LSS combines signature data with transmitted data, which the host confirms. The data from the LSS would be lost if the connection was at all hijacked [61].

3.5. Other Related Factors

With enhancements in IT-enabled speed and processing, some other means are also being adopted as a factor of authentication, especially means like the way a user speaks (voice), the way a user walks (gait), and even the way a user types (keystrokes). Hung et al. [62] have made a systematic analysis and comparison of various behavioral as well as physiological biometric factors.

4. Analysis of Authentication Factors

Several authentication techniques are in use for access control. Their strengths, weaknesses, offered opportunities, and associated threats have been deliberated upon in the SWOT analysis by Patel et al. [63]. However, a detailed analysis of authentication and corresponding factors is essential for the present work.

4.1. Comparison of Factors for Authentication

Depending on a particular type of factor or a set of factors used simultaneously, user verification can evolve as a simple but robust mechanism for user authentication. One or more factors listed in Table 2 can be used to authenticate users.

As a suggested method to mitigate the inherent weakness of password-based authentication, measures like biometric-based with multi-factor-based authentication are advised [64]. Based on the comparative analysis in Table 3 regarding various types of attack scenarios, it can be concluded that retina analysis and thermal image recognition are the least vulnerable to attacks; hence, they are the most secure approaches. However, they require specialized hardware and corresponding specialized software for their operation. On the other hand, despite being vulnerable to Spoofing attacks and Impersonation attacks, face recognition can use the standard web camera to deal with the attack scenario with a suitable solution involving a liveness aspect in place. This aspect is considered for progressing in our approach for the desired authentication mechanism.

Single-factor Authentication (SFA) depends on only one factor. Because of its convenience and user-friendliness, SFA is widely accepted by users. Among the various methods, the most common one employed is a username and password/PIN-based authentication. It is based on the knowledge factor (what-you-know). These password/PIN-based authentications have been considered weak as they are vulnerable to various attacks. Furthermore, malicious users can apply dictionary attacks [65], rainbow tables [66], or social engineering tactics to acquire access. When using this authentication method, a minimum password complexity need is usually considered. Users tend to have the same passwords over multiple websites, and a password leak from one can lead to security threats over all the user accounts on different service providers. Some notable drawbacks of this approach are as follows:

• To access various services, users must remember the authentication factor. If one common password is used for several accounts, these programs may be affected if the password is compromised.
• When many passwords are used, the burden of its remembrance, upkeep, and safe-keeping for proof is on the users. Hence, password fatigue is evident when certain users only use one password for authentication.
• If this factor is penetrated or compromised, the user will be unable to utilize the service until the problem is fixed. It causes a considerable delay in obtaining the desired service or information needed when it is required.
• If a single element is compromised even without the user’s knowledge, the result might be disastrous.

Table 2. Advantages and Limitations of Authentication Approaches.

Approach	Advantages	Limitations	Ref.
Face Recognition	Convenient, quick, and efficient	Large storage requirement, can create data vulnerability, compromised biometric is irrecoverable	[23,67,68]
Fingerprint Scanner	Ease of use, cost-effective	Scanners may fail, easy to replicate fingerprint, compromised biometric is irrecoverable	[61,69,70,71]
Geographical Location	Effective in case the user needs to be present at a particular location	GPS may not be accurate at some locations	[61,72]
Ocular-based Methods	Very efficient and difficult to spoof	Need high-quality camera and robust mathematical techniques, compromised biometric is irrecoverable and cannot be changed	[23,73,74]
OTPs	Extra layer of security, hard to crack, expires after defined time	User availability required, lack of power backup, network issue, vulnerable to man-in-the-middle attacks	[20,75,76]
SmartPhone Applications	Code regenerated in defined time gap, hence safe from attacks	User availability required, lack of power backup, network issue, invalid codes for clock de-synchronization between device and service	[21,77,78]
SmartCards	More secure using encryption technology	Card may get lost, the chip may be damaged, radio interface for two-way communication	[78,79,80]
Thermal Image Recognition	Efficient, can be used from a large distance	Different thermal image in case of fever	[23,81,82]
Vein Recognition	Efficient, accurate	Expensive, but still vulnerable to spoofing attacks at the current stage, compromised biometric is irrecoverable	[61,71,83]
Voice Recognition	Convenient, quick and efficient	False negative in the loud background, change in voice due to sickness; compromised biometric is irrecoverable	[61,84,85]

Table 2. Advantages and Limitations of Authentication Approaches.

Approach	Advantages	Limitations	Ref.
Face Recognition	Convenient, quick, and efficient	Large storage requirement, can create data vulnerability, compromised biometric is irrecoverable	[23,67,68]
Fingerprint Scanner	Ease of use, cost-effective	Scanners may fail, easy to replicate fingerprint, compromised biometric is irrecoverable	[61,69,70,71]
Geographical Location	Effective in case the user needs to be present at a particular location	GPS may not be accurate at some locations	[61,72]
Ocular-based Methods	Very efficient and difficult to spoof	Need high-quality camera and robust mathematical techniques, compromised biometric is irrecoverable and cannot be changed	[23,73,74]
OTPs	Extra layer of security, hard to crack, expires after defined time	User availability required, lack of power backup, network issue, vulnerable to man-in-the-middle attacks	[20,75,76]
SmartPhone Applications	Code regenerated in defined time gap, hence safe from attacks	User availability required, lack of power backup, network issue, invalid codes for clock de-synchronization between device and service	[21,77,78]
SmartCards	More secure using encryption technology	Card may get lost, the chip may be damaged, radio interface for two-way communication	[78,79,80]
Thermal Image Recognition	Efficient, can be used from a large distance	Different thermal image in case of fever	[23,81,82]
Vein Recognition	Efficient, accurate	Expensive, but still vulnerable to spoofing attacks at the current stage, compromised biometric is irrecoverable	[61,71,83]
Voice Recognition	Convenient, quick and efficient	False negative in the loud background, change in voice due to sickness; compromised biometric is irrecoverable	[61,84,85]

Table 3. Different authentication approaches and their vulnerability to various attacks.

Authentication Approach	Brute-Force Attack	Guess Attack	Phishing Attack	Spoofing Attack	Impersonation Attack	Ref.
Face Recognition	No	No	No	Yes	No	[23,67,68]
Fingerprint Scanner	No	No	No	Yes	No	[61,69,70,71]
Geographical Location	No	No	No	No	No	[61,72]
Ocular-based Methods	No	No	No	No (retina) & Yes (iris)	No	[23,73,74]
OTPs	No	No	Yes	No	Yes	[20,75,76]
Password/PIN	Yes	Yes	Yes	No	Yes	[14,70,71]
SmartPhone Applications	No	No	Yes	No	Yes	[21,77,78]
SmartCards	No	No	No	Yes	Yes	[78,79,80]
Thermal Image Recognition	No	No	No	No	No	[23,81,82]
Vein Recognition	No	No	No	Yes	No	[61,71,83]
Voice Recognition	No	No	No	Yes	No	[61,84,85]

Table 3. Different authentication approaches and their vulnerability to various attacks.

Authentication Approach	Brute-Force Attack	Guess Attack	Phishing Attack	Spoofing Attack	Impersonation Attack	Ref.
Face Recognition	No	No	No	Yes	No	[23,67,68]
Fingerprint Scanner	No	No	No	Yes	No	[61,69,70,71]
Geographical Location	No	No	No	No	No	[61,72]
Ocular-based Methods	No	No	No	No (retina) & Yes (iris)	No	[23,73,74]
OTPs	No	No	Yes	No	Yes	[20,75,76]
Password/PIN	Yes	Yes	Yes	No	Yes	[14,70,71]
SmartPhone Applications	No	No	Yes	No	Yes	[21,77,78]
SmartCards	No	No	No	Yes	Yes	[78,79,80]
Thermal Image Recognition	No	No	No	No	No	[23,81,82]
Vein Recognition	No	No	No	Yes	No	[61,71,83]
Voice Recognition	No	No	No	Yes	No	[61,84,85]

4.2. Weakness of Single-Factor Authentication

In a recently conducted study by CyberNews, the investigation team [86] in 2021 analyzed the 15 billion passwords exposed in various database breaches. The study found that only around 2 billion of those passwords were unique. The ten most commonly used passwords are 123456, 123456789, qwerty, password, 12345, qwerty123, 1q2w3e, 12345678, 111111, and 1234567890. It signifies that even after knowing the threats associated with password security, people still prefer to use these easy-to-crack or easy-to-guess passwords. Even if people use difficult-to-guess or secure passwords, there are still chances of the passwords being compromised through phishing and spoofing attacks.

Due to the dependency on telecommunication and data networks, associated factors like OTP, CAPTCHA, PIN, and modern methods like RFID have definite vulnerabilities while functioning as an SFA. User characteristic factors like biometrics are potentially more stable due to their uniqueness associated with the corresponding user.

4.3. Emergence of Multi-Factor Authentication

Although any number of factors discussed above may be used as an authentication factor, only a few unique and practical factors are generally used for authentication in the scheme of MFA (using several factors simultaneously). Some are, undoubtedly, more powerful and complicated than others. All of them, however, are more secure and protected than password-only authentication.

MFA’s purpose is to verify genuine users to safeguard sensitive information by offering a layered defense and making it more difficult for unauthorized persons to acquire access. The advantage of using MFA is that it provides a more secure approach to authenticating users. Any factor that has been compromised or exposed to a data breach is no longer usable; nevertheless, the system can continue to provide authentication services using the non-compromised authentication factors. To obtain access to a target system, attackers must overcome several obstacles [87].

The concept of MFA started with the physical verification of the user’s identity card and verifying the user’s photo with the corresponding authenticated photo present on the officially issued identity card. For example, when a person enters a bank, they are asked to show a photo ID. The person is then identified and authenticated based on their biometric parameters. That is, the bank matches the face of the person with the face on the ID card. It is a form of facial recognition and can be analogous to today’s biometric authentication method. To generalize, this combined effect of more than one authentication factor and their unified and simultaneous utilization for user verification is represented in Equation (2).

$$F\left(x\right)=f1\left(x1\right)\cup f2\left(x2\right)\left\{\begin{array}{cc}1,\hfill & \mathrm{i}\mathrm{f} f1\left(x1\right)\cup g1\left(y1\right),\mathrm{T}\mathrm{R}\mathrm{U}\mathrm{E}\hfill \\ 0,\hfill & \mathrm{o}\mathrm{t}\mathrm{h}\mathrm{e}\mathrm{r}\mathrm{w}\mathrm{i}\mathrm{s}\mathrm{e}.\hfill \end{array}\right.$$

(2)

F(x) is the Multi-factor System Authentication Function over user x with a resultant Boolean Value. f$1($x$1)$ is the First Authentication Factor Function with input value x1; g$1($y$1)$ is the Second Authentication Factor Function with the input value y1; and so on, for its applicability to third and subsequent factors for authentication.

4.4. Related Research Conducted on MFA

Several researchers have explored the aspects associated with various factors for authentication. Multiple factors have also been employed simultaneously for MFA. Their efficacy and salient aspects are considered for the present research scope without requiring additional hardware or software other than the OEM-supplied and installed system components.

Dasgupta et al. [88] proposed an Adaptive-MFA approach. The system chooses the best authentication modalities among many based on the current scenario, like surrounding lighting or noise conditions. The modalities with which the authentication occurs are not fixed. Thus, the dynamic nature reduces the risk of various attacks on the system. It also ensures that the same factors are not used for authentication for two consecutive times, thus reducing the risk of attacks. The limitations of the above system include that it is very complex and requires ample storage space. Storing all factors is not suitable for versatile applications. This system uses lots of external hardware and degrades the user experience during the sign-up phase. Hence, this approach is also not ideal for the presently defined scope of research.

Aboaba et al. [89] proposed an approach based on smartcards and fingerprint biometrics taken together for MFA. The extracted feature from the fingerprint is applied to a fingerprint template and stored in an encrypted format in the smart card. The limitations are that fingerprints can be spoofed and cards can be stolen. This approach uses an external device not under the present scope and terms of reference.

Sciarretta et al. [90] proposed an approach based on the generation of OTPs. It deals with three entities—user, service provider, and identity provider. During the user registration phase, it builds a trusting relationship between the identity provider app and the service provider app. Then, after the activation, every time the user wants to log in, an OTP is created inside the application and sent to the identity provider along with user details. The identity provider verifies the details and checks the validity of the OTP. If everything is in order, it allows the user to sign in. This method is relatively secure as the transmission between the applications is cryptographically secure and it times the OTPs. The limitation is that it needs a phone to be available with the user each time. It requires an additional device to be there with the user, and this does not fit into our system as we intend to achieve this without using any external device.

Hammad et al. [91] proposed a solution using CNN based on a decision-level fusion of fingerprint and ECG. It uses internal fusion to fuse the crucial features of each biometric to improve accuracy. This authentication process is slow and requires high power consumption. The ECG machine is quite costly. Similarly, this method is unsuitable for our present scope since external devices are not solicited. This process is slow, and it hinders the user experience as well.

Zimmermann et al. [92] conducted a study on subjective user perceptions and objective features of the various authentication schemes. The password-based authentication is the most preferred scheme according to the users. It is easy to use and effortless because it is familiar to the users. However, it has a high cognitive load for the users, such as remembering the password. After the password, the fingerprint scheme (followed by face and iris recognition) is preferred in terms of preference, effort, security, and intention to use. The smartphone-based methods were least selected because of the high effort, more login time, and error-prone quality. It shows that user preference correlates with usability and not security and privacy.

AL Saleem et al. [23] proposed an MFA approach using a recall-based system. The user must select three images from different categories during the sign-up process. Then, every time the user logs in, they must choose those three images from a list of many images. As a third factor, the approach uses a PC ID so the user cannot log in from a different PC. The PC needs to be allowed by the admin beforehand. The advantage of this approach is that it adds a layer of security, is easy to use, and has low-cost requirements. This recall-based approach is somewhat similar to the knowledge-based approach and has the same disadvantages. The user needs to remember what image was selected during sign-up, which increases the cognitive load on the user and degrades the user experience. There is a trade-off between ease of use and achieving security. Hence, this approach does not fit into our system, wherein we want to accomplish both ease of use and security.

Sharma et al. [93] proposed a fingerprint-recognition-based approach. The fingerprint template stored in the database is in the form of a 3D spiral curve. Even if the database is compromised, it can not extract helpful information from the stored template. Once the template is compromised, it creates a new template for the same fingerprint by changing the key-set values. The only limitation is when the fingerprints are stolen from another source and the spoofed ones are used with this system. This system uses an external device and hinders the user experience, which does not suit our defined requirements.

Abdelkader et al. [94] utilized a chatbot capable of generating authentication challenges for the system. It is also in a situation to evaluate user responses, along with the necessary functionalities for the smooth operation of the framework system.

An extensive analysis of most of the prominent measures researched for MFA from 2016 to 2022 has been carried out.

Table 4. Comparison of various MFA Approaches and Inherent Vulnerability.

Ref. (Year)	Advantages	Limitations	Inherent Vulnerability
[88] (2016)	(i) Dynamic and environment dependent to choose most suited modalities. (ii) Reduces predictability for the attacker. (iii) Positive experience regarding usability.	(i) Quite complex. (ii) Requires large storage. (iii) Registration is lengthy as multiple input of biometrics of the user is required for password creation.	Depends on a particular set of approaches selected at a time
[89] (2017)	The data is stored in the smartcard in an encrypted way.	(i) Card may be lost or stolen. (ii) Spoofed fingerprints from other sources may be used.	Spoofing attack
[90] (2018)	(i) Secured approach. (ii) Transmissions are encoded cryptographically. (iii) OTPs are timed.	(i) Requires downloading of different app. (ii) Unavailability of smartphone.	Phishing attack
[91] (2019)	The combination of the fingerprint with ECG is more secure as it provides the liveness factor.	Slow and requires high power consumption; costly.	NA
[92] (2020)	(i) Use of textual and figurative credentials. (ii) Use of human factors.	(i) More cognitive on the human brain. (ii) Special hardware for human-specific biometric verification	Guessing attack
[23] (2021)	(i) Cheap and secure in comparison to textual passwords. Anti-key-logger and anti-screen recorder	(i) Increases cognitive load of the user. (ii) A small approach, not suitable on a large scale. (iii) More time-consuming.	Phishing attack
[93] (2021)	Templates are such that attackers cannot access the original fingerprint details from them	Fingerprints may be stolen from other sources and spoofed	Spoofing attack
[94] (2022)	(i) Uses Autonomous Inquiry-based Authentication Chatbot (AIAC). (ii) Human Dynamics Insight And Metrics segment of the authentication framework is used.	(i) Chatbot needs sufficient training on user credential data. (ii) It incorporates a huge credential dataset depending on the number of registered users of the system.	(i) Impersonation attack. (ii) Central point of failure of the authentication process.

presents a detailed analysis of the advantages and limitations of these mentioned methods. The cost factor associated with the implementation of MFA depends on the type of additional hardware and software required for MFA implementation. This is in addition to the cost of the system implementation or even the infrastructure being hired from a CSP [95]. This research considers our current requirement of not including any additional hardware or software for the functioning of MFA. Moreover, from these analytical results, it can be inferred that the Impersonation Attack scenario for authentication, in particular, Cloud Authentication, requires due deliberation and further research.

4.5. Face Recognition towards Potential MFA

The detailed comparative analysis mentioned above concludes that factors of authentication other than facial recognition entail the requirement of specialized and additional hardware as well as software. They may even require specialized user training for flawless utilization of the authentication factors. At the same time, using such specialized means as an authentication factor is liable to affecting the uninterrupted user experience in a logged-in user session. Considering the user’s face to be utilized as a biometric authentication factor, it essentially requires three mutually related processes for facial recognition. The processes are:

• Capturing of the image.
• Detection of the face in the captured image.
• Comparison of detected facial features with the registered user’s stored credentials.

For capturing a simple image, a system-connected webcam is recommended to be used without asking for additional hardware components. However, the detection of the user’s face in the captured image as well as recognition of the registered user’s facial features need due deliberation to meet the need for robust authentication.

Capturing the face image of the user and the comparison of biometric features and the stored user’s credentials is a relatively simpler process. In a cloud environment, the CSP serves multiple tenants, and each tenant could have multiple and huge numbers of users, leading to related complexity for user authentication. Similarly, in a multi-cloud infrastructure, inter-operability among multiple CSPs further complicates the user authentication and associated access control issues [96]. From the above-presented analysis and present survey, the potential of using face recognition towards MFA for cloud infrastructure is considered. A simple but effective face recognition mechanism with OEM-fitted web cameras of the system can be a potential means for MFA and also for tackling impersonation attacks.

4.6. Threats to MFA

At the same time, there are multiple threats envisaged in the implementation and adoption of Multi-Factor Authentication (MFA). The most prominent threats, which have a direct effect on the scope of the present research for threat modeling of MFA, are listed in

Table 5. Prominent Threats to MFA Implementation.

Threat	Envisaged Effect
Biometric Spoofing	Biometric authentication mechanisms may be vulnerable to spoofing attacks, where attackers create fake biometric data to fool the authentication system.
Credential stuffing	Attackers may use stolen MFA credentials to gain access to other accounts belonging to the same user.
Denial of Service (DoS) attacks	Attackers may launch DoS attacks against the authentication system, preventing legitimate users from accessing their accounts.
Insider Threats	Employees or contractors with access to sensitive systems may abuse their privileges to bypass MFA or steal MFA credentials.
Malware	Malicious software such as keyloggers or screen capture tools may be used to steal MFA credentials from infected devices.
Man-in-the-middle attacks	Attackers may intercept communication between users and the authentication system, allowing them to steal MFA credentials.
Social Engineering	Attackers may attempt to trick users into divulging their MFA credentials through phishing attacks or other forms of social engineering.

.

5. Conclusions and Future Work

MFA is an effective means of increasing the difficulty for intruders to gain unauthorized access to the system. MFA ensures secured access to resources for interactions between users and cloud infrastructure by facilitating efficient, user-friendly, and trustworthy authentication whenever accessing a service. This paper presented a systematic approach to determine a factor, particularly biometric face recognition, without disturbing a logged-in user from ongoing work and without requiring additional hardware and software for the system.

Performance consistency and efficiency should be further experimentally established for various associated phases of MFA system functioning. This research effort aims to prevent impersonation attacks on the system since the uniqueness of the user’s biometric facial characteristics is being considered as a factor of authentication [97] as a part of the MFA process. This is to avoid dependency on TTP and make use of a DLT-based storage.Having credentials with advanced cryptographic means, an MFA solution based on the Physically Unclonable Function (PUF) [98] would have an edge over the classical solutions. However, needing further exploration is the trade-off between performance and security of user authentication using state-of-the-art facial recognition based on Non-Convoluted Neural Network (Non-CNN) and Convoluted Neural Network (CNN) algorithms [99] against impersonation attacks. Such effort is expected to handle the potential spoofing attacks by means of a liveness check of the user and provide a means of secured user authentication for the cloud environment and multi-cloud infrastructure.

MFA is vulnerable to social engineering attacks and many researchers are continuously exploring the options for its detection and prevention. Similarly, a simple DoS attack, by blocking the second authentication channel, could also affect the system effectiveness. The usage of cryptography techniques coupled with suitable measures, such as Network Traffic Monitoring, Implementing Traffic Load Balance Functionality, Using of Content Delivery Networks Functionality, and especially Implementing Data-Rate Limiting Approach to and from suspected IP addresses, is a suggested way to tackle possible DoS attacks on MFA systems.