## 2 Literature Review  
Unauthorized access is one of the most common cloud application security threats. The MFA method, one of the most popular methods of authenticating cloud users, is used to minify the risk of unauthorized access to cloud applications, data, services, and resources. In MFA, the number of authentication factors varies according to the design of security frameworks and the level of security requirements. Indeed, MFA provides more secure access to organizations and less inconvenience to users. According to our survey of authentication methods in the literature, there are three levels of authentication factors: single-factor authentication (SFA), two-factor authentication (2 FA), and multi-factor authentication (MFA). SFA uses a single factor to authenticate a user, while 2 FA uses two factors [16; 17; 18], and MFA uses three or more factors. In general, the more factors that are used, the more secure the authentication scheme will be. MFA is becoming increasingly common as organizations look to improve the security of their systems [19; 20; 21; 22]. In zero-factor authentication, there is no requirement for the user to take any action, as it relies upon user signals and user passive biometric behavior. Device, network, and location signals are all examples of user signals. By multi-factor, we mean using two or more factors. According to existing research articles, MFA could be categorized as two-factor authentication (2 FA or TFA) [23; 24; 25], three-factor authentication (3 FA) [26], four-factor authentication (4 FA or FFA) [27; 28; 29; 30], and five-factor authentication (5 FA) [31]. The primary study areas for MFA are mutual authentication, biometric authentication, transaction authentication, multi-factor protocol authentication, multi-factor user behavior authentication, and graphical password authentication. Furthermore, new recent research trends in MFA are emerging on the horizon. These trends include blockchain-based multi-factor authentication [32; 33], password-less multi-factor authentication [34], and machine/deep learning-based multi-factor authentication [35; 36]. In this paper, we applied multi-factor remote user behavior authentication for cloud computing environments. In [37], a bibliometric survey was performed based on Web of Science data for research publications on the topic of MFA. Furthermore, we summarize the use of MFA through a different number of factors for cloud computing environments in Table 1. These cloud-based environments include general cloud computing architecture [38; 39; 40; 41], cloud storage [42; 43; 44; 45], multi-cloud [46], cloud-based logistics information systems [47], cloud-based OTP services [48], multiple-agent cloud-based search engines [49], cloud health care [50; 51], financial transactions [52], private cloud [53], and cloud-based web services [54]. Other non-cloud environments include cryptocurrency [55], websites and mobile apps [56], electronic payments [57; 58], electronic voting systems [59; 60; 61; 62], mobile voting systems [63], wireless networks [64], non-internet based applications [65], electronic document management systems [66], IoT networks [67; 68; 69], RFID infrastructure [70], wearable and virtual reality (VR) platforms with a gesture input interface [71], ATM systems [72], public multi-touch displays [73], blockchain [74], attendance record management systems (ARMSs) [75], question-based authentication systems [76], the Internet of Medical Things (IoMT) [77], human-computer interaction (HCI) [78], ATM transactions [79], and electronic healthcare systems [80]. As presented in [81], CMAF-IIoT is built on the ASCON authenticated encryption (AE) system, which combines encryption and decryption with authentication to provide secrecy, integrity, and authenticity. As a result, designing an authentication framework requires fewer cryptographic procedures. As presented in [82], ESCI-AKA was applied using a Scyther tool with the use of a random oracle model and informal security analysis.