# A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure
## 1 Introduction
### Research Background  
The identification process confirms the identity legitimacy of the concerned user from the designated user name. Authentication is a definite and essential requirement of the security model to control access. The authentication process determines authorization and access permission for resources with a Boolean result method [6]. The user is prompted to input an attribute \(x\). The system computes \(F(x)\) before comparing it with a stored corresponding value of \(y\) for the respective user following Equation (1). \[F(x)=y \tag{1}\]  
where \(x=\) Input credential, \(y=\) Verifiable parameter, and \(F=\) System function of Authentication. The two processes, namely, identification and authorization [7; 8; 9; 10; 11] work hand in hand to confirm user identity. Next in the sequence is the process of authorization, which is responsible for handling restrictions and limitations or access rights for resources. The auditing process keeps track of user access for entering the system and when and what resources the identified and authenticated user has attempted to access in the form of the access log file. Considering the authentication process in more detail, it is the process responsible for validating and confirming the user's identity. A claim for ownership over a user identity may not always be true regarding Boolean results [12]. Hence, to confirm user legitimacy and further grant access permissions to the resources, evidence for confirmation of legitimacy needs to be provided and proven. The associated evidence for proof of corresponding user name (User ID) in the authentication process is termed a 'credential'. From the historical point of view, the first known example of unauthorized access is the accidental disclosure of secret phrases used by thieves for secured gate opening and closing of hidden storage for stolen valuables, committed by [PERSON]. Similarly, in the technical community, the password was used for the first time at MIT to control access to time-shared computers among the students and faculty. Since then, many technological advancements have taken place in this direction, using user credentials for authentication. After many developments, user authentication to a system is done using either of the four commonly known ways. They are something the 'user knows' (proof-of-knowledge), 'user has' (proof-of-ownership), 'user is' (proof-of-characteristic), or 'where the user is' (proof-of-location). Any of the mentioned things are called an authentication factor [13] as depicted in Figure 1.  
The 'user knows' a password or code that can be used as evidence for user authenticity, which is most likely to be forgotten by the user and requires safe storage for referral if not remembered. The 'user has' a hardware key or software key, which can be produced as evidence for proof. However, the same physical entity may be lost or stolen and, hence, requires a safe and secured storage and referral mechanism. Similarly, 'user is' refers to the user having a unique biometric in terms of fingerprint or retina image that can be used as evidence. Located in a logical or geographical boundary, the user may provide proof of 'where the user is' as evidence of user legitimacy. However, the accuracy of  
Figure 1: Fundamental Authentication Factors. the corresponding location factor is directly dependent on the accuracy of the location detection mechanism as well as the accuracy of the Global Positioning System (GPS). The requirement for mobility and computing has led to the cloudification of lightweight and resource-constrained devices in the ecosystem. [PERSON] et al. [14] have described the four different authentication categories and generalized the authentication model using them. However, for user convenience, a password is the most common, well-established, and widely used method for authentication [15].