# A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure
## 4 Analysis of Authentication Factors
### Related Research Conducted on MFA  
Several researchers have explored the aspects associated with various factors for authentication. Multiple factors have also been employed simultaneously for MFA. Their efficacy and salient aspects are considered for the present research scope without requiring additional hardware or software other than the OEM-supplied and installed system components. [PERSON] et al. [88] proposed an Adaptive-MFA approach. The system chooses the best authentication modalities among many based on the current scenario, like surrounding lighting or noise conditions. The modalities with which the authentication occurs are not fixed. Thus, the dynamic nature reduces the risk of various attacks on the system. It alsoensures that the same factors are not used for authentication for two consecutive times, thus reducing the risk of attacks. The limitations of the above system include that it is very complex and requires ample storage space. Storing all factors is not suitable for versatile applications. This system uses lots of external hardware and degrades the user experience during the sign-up phase. Hence, this approach is also not ideal for the presently defined scope of research. [PERSON] et al. [89] proposed an approach based on smartcards and fingerprint biometrics taken together for MFA. The extracted feature from the fingerprint is applied to a fingerprint template and stored in an encrypted format in the smart card. The limitations are that fingerprints can be spoofed and cards can be stolen. This approach uses an external device not under the present scope and terms of reference. [PERSON] et al. [90] proposed an approach based on the generation of OTPs. It deals with three entities--user, service provider, and identity provider. During the user registration phase, it builds a trusting relationship between the identity provider app and the service provider app. Then, after the activation, every time the user wants to log in, an OTP is created inside the application and sent to the identity provider along with user details. The identity provider verifies the details and checks the validity of the OTP. If everything is in order, it allows the user to sign in. This method is relatively secure as the transmission between the applications is cryptographically secure and it times the OTPs. The limitation is that it needs a phone to be available with the user each time. It requires an additional device to be there with the user, and this does not fit into our system as we intend to achieve this without using any external device. [PERSON] et al. [91] proposed a solution using CNN based on a decision-level fusion of fingerprint and ECG. It uses internal fusion to fuse the crucial features of each biometric to improve accuracy. This authentication process is slow and requires high power consumption. The ECG machine is quite costly. Similarly, this method is unsuitable for our present scope since external devices are not solicited. This process is slow, and it hinders the user experience as well. [PERSON] et al. [92] conducted a study on subjective user perceptions and objective features of the various authentication schemes. The password-based authentication is the most preferred scheme according to the users. It is easy to use and effortless because it is familiar to the users. However, it has a high cognitive load for the users, such as remembering the password. After the password, the fingerprint scheme (followed by face and iris recognition) is preferred in terms of preference, effort, security, and intention to use. The smartphone-based methods were least selected because of the high effort, more login time, and error-prone quality. It shows that user preference correlates with usability and not security and privacy. [PERSON] et al. [23] proposed an MFA approach using a recall-based system. The user must select three images from different categories during the sign-up process. Then, every time the user logs in, they must choose those three images from a list of many images.