# A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure
## 2 Authentication Process
### Threats towards Cloud Authentication
Impersonation Attack: In such an attack, an unauthorized user or wrong user makes an attempt to act as a genuine user by fraudulently acquiring the credentials of the actual user [53]. Such attacks could lead to serious data breaches in highly secured working environments like bank and defense sectors where highly sensitive, crucial information and applications are handled. This can be controlled by using biological uniqueness associated with the user. 6. Man-in-the-Middle Attacks: A man-in-the-middle attack can steal user credentials if the attacker can get inside the sender and the receiver. The attacker may now transmit and receive all data exchanges between the two computers. As a result, the attacker can pose as a sender to the recipient and vice versa [54]. The attacker has the power to modify and delete sections of the communications in transit in addition to sending and receiving messages. As a result, the attacker can collect sensitive information, such as the username and password, and use it for malicious purposes. 7. Password Guessing: Password guessing is a technique in which an adversary attempts to guess the username and password of a legitimate user and then authenticate it as being such. The attacker merely guesses probable passwords that the user will likely use in a password-guessing attack. A brute-force attack is generally an exhaustive search that an adversary can use to guess a password. It is an attack in which the attacker attempts to generate all potential password combinations and then authenticates to the system using the username and various password combinations [55]. The time it takes to carry out this assault is determined by the password's length. A dictionary attack is when an attacker tries each word in a dictionary as a password to breach a password-protected authentication system. A password dictionary attack is still classified as both a brute-force attack and a dictionary attack. Similarly, a password-spraying assault is a sort of attack that depends on a small number of frequently utilized passwords. 8. Replay Attacks: Another prominent method of attacking authentication methods is a replay attack. The replay attack involves a hacker copying a password or credential from one organization and utilizing it to authenticate with another. The goal is to mimic the user whose credentials or passwords have been copied. The attacker replicates the message or credentials and transmits them to an authenticator, hoping they will be validated successfully [56]. 9. Social Engineering Attack: Using personal and interpersonal skills is common in social engineering approaches, although it is not always essential to apply information technology. When a user is subjected to a social engineering attack, the adversary tries to persuade them so that they are obliged to disclose certain information or even do a specific action [57]. In today's world, social engineering may take three primary forms: in-person social engineering, phone social engineering, and digital social engineering. Based on the facts mentioned above and their potential threat to the cloud in the matter of Confidentiality, Integrity, and Availability, several corrective measures are suggested as possible remedial measures. A summary of such corrective and restorative actions is described in Table 1.