Multi-Factor Authentication: A Survey

Abstract

Today, digitalization decisively penetrates all the sides of the modern society. One of the key enablers to maintain this process secure is authentication. It covers many different areas of a hyper-connected world, including online payments, communications, access right management, etc. This work sheds light on the evolution of authentication systems towards Multi-Factor Authentication (MFA) starting from Single-Factor Authentication (SFA) and through Two-Factor Authentication (2FA). Particularly, MFA is expected to be utilized for human-to-everything interactions by enabling fast, user-friendly, and reliable authentication when accessing a service. This paper surveys the already available and emerging sensors (factor providers) that allow for authenticating a user with the system directly or by involving the cloud. The corresponding challenges from the user as well as the service provider perspective are also reviewed. The MFA system based on reversed Lagrange polynomial within Shamir's Secret Sharing (SSS) scheme is further proposed to enable more flexible authentication. This solution covers the cases of authenticating the user even if some of the factors are mismatched or absent. Our framework allows for qualifying the missing factors by authenticating the user without disclosing sensitive biometric data to the verification entity. Finally, a vision of the future trends in MFA is discussed.

Challenges of Multi-Factor Authentication for Securing Advanced IoT Applications

“…The quantitative gains highly depend on the input parameters and reach 10 4 vs. 10 8 when 7 factors are combined. This example also highlights the importance of a threshold value selection, since incorrect combining may often result in rapid system performance degradation [10]. The same holds true for any other values of FAR/FRR, even though they may actually vary for different factors.…”

Efficient and Flexible Multi-Factor Authentication Protocol Based on Fuzzy Extractor of Administrator’s Fingerprint and Smart Mobile Device

“…Currently, MFA is considered a vital part in many fields in the information technology world and is involved in processes such as validating the identity of the administrator of the system, IoT devices, and smart mobile devices (see Figure 2). In recent years, Two-Factor Authentication (2FA) [12][13][14] was presented for use of a second factor-such as an SMS token, token device, smart card, and biometric with the user's account information-for resisting malicious attacks and solving the memorizing issue in password complexity [15][16][17].…”

“…Currently, MFA is considered a vital part in many fields in the information technology world and is involved in processes such as validating the identity of the administrator of the system, IoT devices, and smart mobile devices (see Figure 2). The major advantage for using MFA schemes is to increase security level-"assume an adversary can get user's password by applying malicious attacks but he faces difficulties to retrieve information of another factor" [17]. Furthermore, some MFA schemes use a token device that does not need coverage for a mobile network or the Internet.…”

“…MFA does have several drawbacks, such as forgotten/stolen mobile phone, smart card or token device, allowing illegal access to the authorized user's accounts and extra cost for detection resources for the hardware's maintenance centers. For that reason, our work aims to propose a strong and lightweight protocol for user authentication, based on a fuzzy extractor of fingerprints and smart In recent years, Two-Factor Authentication (2FA) [12][13][14] was presented for use of a second factor-such as an SMS token, token device, smart card, and biometric with the user's account information-for resisting malicious attacks and solving the memorizing issue in password complexity [15][16][17].…”

“…MFA does have several drawbacks, such as forgotten/stolen mobile phone, smart card or token device, allowing illegal access to the authorized user's accounts and extra cost for detection resources for the hardware's maintenance centers. For that reason, our work aims to propose a strong and lightweight protocol for user authentication, based on a fuzzy extractor of fingerprints and smart The major advantage for using MFA schemes is to increase security level-"assume an adversary can get user's password by applying malicious attacks but he faces difficulties to retrieve information of another factor" [17]. Furthermore, some MFA schemes use a token device that does not need coverage for a mobile network or the Internet.…”