# Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols:
A Systematic Security Analysis

Ang Kok Wee  Singapore University of Technology and DesignSingaporeSingapore
<EMAIL_ADDRESS>,  Eyasu Getahun Chekole  Singapore University of
Technology and DesignSingaporeSingapore<EMAIL_ADDRESS>and
Jianying Zhou  Singapore University of Technology and DesignSingaporeSingapore
<EMAIL_ADDRESS>
(2024)

###### Abstract.

Nowadays, cyberattacks are growing exponentially, causing havoc to Internet
users. In particular, authentication attacks constitute the major attack
vector where intruders impersonate legitimate users to maliciously access
systems or resources. Traditional single-factor authentication (SFA) protocols
are often bypassed by side-channel and other attack techniques, hence they are
no longer sufficient to effectively address the current authentication
requirements. To alleviate this problem, multi-factor authentication (MFA)
protocols have been widely adopted recently, which helps to raise the security
bar against imposters. Although MFA is generally considered more robust and
secure than SFA, it may not always guarantee enhanced security and efficiency.
This is because, critical security vulnerabilities and performance problems
may still arise due to design or implementation flaws of the protocols. Such
vulnerabilities are often left unnoticed by the designers or users until they
are exploited by attackers. Therefore, the main objective of this work is
identifying such vulnerabilities in existing MFA protocols by systematically
analysing their designs and constructions. To this end, we first form a set of
security evaluation criteria, encompassing both existing and newly introduced
ones, which we believe are very critical for the security of MFA protocols.
Then, we thoroughly review several MFA protocols across different domains.
Subsequently, we revisit and thoroughly analyze the design and construction of
the protocols to identify potential vulnerabilities. Consequently, we manage
to identify critical vulnerabilities in ten of the MFA protocols investigated.
We thoroughly discuss the identified vulnerabilities in each protocol and
devise relevant mitigation strategies for each of the vulnerabilities
identified. We also consolidate the performance information of the protocols.
We believe that the consolidated security analysis and performance information
would serve as a single reference point for researchers and practitioners to
be aware of the potential security and performance issues when designing MFA
protocols. This investigation also reinforces the fundamental need for an
enhanced and secure design and implementation of MFA protocols.

Multi-Factor Authentication, Authentication Factors, MFA Vulnerabilities,
Mutual Authentication, Key Leakage Resilience, Perfect Forward Secrecy, User
Anonymity

††copyright: acmlicensed††journalyear: 2024††doi: XXXXXXX.XXXXXXX

##  1\. Introduction

The importance of information security is increasing exponentially due to the
dynamic cyber threats posed by malicious adversaries(Altulaihan et al., 2022;
Wong et al., 2023). They typically exploit various types of security
weaknesses and flaws to achieve their malicious intent(Humayun et al., 2020;
Ang et al., 2023). In particular, authentication-related attacks constitute
the major cyber-attacks in the cybersecurity landscape. In this regard,
attackers exploit weaknesses in authentication protocols and impersonate
legitimate users to gain unauthorized access to a system or service (Ma and
He, 2022). Therefore, employing effective authentication mechanisms is crucial
to alleviate the prevalence of cyber risks in various domains.

Traditionally, authentication protocols are based on a single authentication
factor, e.g., passwords, PINs, preshared keys, and biometrics. However, such
authentication protocols are no longer sufficient due to various reasons. Weak
passwords and password-related vulnerabilities are prevalent concerns. Users
frequently choose easily guessable passwords or reuse them across multiple
accounts, providing opportunities for attackers to crack passwords and gain
unauthorized access (Xie et al., 2022). Phishing attacks are also other
significant threats in which attackers exploit human vulnerabilities by using
fraudulent emails or fake login pages to trick users into revealing their
authentication credentials. These attacks can be phenomenally successful even
against users with strong passwords (Aleroud and Zhou, 2017). Various side-
channel techniques, brute-force attacks, or a combination of the two could
allow attackers to leak passwords/PINs or preshared keys. Adversaries can also
maliciously copy biometric features or hack into a victim’s database in
numerous ways. The need for more robust security measures has led to the
emergence of multi-factor authentication (MFA) (Barkadehi et al., 2018).

MFA is often considered to be more robust and secure than SFA. However, it is
crucial to recognize that only enforcing MFA may not always guarantee enhanced
security. This is because, security weakness and flaws (vulnerabilities) may
still arise due to an incorrect design or implementation of the MFA protocols.
Since the construction of MFA protocols involves different authentication
factors, various secret and public parameters and complex technical issues, it
remains challenging to properly detect security flaws in such protocols. In
fact, even rigorous formal security proofs usually fail to detect such flaws
(Wang and Wang, 2022), which is also proven in our analysis discussed below.
Consequently, such vulnerabilities are often left unnoticed by the protocol
designers or end-users until they are exploited by attackers. If exploited,
they may result in disastrous impacts on users. Furthermore, some MFA
protocols employ three or more authentication factors to enhance their
security guarantee (Jin et al., 2023; Ghafouri Mirsaraei et al., 2022; Kumar
et al., 2023; Ali et al., 2020). However, increasing the number of factors or
using heavyweight approaches may also impose heavy performance penalties,
which might not be tolerable in certain resource-constrained systems.

Therefore, this work aims to detect potential vulnerabilities in existing MFA
protocols by systematically analyzing its design and construction information
that is publicly available in the respective paper. To this end, we first
perform a background study on MFA protocols. Specifically, we first discuss
about authentication factors, which are the building blocks of MFA protocols.
The design and construction of MFA protocols involves a systematic synergy of
different authentication factors. In fact, the security and robustness of MFA
protocols is heavily dependent on the synergy and the types of authentication
factors used. To better comprehend our study and analysis, we revamp the
taxonomy of authentication factors in MFA (cf. Figure 1). In brief, we
classify them into two main categories: _conventional_ and _emerging_
authentication factors. The former involves the commonly used authentication
factors and are further classified as _knowledge factors_ (e.g., passwords,
PINs and security questions), _possession factors_ (e.g., physical tokens,
security keys, smart cards and mobile authenticator apps), _inherent factors_
(Ahmadi et al., 2021) (e.g., fingerprints(Maltoni et al., 2009), facial
recognition(Solomon et al., 2022, 2023c), iris scans(Jardine et al., 2021),
and image recognition(Solomon et al., 2023b, a)) and _location factors_ (Meher
and Amin, 2022; Hegarty, 2017; Karapanos et al., 2015; Saxon and Feamster,
2022). The latter includes recently introduced authentication factors that
show high effectiveness, especially in the context of machine-to-machine (M2M)
authentications. These includes _historical data_ (Chan et al., 2016a; Jin et
al., 2023), _physically unclonable functions (PUF)_ (Alkatheiri et al., 2022;
Gassend et al., 2002) and _firmware integrity_ (Chen et al., 2023; Chekole et
al., 2020, 2021). Such a systematic classification of the authentication
factors is imperative as the use of distinct and independent authentication
factors plays a crucial role in improving the security and robustness of MFA
protocols. The introduction of various machine-learning techniques (Solomon
and Cios, 2023a, b; Solomon, 2023; Solomon and Woubie, 2024) also enhanced the
seamless integration and robustness of different authentication factors in
MFA.

Then, we thoroughly conduct a literature review on various MFA protocols. To
be more comprehensive, we cover several relevant protocols in different
domains, which we classify them as generic client-server systems (Uysal and
Akgün, 2023; Chenchev, 2023; Chen et al., 2022), cloud computing (Bouchaala et
al., 2022; Lee et al., 2021; Yi and Wen, 2023), finance (Hassan and Shukur,
2021; Durairaj and Ramachandran, 2021; Abiew et al., 2020; Aburbeian and
Fernández-Veiga, 2024), healthcare (Sabeeh and Yassin, 2022; Shamshad et al.,
2021; Ali et al., 2020; Dhillon and Kalra, 2018), generic IoT (Cvetković et
al., 2021; Chen et al., 2023; Ghafouri Mirsaraei et al., 2022; Zahednejad et
al., 2023; Sadhukhan et al., 2020), healthcare IoT (Xiaoying et al., 2019; Al-
Saggaf et al., 2022; Azrour et al., 2021; Sharma and Kalra, 2018; Chen et al.,
2024), industrial IoT (IIoT) (Zhang et al., 2022; Khalid et al., 2021; R. et
al., 2020; Li et al., 2020; Liu et al., 2021; Jin et al., 2023; Cui et al.,
2022; Han et al., 2024), smart cities/home (Othman, 2023; Wang et al., 2022;
Oh et al., 2021; Xiang and Zheng, 2020), and wireless sensor networks (WSN)
(Lee et al., 2020; Kumar et al., 2023). We also highlight the key security
requirements and constraints under each domain. We also emphasise on IoT-based
multi-factor authenticated key exchange (MAKE) protocols as they involve more
critical security and efficiency requirements.

First, we identify several protocols based on its relevance and recency. Then,
we revisit and thoroughly analyze the design and implementation of the MFA
protocols to identify potential vulnerabilities. More specifically, we delve
into the intricate details of their constructions to identify vulnerabilities
that can potentially jeopardize the security of the authentication process and
future key secrecy. The analysis is performed heuristically based on a set of
evaluation criteria we employed for this purpose. While different users adopt
different set of security evaluation criteria, we formed our own set of
criteria. It encompasses both existing and our newly introduced ones, which we
believe are very critical for the security of MFA protocols. Then, we
thoroughly evaluate several MFA protocols based on the formed criteria.
Consequently, we manage to detect significant vulnerabilities in ten of the
MFA protocols investigated, which could be readily exploited by an attacker.
We thoroughly discuss the identified vulnerabilities and consolidate the
performance information of the protocols.

The identified vulnerabilities are related to the lack of: explicit mutual
authentication, independence of authentication factors, distinctiveness of
authentication factors, leakage resilience, perfect-forward secrecy, user
anonymity, resilience against known attacks, and realistic adversarial
assumptions. Finally, we propose relevant mitigation strategies for the
identified vulnerabilities. We believe that the consolidated information
provided would serve as a single reference point for researchers and
practitioners to be aware of the potential security issues when designing MFA
protocols. It also helps to apply the necessary mitigation strategies to the
vulnerable ones.

We believe that this work can provide valuable insights to security
researchers and practitioners to better understand potential vulnerabilities
that may exist in the design of MFA protocols and the attack vectors that
could be utilized by adversaries. Remarkably, most of these vulnerable
protocols we identified are published in top cybersecurity journals and
conferences. However, those vulnerabilities went unnoticed during the design,
implementation, testing, and peer-review processes. Although most of the
authors provided rigorous formal proofs on their protocols, they failed to
detect those flaws. This implies that heuristic analysis could sometimes be
even more effective than formal proofs in certain contexts. Therefore, we
believe that insights from this analysis could serve as the basis for
proposing effective mitigation strategies to enhance the design of MFA
protocols per the established security evaluation criteria. Outcomes of this
work can also significantly contribute to the ongoing efforts in the research
community to strengthen authentication protocols and mitigate the security
risks of improper MFA designs.

While there are existing works that tried to detect vulnerabilities in MFA
protocols, they only cover certain security issues on some protocols using
different evaluation criteria (Lee et al., 2020; Ozkan and Bicakci, 2020;
Bellare et al., 1998; Xie et al., 2022). Some others provide a survey on the
security of MFA protocols (Otta et al., 2023; Sain et al., 2022; Barkadehi et
al., 2018; Lee et al., 2020; Williamson and Curran, 2021), but they did not
perform any new security analysis to detect vulnerabilities in the design and
construction of the MFA protocols. To the best of our knowledge, this work is
the first to provide a comprehensive security analysis, especially on design-
and construction-level vulnerabilities of MFA protocols, using a new set of
security evaluation criteria.

Overall, the main objectives of this work are: 1) detecting critical security
flaws in MFA protocols and report them before they are exploited; 2) showing
that simply adding multiple authentication factors may not always guarantee
enhanced security; 3) testifying the relevance of a heuristic analysis in such
contexts (even performs better than formal analysis in some cases); 4)
creating awareness on the critical design flaws in MFA protocols and provide
mitigation strategies; and 5) providing insights and mitigation strategies
towards the design of more secure MFA schemes.

In sum, this work makes the following main contributions.

  * •

We perform a systematic review of several MFA protocols across different
domains, which can serve as a single-point of reference about the state-of-
the-art MFA protocols.

  * •

Our work goes beyond the conventional survey work. Because, we also
systematically analyze the security of several MFA protocols. To this end,

    1. (1)

We first form a set of security evaluation criteria (by introducing new ones
and adopting some existing ones) that can be used to critically assess the
security of MFA protocols.

    2. (2)

We thoroughly evaluate the protocols based on the formed criteria and managed
to identify several critical vulnerabilities in ten of the protocols.

  * •

We devise appropriate mitigation strategies for the vulnerabilities
identified, based on our own perspectives and from certain existing sources.

  * •

We believe that this work provides sufficient insights to the community about
design-level security weaknesses and flaws in MFA protocols.

_Organization._ The remainder of this article is structured as follows.
Section 2 provides the relevant background on MFA and authentication factors.
Section 3 provides our reviews of existing MFA protocols across various
domains. Section 4 highlights our adversarial assumptions used to assess the
security of MFA protocols. In Section 5, we thoroughly analyze and discuss the
flaws and vulnerabilities of the selected MFA protocols. In Section 6, we
devise relevant mitigation strategies for the vulnerabilities identified.
Section 7 concludes the article by outlining relevant future works.

##  2\. Background

###  2.1. Overview of MFA

MFA is employed in diverse contexts to ensure secure access to systems,
applications, or sensitive information. It strengthens security measures by
requiring individuals or entities to provide multiple authentication factors
that prove their identity before they are allowed to access the system or
application. This approach goes beyond traditional SFA and adds additional
layers of security by combining multiple authentication factors.

As highlighted in the introduction, the reliance on a single authentication
factor, such as passwords, PINs, secret keys, and biometrics, is no longer
sufficient for the current security trends and requirements. So, by reducing
the dependence on a single authentication factor, MFA can impose stronger
verification mechanisms. Even if one of the factors is compromised, the
inclusion of additional factors in MFA prevents attackers from advancing
without presenting the complete set of authentication factors. It is worth
noting that MFA is nowadays commonly required in regulatory standards (House,
2021; mis, 2019) and recommended in advisories (mis, 2022, 2023) to safeguard
the security of systems and sensitive information.

Authentication factors are the building blocks of MFA protocols. They are
combined systematically to form an MFA protocol with adequate security
guarantees. In this work, we classify them into conventional and emerging
categories. These categories and their respective subcategories are discussed
in detail below and illustrated in Figure 1 with examples.

###  2.2. Conventional authentication factors

The four categories of authentication factors typically used in MFA protocols
are knowledge factors, possession factors, inherent factors, and location
factors (Williamson and Curran, 2021).

Figure 1. Taxonomy of authentication factors

####  2.2.1. Knowledge factors

Knowledge factors refer to something the individual knows, such as a password,
PIN, or security questions. It is widely employed to verify an individual’s
identity and grant access to systems. Knowledge factors are based on the
assumption that the individual is solely the one who knows the information.
However, knowledge factors may potentially be susceptible to known attacks. As
highlighted in earlier, passwords can be weak or easily guessed. Security
questions can sometimes have answers that can be easily obtained or guessed
(Rabkin, 2008).

####  2.2.2. Possession factors

Possession factors involve something the individual possesses. A typical
example of a possession factor is a physical token, such as a hardware
security key or a smart card. Using such tokens, cryptographic algorithms are
typically utilised to generate a unique code or response to verify the user’s
identity. Mobile authenticators are another form of a possession factor. They
are applications installed on an individual’s mobile device. Mobile
authenticators employ algorithms such as HMAC-based One-Time Password (HOTP)
or Time-based One-Time Password (TOTP) to generate a One-Time Password (OTP)
at regular intervals. The individual is required to enter the generated OTP to
verify their identity.

####  2.2.3. Inherent factors

Inherent factors rely on something the individual is or has, typically related
to an individual’s biological traits or physical characteristics. These traits
are difficult to replicate and provide an elevated level of security (Ahmadi
et al., 2021). Fingerprints, facial recognition, and iris scans are examples
of inherent factors.

These inherent factors offer several advantages in authentication. They
provide high accuracy and security since they are difficult to counterfeit or
manipulate. Additionally, they eliminate the need for users to remember
passwords or carry physical tokens, enhancing convenience and user experience.

####  2.2.4. Location factors

The use of location as an additional authentication factor has been introduced
recently (Meher and Amin, 2022). This factor considers the individual’s
physical presence and compares it to their expected or usual location. If the
user’s location deviates significantly from their regular pattern or appears
suspicious, it can trigger additional verification steps. The prevalence of
mobile devices and technological advancements like Global Positioning System
(GPS) (Hegarty, 2017), IP geolocation (Saxon and Feamster, 2022), and
proximity authentication through ambient sounds (Karapanos et al., 2015) have
led to the increased prominence of location-based authentication.

###  2.3. Emerging authentication factors

Traditional authentication factors possess certain limitations, especially
when employed for machine-to-machine (M2M) authentications. Hence, they pose a
challenge in ensuring secure M2M communications and transactions. Machines,
unlike humans, cannot produce and provide authentication factors like password
or biometric data. New types of authentication factors, such as historical
data, PUF and firmware integrity, are emerged to address these issues.

####  2.3.1. Historical data

Historical data (Chan et al., 2016a) (e.g., previously exchanged sensor data
between a client and server) is recently introduced as a strong authentication
factor due to its dynamic nature and high leakage resilience. It is
incorporated by selecting a set of indices from the historical dataset that is
continuously expanding and using the corresponding data and tags to compute
the response as part of the authentication process. As historical data is
constantly expanding (even if an adversary compromises the data), it will get
outdated soon after, leaving limited room for exploitation.

####  2.3.2. Physically unclonable functions (PUF)

PUF (Alkatheiri et al., 2022; Gassend et al., 2002) utilise the physical
distinction of each electronic device to generate a unique response when
provided with a challenge. These distinctions are typically introduced during
the manufacturing processes. Given the difficulty in replicating the same
response, PUF is used as an authentication factor. While there may be slight
variation in the response due to external factors, it can be rectified using
fuzzy extractors.

####  2.3.3. Firmware integrity

Firmware integrity (Chen et al., 2023) utilise the IoT device’s firmware to
verify its integrity and authenticity. Unlike traditional computing devices,
most IoT devices have firmware as their operating system and interact directly
with the hardware to complete the required assignments. With technological
advancement, some IoT devices are installed with embedded Operating Systems
(OS) such as Windows CE, embedded Linux OS, etc., where the image files are
typically stored together with other essential files in a flash or embedded
multi-media card. Any unauthorised modification would affect the integrity of
the stored content, simplifying the authenticity checks of the IoT device by
verifying the firmware integrity.

##  3\. Literature review on MFA protocols

Before we dive into our security analysis of the vulnerable MFA protocols in
Section 5, we would like to provide a summary of the literature reviews we
conducted in several MFA protocols. Because, the literature review helps to
better comprehend the current trends and advancements in MFA security. With
the multitude of MFA protocols published, it is necessary to understand the
approaches undertaken by researchers when designing the MFA protocols.

In recent years, extensive research and development efforts have resulted in
the development of numerous MFA protocols tailored to specific domains,
including but not limited to cloud computing, finance, healthcare, and the
rapidly expanding field of the internet of things (IoT). Numerous research
papers have also been published to analyze and compare MFA protocols to
identify and rectify security weaknesses and flaws, ultimately improving the
overall security of MFA protocols. To identify vulnerabilities in MFA
protocols, we reviewed several research papers in different domains. Due to
space limitation, we discuss below only the selected ones that we believe are
more relevant in each respective domain. Out of which, we identify
vulnerabilities in ten of them, which are discussed in detail in Section 5.

###  3.1. Generic client-server architecture

Ertan et al. (Uysal and Akgün, 2023) proposed a two-factor authentication
protocol (using TOTP and PUF as the first and second authentication factors)
to alleviate the security posture of TOTP systems. The MFA protocol uses PUF
as storage to securely store the client’s secret. The authors assumed that
Transport Layer Security (TLS) is in place to secure the communication channel
between the entities.

Ivaylo Chenchev (Chenchev, 2023) proposed an MFA protocol secure
communications in a client-server or peer-to-peer architecture. The protocol
uses time-based onetime passwords (TOTP) and dynamically generated passwords
(which is not stored anywhere) as its authentication factors. This protocol
mainly intended to address the vulnerabilities of traditional password-based
MFA protocols that potentially arise due to insecure generation of passwords.

Chen et al. (Chen et al., 2022) proposed a biometrics-based three-factor
authentication and key agreement scheme for multi-server environments. The
authors mainly focused on addressing the weakness of conventional MFA
protocols when adopted in a multi-server environment. This protocol employs
user id, password and digital signature as authentication factors. Using this
protocl, the authors claimed to achieve several impersonation and reply
attacks.

###  3.2. Cloud computing

As the adoption rate of cloud computing increases, adversaries targeting cloud
services are also rising. MFA improves the robustness and efficiency of the
authentication process, which directly enhances the overall security posture
of cloud-based systems, safeguarding sensitive data from potential cyber
threats.

Bouchaala et al. (Bouchaala et al., 2022) proposed a cloud-based MFA protocol
using user id and password, and additionally, smart card as authentication
factors. The protocol is based on elliptic curve cryptography (ECC) and
consists of four phases that include registration, authentication, key update,
and card revocation. The key update phase facilitates the renewal of
cryptographic keys stored in the smart card to maintain security, while the
card revocation feature allows for the immediate revocation of compromised or
lost smart card to reduce the likelihood of security compromise. Through the
formal and informal security analysis conducted, the authors claimed that the
MFA protocol is able to prevent attacks posed by adversaries.

Lee et al. (Lee et al., 2021) proposed a three-factor MFA protocol explicitly
tailored for the cloud environment. The protocol employs password, smart
device, and biometric as authentication factors. It consists of four essential
phases, including the registration phase, login and authentication phase,
password change phase, and identity update phase. Users are allowed to update
their password and modify their personal information as needed. The authors
proved that protocol was able to perform mutual authentication and establish a
secured channel between both parties.

Lee et al. (Yi and Wen, 2023) proposed an innovative and improved three-factor
authentication protocol to mitigate known attacks such as replay attacks,
offline guessing attacks and Denial-of-Service (DoS) attacks. Besides password
and biometric as the first and second authentication factors, the protocol
allows the flexibility of using a laptop and/or smart card as the third
authentication factor. Users can still complete the authentication process if
the laptop or smart card is lost. The protocol consists of a registration and
authentication phases.

Otta et al. (Otta et al., 2023) systematically surveyed MFA protocols
explicitly tailored for securing cloud infrastructure. The paper covered the
following key aspects: threats related to cloud authentication, analysis of
the different types of authentication factors used in MFA, and a comparative
analysis of MFA protocols designed by various researchers. The findings
presented in the paper contributed to a structured approach in selecting the
authentication factor, which can thwart impersonation attacks based on its
uniqueness.

Google developed Google Authenticator to provide its users with an additional
layer of security (Team, [n. d.]). With the enhancement, besides furnishing
their username and password, users are required to furnish the OTP generated
by the Google Authenticator registered to their account as the second
authentication factor to verify their identity when accessing Google services.
Any other services or applications that support TOTP algorithm can also
utilise Google Authenticator as the second authentication factor.

###  3.3. Finance

MFA is also widely adopted by financial sectors, such as banks, insurance
companies, and various payment systems, to securely authenticate individuals
before allowing them to perform any financial transactions. Scam and fraud
transactions, and privacy of clients are some of the critical security
concerns in this domain.

Hassan and Shukur (Hassan and Shukur, 2021) proposed a three-factor
authentication protocol to enhance the authentication process for an
electronic payment system. It combines three authentication factors: password,
biometric, and OTP. The protocol consists of three phases: registration,
authentication and transaction phases, to safeguard the payment system against
a wide range of attacks.

Durairaj and Ramachandran (Durairaj and Ramachandran, 2021) proposed an
innovative approach to their ECC-based authentication protocol. In addition to
low entropy password, International Mobile Subscriber Identity (IMSI) of the
user’s device, and fingerprint, Durairaj and Ramachandran proposed to include
the feature extracted from voice print, processed using Mel Frequency Cepstral
Coefficient algorithm (MFCC) as an additional authentication factor. They
proved that the MFA protocol is able to establish secure communication
channels between two entities after successful mutual authentication.

Similarly, Abiew et al. (Abiew et al., 2020) also adopted an innovative low-
cost approach using another authentication factor, Keystroke Dynamics, to
improve the authentication process. Through the experiment conducted, they
proved that the protocol is able to mitigate the vulnerability of ATM PINS to
dictionary attacks.

Aburbeian et al. (Aburbeian and Fernández-Veiga, 2024) proposed a protocol
that integrates MFA and machine learning to secure financial transactions. The
protocol involves two stages security. In the first stage, the protocol
employs fingerprint and OTP as authentication factors to authenticate users.
In the second stage, the protocol involves a machine learning layer, which
employs facial recognition as a decisive and third authentication factor. This
is to further enhance the security and robustness of the authentication
process. The authors claimed to have achieved several security features with
high accuracy.

###  3.4. Healthcare

In healthcare, researchers have focused on developing MFA protocols
particularly designed to protect lost of patient data, privacy breaches and
unauthorised access to health-related information.

Sabeeh and Yassin (Sabeeh and Yassin, 2022) proposed a two-factor
authentication protocol to authenticate the administrator in the healthcare
system using password and SMS token as authentication factors. The components
include an administrator, user data entry, and a healthcare centre and are
based on typical authentication phases such as initialization, registration,
and authentication phase. Scyther tool was utilised to assess the security
properties of the MFA protocol and proved to be capable of resisting known
attacks.

Shamshad et al. (Shamshad et al., 2021) proposed an improved ECC-based two-
factor authentication protocol that employs password and smart card as
authentication factors to enhance the authentication process. Besides the
typical registration and authentication phases, the protocol includes a
password change phase to facilitate the change of password when required.
While the performance of the protocol was observed to be sub-optimal, they
proved that it is capable of resisting known attacks that affect other more
efficient MFA protocols.

Ali et al. (Ali et al., 2020) discovered that the protocol of Barman et al.
(Barman et al., 2019) was vulnerable to various attacks, such as session key
leakage, server impersonation, and user impersonation attacks. Then, Ali et
al. (Ali et al., 2020) proposed an improved three-factor MFA protocol to
address those security flaws in (Barman et al., 2019). This protocol employs
password, smart card, and biometrics as its authentication factors. The
protocol also involves a user revocation feature, which allows to revoke users
in case of loss of their smart card. The authors claimed to achieve several
security properties, such as key resilience against key leakage attacks,
impersonation attacks, and known attacks.

Dhillon et al. (Dhillon and Kalra, 2018) proposed a three-factor
authentication protocol (involving password, biometrics, and smart card as its
authentication factors) to establish a secure communication channel between a
medical professional and a cloud server. The authors’ informal and formal
security analysis demonstrated that the proposed MFA protocol is capable of
resisting various known attacks.

###  3.5. IoT

The rapid proliferation of IoT devices has contributed to the surge in
designed MFA protocols. The authentication process for IoT devices is unique
due to resource-limited devices and M2M communication scenarios where human
involvement is minimal or absent. That poses challenges for traditional
authentication factors like PINs, passwords, and biometrics. Within the IoT
domain, different subdomains such as Healthcare IoT, industrial IoT (IIoT),
smart cities/homes, and wireless sensor networks (WSN) require specifically
tailored MFA protocols to address their respective requirements and
challenges. To provide a more comprehensive and thorough analysis, we further
classify the MFA protocols of this domain into the following sub-categories.

####  3.5.1. Generic IoT

Cvetković et al. (Cvetković et al., 2021) presented on the application of MFA
protocols in the context of IoT. With the complexity of IoT architecture taken
into consideration, the paper briefly discussed the various IoT security
techniques that stood out, the security objectives of IoT, selected MFA
protocols relevant to IoT, and security considerations specific to MFA
implementation in the IoT. The findings presented in the paper contribute to
understanding MFA protocols suitable for IoT environments and provide insights
into the challenges and considerations involved. With the limitations faced,
they highlighted the need for efficient resource utilization, lightweight
security authentication protocols, and cryptographic algorithms customised for
the IoT environments.

Halvor Vada presented a comparative analysis of various MFA protocols tailored
for IoT systems. Vada highlighted the security challenges inherent in IoT
systems at each layer of the selected 3-layer architecture and emphasized the
importance of a robust authentication protocol to enhance security. The paper
offered valuable insights into the implementation of MFA protocols for IoT
systems by comparing a range of MFA protocols based on authentication factors
employed, performance, strengths, and weaknesses.

Chen et al. (Chen et al., 2023) introduced a novel authentication protocol
designed specifically to enhance the security of IoT devices through MFA. This
protocol incorporates a hierarchical architecture based on the traditional IoT
system, comprising the perception, network, and application layers. In
addition to a secret cryptographic key and PUF, the integrity of the device’s
firmware, which is used to ensure integrity, is also employed as one of the
authentication factors. The protocol also supports firmware updates, enabling
the deployment of patches and security enhancements.

Mirsaraei et al. (Ghafouri Mirsaraei et al., 2022) proposed an ECC-based MFA
protocol on a blockchain platform for generic IoT devices. It employs
password, biometric, and smart card as the authentication factors. In addition
to the typical registration phase, login phase, and authentication phase, an
update phase was included to facilitate password and biometric information
updates. Through the informal and formal security analysis, the authors proved
that the proposed MFA protocol satisfies the typical security requirements and
is capable of resisting known attacks. Automated Validation of Internet
Security Protocols and Applications (AVISPA) tool was utilised to automate the
formal security analysis of this protocol.

Zahednejad et al. (Zahednejad et al., 2023) proposed a two-factor
authentication protocol for generic IoT devices in an M2M context. The
protocol employs a long-term cryptographic key and data items as
authentication factors. The three phases include initialization,
authentication, and a revocation phase to revoke compromised or lost devices.
To simulate real-life scenarios, they assumed a strong adversary capable of
compromising the server and retrieving all the information within and proved
that the MFA protocol was able to ensure a secure authentication process and
repel attacks.

Sadhukhan et al. (Sadhukhan et al., 2020) proposed an ECC-based lightweight
three-factor authentication (involving user identity, password and bimetric
data as the authentication factors) protocol for remote users in IoT network.
The authors performed formal and informal security analysis to demonstrate
that their proposed MFA protocol achieves several security features, such as
resilience against impersonation and DoS attacks, perfect forward secrecy
(PFS), and user anonymity, among others.

Melki et al. (Melki et al., 2020) proposed a lightweight ECC-based two-factor
authentication protocol to provide secure communication channels between an
IoT device and a gateway. A secret session identifier $ID_{s}$ (that is
derived from a PUF output value) and a secret channel-based parameter
$\sigma_{i}$ are used as authentication factors. The authors claimed to have
achieved several security features, such as PFS, session secrecy, user
privacy, and resilience against reply, side-channel and man-in-the-middle
attacks.

####  3.5.2. Healthcare IoT

Jia et al. (Xiaoying et al., 2019) proposed a two-factor authentication
protocol for a fog-driven IoT healthcare system using password and smart card
as authentication factors. This protocol designed is specifically for
healthcare applications in the IoT domain. It involves several phases,
including system setup, registration of users and fog nodes, authentication,
and key agreement. In addition, password updates, user revocation and re-
registration, and fog node revocation were also included to ensure
comprehensiveness. The bilinear pairing was utilized to compute cryptographic
operations efficiently. Formal and informal security analyzes against known
attacks were also performed to demonstrate the security of the MFA protocol.

Al-Saggaf et al. (Al-Saggaf et al., 2022) introduced an innovative and
improved two-factor authentication protocol specifically designed for the IoT-
enabled healthcare ecosystem. The protocol combines smart card and biometrics
as authentication factors. Given the challenges in post-quantum computing, the
authors utilized a Post-Quantum Fuzzy Commitment scheme (PQFC) to protect the
biometric template. It consists of several key phases, including setup,
registration, login, authentication, and biometric revocation. By
incorporating biometric revocation capabilities, the use of suspected
compromised biometrics is prevented.

Azrour et al. (Azrour et al., 2021) designed a two-factor authentication
protocol to address the vulnerabilities observed in a prior work (Sharma and
Kalra, 2018). This protocol employs password and smart card as authentication
factors to secure communications between healthcare systems in the cloud IoT.
It encompasses several phases, including system setup, registration of new
sensors and users, login and authentication, and password update. Formal
security analysis was performed using the Scyther tool and the ROM model, in
addition to informal security analysis to verify the security of the MFA
protocol.

Chen et al. (Chen et al., 2024) proposed a privacy-preserving three-factor MFA
scheme to secure a cloud-assisted medical IoT. The protocol employs user id,
password and biometric data as the authentication factors. The authors claimed
to have achieved several security properties, such as post-quantum security,
PFS, user anonymity, and resilience against reply and impersonation attacks.

####  3.5.3. IIoT

A wide range of industrial IIoT-based MFA protocols has been proposed over the
years (Zhang et al., 2022; Khalid et al., 2021; R. et al., 2020; Li et al.,
2020; Liu et al., 2021; Jin et al., 2023; Cui et al., 2022). Sain et al. (Sain
et al., 2022) provided an overview of security issues related to Cyber
Physical Systems (CPS) and explored the use of MFA to improve security. The
authors also discussed the evolution of authentication, elaborated on the
importance of MFA, and highlighted the rapid adoption of biometrics as one of
the authentication factors. MFA protocols designed for CPS were deliberated
and compared against an established set of evaluation criteria.

Zhang et al. (Li et al., 2020) proposed a blockchain-based MFA protocol
designed specifically for cross-domain IIoT systems. This protocol combines a
long-term cryptographic key and PUF as authentication factors to enhance
security. The protocol encompasses various phases, including registration,
intra-domain authentication, cross-domain authentication to ensure a secure
authentication process. A formal security analysis using BAN logic was
performed to prove the security of the MFA protocol.

Khalid et al. (Khalid et al., 2021) introduced an MFA protocol designed for
cross-platform IIoT systems. This protocol combines password, smartcard, and
biometric authentication factors to enhance the authentication process. The
protocol utilizes the AES-ECC algorithm to secure communications between the
entities. The protocol encompasses various phases, including setup, user and
fog node registration, login, and authentication, ensuring only access to
authenticated users. BAN logic was employed to perform a formal security
analysis to prove the security of the MFA protocol.

The three-factor authentication protocol proposed in (R. et al., 2020) employs
a combination of authentication factors, including password, smart card, and
biometric, to ensure secure communication channels. The protocol consists of
seven phases: offline sensing device and user registrations, login,
authenticated key agreement, biometric and password update, and dynamically
sensing device addition and revocation. The security of the MFA protocol was
proven using Real-Or-Random model (ROR).

A newly designed low-interactivity Multi-Factor Authenticated Key Exchange
(MFAKE) protocol named Secure Remote Multi-Factor protocol was introduced in
(Li et al., 2020) and aims to enhance the security of M2M communication within
the IIoT. The protocol ensures a robust authentication process by leveraging
authentication factors such as password, biometric, and OTP. The key exchange
was proven to be secured using the Bellare-Pointcheval-Rogaway model.

Liu et al. (Liu et al., 2021) introduced an innovative two-factor
authentication protocol to enhance security in M2M communication within the
IIoT landscape. The protocol employs long-term private keys and big data tags
as authentication factors. The protocol begins with an initialization phase
where the entities generate their respective private keys associated with the
big data tags. The IoT device and the server need to provide evidence or proof
that they possess knowledge of the data and its associated tag before
establishing a secure connection between the two during the authentication
phase. They demonstrated that the MFA protocol can achieve Key Compromise
Impersonation (KCI) and Server Compromise Impersonation (SCI) Resilience,
which are critical in IIOT.

Jin et al. (Jin et al., 2023) proposed a historical data-based multi-factor
authenticated and confidential channel establishment (HMACCE) protocol for the
M2M communication within the IIoT. This protocol involves a client and a
server as the entities, with the client possessing a long-term symmetric key
and a secret key as authentication factors. In contrast, the server holds a
long-term symmetric key, historical data, and data tags. The protocol
encompasses three phases, including initialization, tag generation, and online
authentication and key exchange. During the tag generation phase,
authentication tags are generated using the historical data and data tags,
enabling subsequent verifications. They also proposed another HMACCE protocol
named $\pi_{FS}$ to address the issue of adaptive bounded leakage.

Cui et al. (Cui et al., 2022) introduced a three-factor authentication
protocol to satisfy the established security requirements of IIoT
environments. The protocol incorporates three authentication factors,
including password, biometric, and smart card. It encompasses various phases
such as server initialization phase, smart device registration phase, user
registration phase, user login phase, authentication and key agreement phase,
password and biometric update phase, smart devices addition phase, and user
revocation phase. All smart devices and users must be registered before
communications are allowed. They demonstrated the security of the MFA protocol
through informal and formal security analysis using ROR model.

Han et al. (Han et al., 2024) proposed a a three-factor MFA and key agreement
protocol to secure the communication in IIoT that specifically involves three
entities, namely user, gateway and sensing device. The protocol employs user
id, password and biometric key (that is generated from the users biometric
data using a fuzzy extractor) as its authentication factors. The protocol is
mainly designed to address the vulnerabilities of a prior work (Rafique et
al., 2022), such as lack of forward security and vulnerability to insider and
session specific temporary information (KSSTI) attacks.

####  3.5.4. Smart cities/homes

The two-factor authentication protocol for smart cities proposed in (Othman,
2023) incorporates password and smart card as authentication factors. The
protocol consists of several phases, including setup, user and sensors
registration phase, login phase, authentication and key exchange phase, update
phase, and revocation phase to allow for the removal of user privileges if
necessary. Besides informal security analysis using BAN logic, which was
typically used for formal security analysis, AVISPA tool was employed to prove
the security of the MFA protocols. A comparison with other related MFA
protocols was also conducted to demonstrate its effectiveness.

Wang et al. (Wang et al., 2022) designed an improved ECC-based three-factor
authentication protocol based on ECC for smart homes using password, smart
card, and biometrics as authentication factors. The initialization,
registration, login and authentication, and password update phase were
involved in the authentication process. They demonstrated the security of the
MFA protocol through formal security analysis using BAN logic and demonstrated
its efficiency through performance comparison with other related MFA
protocols.

The two-factor authentication protocol proposed in (Oh et al., 2021) was
designed to address the security issues observed in (Xiang and Zheng, 2020).
Password and mobile device are employed as authentication factors in the MFA
protocol. The protocol involves a series of phases, from initialization and
device registration to authentication and key agreement processes. The
protocol also supports password updates for enhanced security. Secure
communication and interaction between the Mobile User and the Smart Device are
established through the Home Gateway. A combination of tools, including BAN
logic, ROR model, and AVISPA tool, was utilised to demonstrate the security of
the MFA protocol.

####  3.5.5. WSN

Wang et al. (Wang and Wang, 2022) aims to investigate and understand the
failures observed in the security proofs of MFA protocols specifically
designed for mobile devices. The paper provided an overview of MFA protocols
designed for mobile devices, an understanding of security proofs failures in
MFA protocols, the development of an enhanced set of evaluation criteria, and
an analysis of a selection of ten MFA protocols. They also proved that
protocols with formal security proofs were able to better satisfy the
established evaluation criteria which aid in the design of a more secure MFA
protocol for mobile devices.

The three-factor authentication protocol designed by authors in (Lee et al.,
2020) for WSNs consists of three phases, including registration of users and
sensors phase, login and authentication phase, and password change phase. It
employs password, biometric, and smart card as authentication factors. All
users and sensors must register with the gateway before establishing any
connection. The protocol utilizes ”honey list” and ”fuzzy extractor”
techniques to enhance security . ProVerif tool was employed to prove the
security of the MFA protocol. The protocol’s performance also proved to be
exceptionally better compared to other related MFA protocols.

Kumar et al. (Kumar et al., 2023) proposed a three-factor authentication
protocol incorporating password, smart card, and biometric as authentication
factors. They incorporated several phases, including the initialization base
station phase, user and sensor node registration phase, login and
authentication phase, and password and session key updating phase, into the
protocol design where users can update their password and generate new session
keys for enhanced security. The protocol also allowed the inclusion of new
sensor nodes into the network with proper authentication procedures through
the adding new nodes phase. The ROR model and the AVISPA tool were employed to
demonstrate the security of the MFA protocol, which proved to satisfy the
security requirements.

###  3.6. Mobile authenticators

Recently, mobile applications are widely used as authentication factors in
most of the domains mentioned above. For example, Google developed Google
Authenticator to provide its users with an additional layer of security (Team,
[n. d.]). With the enhancement, besides furnishing their username and
password, users are required to furnish the OTP generated by the Google
Authenticator registered to their account as the second authentication factor
to verify their identity when accessing Google services. Any other services or
applications that support the TOTP algorithm can also use Google Authenticator
as the second authentication factor.

However, such authenticators are also not without security risks. In a recent
publication (Ozkan and Bicakci, 2020), researchers discovered vulnerabilities
in several mobile authenticators that exposed the unique secret key. The
affected authenticators (as illustrated in Figure 2) includes Epic
Authenticator, Google Authenticator, Microsoft Authenticator, Sophos
Authenticator, Red Hat Free OTP, and Twilio Authy Authenticator. These
vulnerabilities allowed an adversary to access the unique secret key stored
plainly at specific repository locations, such as directories or database
files. In addition, the unique secret key can also be retrieved from memory
during specific periods.

Figure 2. Affected authenticator applications

##  4\. Adversarial model

In order to assess the security of MFA protocols, it is essential to assume a
realistic and concrete adversary model. In fact, one of the limitations of
most MFA protocols is failing to assume strong and realistic adversaries.
Therefore, it is crucial to consider a realistic adversary model. In our
model, we consider the following capabilities of the adversary in an MFA
context:

  * •

The adversary has full control of messages transmitted over the public
channel, i.e., it can intercept, eavesdrop, and redirect it.

  * •

The adversary can acquire design of the proposed MFA protocol.

  * •

The adversary can acquire the first authentication factor, e.g., password.

  * •

A strong adversary can obtain all the data from the device if he gets access
to the device (cf. Figure 3 for the comparison between weak and strong
adversaries).

  * •

In case of PFS attack, we assume that the adversary can obtain the long-term
secrets of both parties.

Figure 3. Snapshot of the comparison between a strong and weak attacker
(Zahednejad et al., 2023)

##  5\. Security analysis of MFA protocols

As highlighted in the introduction, we perform critical security analysis on
several MFA protocols to identify potential security flaws. Of these, we
identify serious security flaws in ten of the protocols. In this section, we
provide a detailed discussion of the vulnerabilities identified in these
protocols. In addition, since the runtime performance of the protocols is
critically important, especially in resource-constrained devices and/or hard
real-time constrained systems, we also present a comparative performance
analysis of the protocols to assess their efficiency.

###  5.1. Evaluation criteria

To assess the security of an MFA protocol, it is essential to establish a set
of evaluation criteria. Different researchers adopted different sets of
security evaluation criteria considering various domains and contexts. After
analyzing the criteria in the existing frameworks, we introduce some new
criteria, such as distinctiveness of authentication factors, independence of
authentication factors, and leakage resilience, to form our set of evaluation
criteria. In sum, it comprise 8 criteria, which are briefly discussed and
summarized in Table 1. We believe these criteria are very essential to
evaluate MFA protocols in different domains, including the multi-factor
authenticated key exchange (MAKE) domain in IoT settings.

Table 1. Evaluation criteria S/No. | Evaluation criteria |  Description
---|---|---
C1 | Mutual authentication |  Both parties must verify each other’s identities before advancing the authentication process and establishing a session key.
C2 | Distinctiveness of factors |  Employ distinct authentication factors each selected from different categories, such as knowledge factors, possession factors, inherent factors, historical data, etc.
C3 | Independence of factors |  Ensure each authentication factor is independent from other. For example, the generation of one factor must not depend on any other factor. Similarly, one factor must not be protected (e.g., encrypted) by using any other factor.
C4 | Leakage resilience |  Ensure that any data leakage cannot compromise keys or authentication factors. In addition, keys and authentication factors must be computationally infeasible to be predicted or guessed.
C5 | Perfect-forward secrecy (PFS) |  Ensure that the leakage of long-term keys (client or server) cannot compromise the security of previous sessions.
C6 | User anonymity |  Preserve user’s identity during the authentication process.
C7 | Resilience against known attacks |  Protect the authentication process against known attacks, such as MITM, replay, password-guessing, impersonation, insider, and DoS attacks.
C8 | Adversary assumption |  Assume strong and realistic adversaries who possess adequate skills and resources to perform sophisticated attacks.

###  5.2. Security analysis

As discussed in the preceding sections, we identified vulnerabilities in ten
of the MFA protocols we analyzed. In this section, we discuss a detailed
account of the vulnerabilities identified.

####  5.2.1. Vulnerable MFA Protocol 1 (Jin et al., 2023)

As discussed in Section 3.5.3, Jin et al. (Jin et al., 2023) proposed a
historical data-based multi-factor authenticated and confidential channel
establishment (HMACCE) protocol for the M2M communication within the IIoT, as
illustrated in Figure 4. This protocol involves a client and a server as the
entities. The client possesses a long-term symmetric key and a tag generation
secret key as first and second authentication factors while the server
possesses a long-term symmetric key, historical data and data tags as first,
second and third authentication factors, respectively. The protocol
encompasses three phases, including initialization, tag generation, and online
authentication and key exchange. During the tag generation phase,
authentication tags are generated using the historical data and data tags,
enabling subsequent verifications. The authors claimed to address the key
leakage issues of a prior historical data-based two-factor authentication
protocol (Chan et al., 2016b). This protocol comprises two versions, namely
$\pi_{woFS}$ and $\pi_{FS}$, that are designed without and with forward
secrecy, respectively. The latter is also claimed to address the issue of
adaptive bounded leakage.

Based on our analysis, this protocol exhibits several vulnerabilities: 1) The
authors claimed that adding an additional authentication message will ensure
mutual authentication between the client and server. Based on the
authentication steps provided, it is true that the client can verify the
authentication message, $M=h(mk||Y||sid||Auth’)$, sent by the server. However,
further checks on the MFA protocol revealed that the client does not send an
explicit authentication message to the server. Hence, the server cannot verify
authenticity of the client, therefore failing the mutual authentication
criteria _C1_. 2) Both of the client’s authentication factors, i.e., the
symmetric authentication key $mk$ and the tag generation secret key $K$, are
in the same authentication factor category, i.e., possession factors. Given
that it does not fully satisfy the intent of MFA, where multiple
authentication factors from different categories should be used to prove
identities (NIST, 2022), it fails the authentication factors distinctiveness
criteria _C2_. 3) The second authentication factor $t_{i}$ of this protocol is
protected using the first authentication factor $sk^{1}_{ids,idc}$ during
transmission, hence failing the authentication factors independence criteria
_C3_. 4) During the tag generation phase, in which the client transfers a
piece of data $d_{i}$ to the server, the server computes an authentication tag
$t_{i}$ using $K$, which is the second authentication factor of the client.
The equation used to derive $t_{i}$ is:

$t_{i}=K.h(d_{i}||i)+k_{i}(modp)$

As a result, the computation of the tag $t_{i}$ depends on the value of the
second authentication factors of the client and the server. Any compromise to
the second authentication factor could potentially lead to the compromise of
the third authentication factor, hence failing the criteria _C3_ again. 5)
This protocol is also susceptible to data- and tag-stealing attacks in which
adversaries could retrieve all the historical data and tags. Since data and
tags are used as authentication factors, such leakage can also compromise the
authentication factors and the session keys. Therefore, it fails the leakage
resilience criteria _C4_. 6) The entropy of its sensor data (which is used as
authentication factor) is between 4.52 and 7.80, which is low and could easily
be predicted. Hence, it fails the criteria _C4_ again. 7) This protocol does
not employ any client anonymity mechanism, thus failing criteria _C6_. 8) The
authors assume a weak adversary (called a bounded-retrieval model) who can
access only a fraction of the historical data after he compromises the server.
This is an unrealistic assumption and fails the criteria _C8_. On the other
hand, the second version (i.e., $\pi_{FS}$) of this protocol satisfies PFS
while the first version (i.e., $\pi_{woFS}$) does not.

Figure 4. Overview of the HMACCE Protocol (Jin et al., 2023)

####  5.2.2. Vulnerable MFA Protocol 2 (Ghafouri Mirsaraei et al., 2022)

As discussed in Section 3.5.1, Mirsaraei et al. (Ghafouri Mirsaraei et al.,
2022) proposed an ECC-based MFA protocol on a blockchain platform for generic
IoT devices. It employs password, biometric, and smart card as the
authentication factors. The authors conducted an informal and formal (e.g.,
using the AVISPA tool) analysis and claimed that their protocol is capable of
satisfying a set of established security requirements and resisting attacks
including key leakage, MITM attacks, DoS attacks, etc.

We perform further analysis in this protocol to identify potential security
flaws. In their security analysis, it was assumed in “Assumption 5” that “the
malicious attacker can obtain only one parameter in an equation at a time.”.
It is crucial to note that adversaries can employ various sophisticated
techniques and strategies to acquire multiple parameters simultaneously. Given
that a strong adversary could potentially acquire the information discussed in
Section 4, there is a risk in this protocol that the session key can be
computed and compromised. The session key is computed using the following
equation:

$SK=M_{2}\oplus V_{1}$

Using the information acquired discussed in Section 4, the adversary can
easily obtain the values of $M_{2}$ and $V_{1}$ to compute $SK$. This is
because, $M_{2}$, which is transmitted through the insecure channel from the
server to the client, can be easily retrieved by eavesdropping. $V_{1}$ can
also be computed using the following equation:

$GID_{i}=ID_{i}\oplus V_{1}$

Similarly, $GID_{i}$ is transmitted through the insecure channel from the
client to the server and can be retrieved by the adversary through
eavesdropping. As for $ID_{i}$, the adversary could acquire the information
through other forms of attacks such as phishing, keylogging, malware, etc.
With the computed session key, the adversary would be able to decipher the
information transmitted via the secured communication channel using the
compromised session key. Therefore, this protocol fails to achieve several
evaluation criteria, including C4, C5, C7 and C8.

####  5.2.3. Vulnerable MFA Protocol 3 (Zahednejad et al., 2023)

As highlighted in Section 3.5.1, Zahednejad et al. (Zahednejad et al., 2023)
proposed a two-factor authentication protocol for generic IoT devices in an
M2M context. The protocol employs a long-term cryptographic key and historical
data items as authentication factors. To simulate real-life scenarios, they
assumed a strong adversary capable of compromising the server and retrieving
all the information within (as illustrated in Figure 3) and proved that the
MFA protocol was able to ensure a secure authentication process and repel
attacks. They also employed ROR model to to formally prove how their protocol
achieves perfect forward secrecy and key compromise resilience.

We perform a further analysis of the protocol to assess its security. As per
the threat model, the adversary can only obtain $N-1$ authentication factors
and is able to eavesdrop any information passed through the public
communication channel. Based on that assumption, it is possible to acquire the
values of $R1$, $R2$, $Y$ and $TID_{c}$, which are transmitted in plain
through the public channel. The adversary would also be able to acquire the
value of one of the authentication factors $mk$. Given that $spk_{s}$ is the
server’s public key, it is publicly available and can be easily acquired by
the adversary. With the acquired information, the adversary would be able to
compute $r1$, $r2$, and $X$ using the following equations:

  1. (1)

$R1=mk\oplus r1$;

  2. (2)

$R1=mk\oplus r1$;

  3. (3)

$X=Y-H(r1||r2)$;

Using the acquired and computed values, the adversary can compute the value of
the session key $SK_{s}$ and decipher the information that is transmitted via
the communication channel secured by the session key $SK_{s}$ using the
equation:

$SK_{s}=H(mk|r1|r2|X|TID_{c}|spk_{s})$

. Moreover, the construction of the authentication process in this protocol is
entirely dependent on the first authentication factor (i.e., mk). Meaning, if
the adversary manages to get mk, he can simply forge the whole authentication
process. Therefore, this protocol does not even satisfy multi-factor
authentication, and it fails several evaluation criteria, such as C3, C4, C5,
C7 and C8.

####  5.2.4. Vulnerable MFA Protocol 4 (Kumar et al., 2023)

As discussed in Section 3.5.5, Kumar et al. (Kumar et al., 2023) proposed a
three-factor authentication protocol for wireless sensor networks. It employs
password, smart card, and biometric as authentication factors.

However, based on our analysis, this protocol also has several limitations.
First of all, a strong adversary was not considered in their threat model. In
the scenario whereby a strong adversary is able to intercept the information
that passes through the open communication channel, i.e. $ID_{sn}^{i}$,
$N_{ur}$, $h(RN_{sc})$, $TS_{1}$ and $TS_{5}$, and obtain $N-1$ authentication
factors, i.e., user id and password, and smart card, the session key used by
the entities can be computed. Using the data acquired, the adversary can
compute the value of the session using the equation:

$K_{ss}=h(ID_{ur}||ID_{sn}^{i}||U_{rg}^{i}||h(ID_{ur}||N_{ur})||h(RN_{sc})||TS_{1}||TS_{5})$

It is possible to infer that the value $TS_{5}$ is meant for a particular
session key by checking the value of $l_{10}$, which is equal to
$(h(K_{sh}\oplus U_{rg}^{i})||ID_{ur})$. Based on Kerckhoffs’s principle
(Petitcolas, 2011) and that hash values have a fixed length, the adversary is
able to derive the length of $h(K_{sh}\oplus U_{rg}^{i})$. Using this
information, the adversary can extract the value of $ID_{ur}$ by removing the
bits belonging to the hash value and determine if $TS_{5}$ is meant for the
affected user that is attempting to establish a secure communication channel,
which results in security and anonymity breaches. Overall, this protocol fails
several evaluation criteria, such as C4, C5, C6, C7 and C8.

####  5.2.5. Vulnerable MFA Protocol 5 (Azrour et al., 2021)

As discussed in Section 3.5.2, Azrour et al. (Azrour et al., 2021) designed a
two-factor authentication protocol for healthcare IoT systems. The protocol
was designed to address vulnerabilities of a prior work (Sharma and Kalra,
2018). This protocol employs password and smart card as authentication factors
to secure communications between healthcare systems in the cloud IoT. In
addition to the informal security analysis, the authors claimed that they
performed a formal security analysis using the Scyther tool and the ROM model
to verify the security of their MFA protocol.

However, upon performing a security analysis, we discovered several flaws in
this protocol. First of all, the authors did not provide a clear threat model
nor indicated capabilities of the assumed adversaries. In addition, based on
their formal and informal analysis, the authors claimed that they achieved
perfect forward secrecy assuming that the values of $x_{s}$ and $MID$ are kept
secret. However, our analysis of this protocol proved the other way round.
$MID$ is transmitted plainly through the public channel; therefore, it is not
secret. In addition, a strong adversary would be capable of acquiring the
value of $x_{s}$ from the cloud server through alternative means. Then, the
value of $w_{i}$, which is used to compute the session key $S_{key}$, can be
obtained using the following equation:

$w_{i}=h(MID||x_{s})$

$Id_{SN}$ is also transmitted plainly through the public channel, therefore it
can be eavesdropped. Using the values $w_{i}$, $MID$ and $Id_{SN}$, the
adversary can compute the session key $S_{key}$ using the equation:

$S_{key}=h(w_{i}||MID||Id_{SN})$

Therefore, this protocol fails several evaluation criteria, including C4, C5,
C6, C7, and C8.

####  5.2.6. Vulnerable MFA Protocol 6 (Ali et al., 2020)

As discussed in Section 3.4, Ali et al. (Ali et al., 2020) proposed a three-
factor symmetric key-based secure AKA protocol for Telecare Medicine
Information Systems (TMIS). It was designed to address vulnerabilities of a
prior work (Barman et al., 2019). The protocol involves password, smart card
and biometrics as its authentication factors. A revocation/re-register phase
was also incorporated to enable the revocation of users in case of loss of a
smart card. Through the informal and formal analysis, the authors demonstrated
that the MFA protocol is resilient against key leakage, impersonation and
known attacks, unlike several other authentication protocols.

However, our analysis proves that the proposed protocol fails to achieve
several security properties, as discussed follows. The proposed MFA protocol
computes its session key $SK_{ij}$ as follows:

$SK_{ij}=h(Y_{RC}||SID_{j}||T_{3})==SK_{ij}^{{}^{\prime}}=h(Y_{i}||SID_{j}||T_{3})$

Through our analysis, the values of $SID_{j}$ and $T_{3}$ can be intercepted
from the open communication channel. It is also possible to compute the value
$Y_{i}$ using the following equation.
$Y_{i}=h(SID_{j}||HID_{i}^{{}^{\prime}}||R_{rand2}||T_{1})$, where:

  * •

$HID_{i}^{{}^{\prime}}=h(PID_{i})$ (acquire $PID_{i}$ by compromising the
first authentication factor);

  * •

$R_{rand2}=R_{rand2}^{{}^{\prime}}\oplus ID_{i}$ (acquire
$R_{rand2}^{{}^{\prime}}$ by intercepting the message from the open
communication channel);

  * •

$T_{1}=T_{1}^{{}^{\prime}}\oplus HID_{i}^{{}^{\prime}}$ (acquire
$T_{1}^{{}^{\prime}}$ by intercepting the message from the open communication
channel);

Upon acquiring the required information as shown above, the adversary can
compute the value of the session key $SK_{ij}$ and decipher the information
that is secured using the session key. The authors also assumed that the
adversary cannot steal the private key of the registration center, which is a
weak assumption as such keys can be leaked using side-channel or other
techniques. Therefore, this protocol does not also achieve key leakage
resilience (C4), perfect forward secrecy (C5), resilience against known
attacks (C7), and strong adversarial assumption (C8).

####  5.2.7. Vulnerable MFA Protocol 7 (Uysal and Akgün, 2023)

As discussed in Section 3.1, Ertan et al. (Uysal and Akgün, 2023) proposed a
two-factor authentication protocol for a generic client-server architecture.
It aimed to alleviate the security posture of TOTP systems. It employs TOTP
and PUF as its first and second authentication factors. The MFA protocol uses
PUF as storage to securely store the client’s secret. The authors assumed that
the communication channel between the entities is secured using TLS.

Based on our analysis, it is observed that the paper did not explicitly
demonstrate the complete authentication process, specifically mutual
authentication, which is an important requirement in MFA protocols. The client
sends the following messages to the server for the authentication:

a) $M_{1}=H(k_{1},(t-t_{0})/I)\oplus r$;

b) $M_{2}=H(k_{2}\oplus r,(t-t_{0})/I)$;

c) $c_{1}$, and;

d) $c_{2}$.

The server computes the value of $H(k_{2}\oplus r,(t-t_{0})/I)$ and verify if
the computed value is the same as $M_{2}$ to authenticate the client. There
is, however, no clear indication of verification performed by the client to
determine the identity and authenticity of the server. Hence, it does not
provide mutual authentication. Furthermore, the authors did not consider other
critical security requirements in MFA, such as key leakage resilience, PFS,
user anonymity, resilience against known attacks, and strong adversarial
assumption. Therefore, it fails the evaluation criteria C1, C4, C5, C6, C7,
and C8.

####  5.2.8. Vulnerable MFA Protocol 8 (Sadhukhan et al., 2020)

As discussed in Section 3.5.1, Sadhukhan et al. (Sadhukhan et al., 2020)
proposed an ECC-based lightweight three-factor authentication protocol for
remote users in a generic IoT network. It employs user identity, password and
bimetric data as its authentication factors.Through their informal security
analysis, the authors claimed to have achieved several security goals,
including resilience against impersonation and DoS attacks, PFS, and user
anonymity, among others.

However, our further analysis on this protocol reveals that most of the
claimed security goals are not properly achieved. For example, the authors
claim of achieving PFS is just by assuming that the secret random number
$R_{U}$ used in the session key generation cannot be compromised by an
attacker even if the pre-shared encryption/decryption symmetric key $K_{X}$ is
compromised by the attacker. This is a wrong assumption. If the attacker gets
$K_{X}$ (which is the underlying assumption in PFS), he can intercept the
packet sent over the public channel and decrypt it to obtain $R_{U}$ (see
Fig.6 in (Sadhukhan et al., 2020)). Because, $R_{U}$ is protected by only
$K_{X}$. That is also how the gateway obtains $R_{U}$ in their protocol.
Therefore, this protocol does not achieve PFS.

In addition, the authors do not consider proper authentication factors as the
user ID and biometric can be easily eavesdropped over the public communication
channel. Moreover, the mutual authentication is based on the hash of the three
factors, i.e., $H_{U}=h(ID_{U}||PW_{U}||B_{U})$. This value (alongside
$R_{U}$) is also encrypted using $K{X}$, i.e., $E_{Kx}(H_{U}||R_{U})$, and
send to other parties over the public channel (see Figure A.1 or Fig.6 in
(Sadhukhan et al., 2020)). That means, it is completely dependent on the pre-
shared encryption/decryption key $K_{X}$ (see the discussion about $R_{U}$
above). In other words, the security of the protocol is entirely dependent on
$K_{X}$, hence the authentication factors become meaningless. Therefore, this
protocol does not achieve proper mutual authentication, distinctiveness of
factors, and independence of factors.

Furthermore, the authors claim of user anonymity is by assuming that the
user’s identity, i.e., $ID_{u}$, is never communicated in plain. However, the
user sends a message, consisting of the variables
$ID_{u},E_{kx}(H_{u}||R_{u}),T_{1}$, to the IoT node over the public channel
(as highlighted in Figure A.1). Since $ID_{u}$ is sent in plain over the open
communication channel, an adversary can obtain it by eavesdropping the open
communication channel. Hence, the protocol does not preserve the user’s
anonymity.

In addition, this protocol does not properly achieve resilience against key
leakage and known attacks nor provided strong threat model. Overall, this
protocol fails all of our security evaluation criteria, i.e., C1 through C8.

####  5.2.9. Vulnerable MFA Protocol 9 (Dhillon and Kalra, 2018)

As highlighted in Section 3.4, Dhillon et al. (Dhillon and Kalra, 2018)
proposed a three-factor MFA and key exchange protocol for a healthcare system.
In particular, it is designed to establish a secure communication channel
between a medical professional and a remote patient monitoring in Cloud-IoT
environments. The protocol involves a password, biometrics, and smart card as
its authentication factors. The authors claimed to have achieved several
security goals, such as mutual authentication, user anonymity, forward secrecy
and many other known attacks.

However, our further analysis on the proposed protocol revealed several
security flaws. For example, even though the protocol is supposed to use three
authentication factors, credentials computed based on the user’s password (1st
factor) and biometric feature (2nd factor) are made to be stored in the smart
card (3rd factor). This means, the two factors are dependent on the safety and
security of the 3rd factor, failing our factors independence criteria C3.

In addition, the authors claim of achieving forward secrecy is infeasible. To
achieve this, they are relying on the MP’s identity ($ID_{MP}$), its private
key $X$, and other parameters $c$ and $u$. First of all, $u$ is transmitted
over a public channel (as seen in Fig.5 of (Dhillon and Kalra, 2018)), which
can be easily intercepted. Secondly, the assumption in forward secrecy is that
the adversary can compromise long-term credentials of the client and server,
hence the authors cannot rely on $X$. Third, $c$ is computed based on the
private key of the cloud server, which is the same issue as above. Fourth, the
$ID_{MP}$ is also stored both in the client and cloud server, which can be
obtained in the same way or in several other means. In fact, $ID_{MP}$ should
not also be used for such purpose since it is not a secret factor. Therefore,
this protocol fails the forward secrecy criteria C5.

Furthermore, there is no resilience against session key or long-term key
leakage attacks or other known attacks. The authors also did not put a strong
adversarial assumption that compromise identities and credentials of the user
and cloud server. Overall, this protocol fails several security criteria,
including C3, C4, C5, C7 and C8.

####  5.2.10. Vulnerable MFA Protocol 10 (Melki et al., 2020)

As discussed in Section 3.5.1, Melki et al. (Melki et al., 2020) proposed a
lightweight ECC-based two-factor authentication protocol to provide secure
communication channels between an IoT device and a gateway (see Figure A.6).
The protocl uses a secret session identifier $ID_{s}$ (that is derived from a
PUF output value) and a secret channel-based parameter $\sigma_{i}$ are used
as authentication factors. The authors claimed to have achieved several
security properties, such as PFS, session secrecy, user privacy, and
resilience against reply, side-channel and man-in-the-middle attacks.

However, our analysis of the protocol reveals several flaws of the protocol.
First of all, the assumed authentication factors, i.e., $ID_{s}$ and
$\sigma_{i}$, are not appropriate factors since such features are not reliable
and prone to several security problems. These factors are not also distinct as
both belong to the family of possession factors. In addition, the authors’
assumption that ”the adversary’s probability of obtaining $ID_{s}$ is
exceptionally low” is unrealistic and it diminishes the principal threat
assumption of MFA, in which the attacker can achieve $N-1$ authentication
factors. In fact, there are several ways to obtain $ID_{s}$, e.g., via side-
channel techniques as it is stored in the client and server devices.

Furthermore, the proposed protocol is susceptible to both client and server
impersonation attacks. Hence, an adversary can potentially obtain the list of
$ID_{s}$ from the gateway. In addition, the adversary can plant itself in
between the IoT device and the gateway and establish separate communication
channels with either of them. In that case, the IoT device would send
$Message_{1}:<M_{1},M_{2},TS_{A}>$ to the adversary instead of the gateway.
The adversary will attempt to retrieve the values of $R_{A}$ and $\tau_{i}$ by
computing $M_{3}^{a}=h(ID_{s}||TS_{A})$, $R_{A}=M_{3}^{a}\oplus M_{1}$,
$\tau_{i}=M_{2}\oplus R_{A}$. The adversary will also compute
$\sigma_{i}^{{}^{\prime}}=Rep(N_{0,A^{a}},\tau_{i})$ where $N_{0,A^{a}}$ is
the channel-based nonce between the IoT device and adversary. The adversary
then computes $Message_{1}^{a}$ containing $<M_{1},M_{2}^{a},TS_{A}>$ where
$M_{2}^{a}=R_{A}\oplus\tau_{i}^{a}$. Here, $\tau_{i}^{a}$ is computed using
the equation $Gen(N_{0,B^{a}})=(\sigma_{i}^{a},\tau_{i}^{a})$ where
$N_{0,B^{a}}$ is the channel-based nonce between the adversary and gateway.
Upon receiving $Message_{1}^{a}$, the gateway can compute the following values
and send them back to the adversary as $Messsage_{2}:<M_{4},M_{5},TS_{B}>$
where:

  1. a)

$SK=h(ID_{s}||TS_{A}||TS_{B}||R_{A}||R_{B}||\sigma_{i}^{a^{{}^{\prime}}})$,
where $\sigma_{i}^{a^{{}^{\prime}}}=Rep(N_{0,B^{a}},\tau_{i}^{a})$;

  2. b)

$M_{4}=h(ID_{s}||TS_{B}||TS_{A}||R_{A})\oplus R_{B}$, and;

  3. c)

$M_{5}=h(SK\oplus R_{A}\oplus R_{B})$.

The adversary will then send $Message_{2}^{a}$: $<M_{4},M_{5}^{a},TS_{B}>$ to
the IoT device where $M_{5}^{a}=h(SK_{a}\oplus R_{A}\oplus R_{B})$ and
$SK_{a}=h(ID_{s}||TS_{A}||TS_{B}||R_{A}||R_{B}||\sigma_{i}^{{}^{\prime}})$.
Upon receiving $Message_{2}^{a}$, the IoT device will compute the following
values and sent back to the adversary as
$Messsage_{3}:<M_{8},TS_{A^{{}^{\prime}}}>$ where
$M_{8}=h(SK_{a^{{}^{\prime}}}||ID_{s})$. Lastly, the adversary will send
$Message_{3}^{a}:<M_{8}^{a},TS_{A^{\prime}}>$ where
$M_{8}^{a}=h(SK^{{}^{\prime}}||ID_{s})$ to the gateway. With the above actions
performed, the adversary can successfully plant itself in between the IoT
device and gateway to intercept all the transmitted information.

Furthermore, the authors claimed to have achieved PFS just by considering the
one-way property of a hash function and the secrecy of the session identifier
$ID_{s}$. This is also an unrealistic claim. Because, the $ID_{s}$ is not
properly secure (as discussed above) and the other parameters (e.g.,
timestamp) are transmitted over the public channel (see Figure A.6). More
importantly, the authors’ assumption of PFS is different from the actual
definition. In reality, PFS is a critical security requirement in key exchange
which requires that past session keys remain secure even if the long-term
credentials of both client and server are compromised. Therefore, this
protocol does not achieve PFS in many ways.

In addition, the authors excluded a malware embedded in one of the
communicating devices and an adversary present in the same subnet (as it can
obtain channel-based parameters) from their threat assumption. These are
unrealistic assumptions, which makes their adversarial model weak. Overall,
this protocol fails to achieve any of our evaluation criteria, i.e., C1
through C8.

###  5.3. Summary of the security analysis

The analysis performed demonstrated that not all MFA protocols are without
weaknesses or flaws. Table 2 summarizes results of our evaluation on the ten
protocols using our evaluation criteria. One of the key insights drawn from
the analysis is that having more authentication factors does not necessarily
translate to better security. As shown in the above analysis, most of the MFA
protocols do not consider the critical security requirements discussed in our
evaluation criteria.

Some MFA protocols were not designed with mutual authentication in mind (Amin
et al., 2018). With the increase in scams (Cue, 2023), it is no longer
surprising that individuals require assurance that the entities they are
interacting with are trusted and legitimate. Organizations verifying the
authenticity of individuals alone are no longer sufficient, as they would need
to prove their identity to the individuals interacting with them too.

As shown in the above analysis, employing interdependent multiple
authentication factors will negatively affect the security of the MFA protocol
it is originally supposed to provide. Compromise in one of the authentication
factors may result in a cascading effect leading to the compromise of the
other authentication factors.

Privacy and anonymity are two features that people increasingly demand as they
become more aware of the importance of safeguarding their personal information
and identity. Moreover, there are privacy regulations (Default, 2023; GDPR.eu,
nd; Singapore Statutes Online, nd) that organizations must comply with. Secure
generation of session keys that are only accessible by authorized parties,
therefore, becomes one of the key requirements (Kumar et al., 2023), which
seems to be lacking in some of the investigated MFA protocols. A combined
attack such as MTIM attack to obtain information transmitted through the open
communication channels and other attacks e.g., smart card loss attack, side-
channel attack, or malware infection resulting in the loss of one
authentication factors, a strong adversary is able to repeatedly compute the
session key generated for each session and use it to decipher the sensitive
information protected by the session key.

Lastly, it is imperative to accurately depict real-life threat scenarios. The
capabilities of adversaries and all possible entry points that could be
targeted by them must be considered in the design of a robust, efficient, and
secure MFA protocol. The weaknesses and flaws identified through this analysis
is a clear indication of fundamental but critical security requirements that
should have been considered when designing MFA protocols.

Table 2. Security evaluation results of the 10 MFA protocols

Protocol | Domain | Authentication Factors | C1 | C2 | C3 | C4 | C5 | C6 | C7 | C8
---|---|---|---|---|---|---|---|---|---|---
Protocol 1 (Jin et al., 2023) ($\pi_{woFS}$) | IIoT | LSK + TGKc \+ HDs \+ HDTs | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | WA
Protocol 1 (Jin et al., 2023) ($\pi_{FS}$) | IIoT | LSK + TGKc \+ HDs \+ HDTs | $\times$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | $\checkmark$ | WA
Protocol 2 (Ghafouri Mirsaraei et al., 2022) | Generic IoT | PW + SC + BD | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | WA
Protocol 3 (Zahednejad et al., 2023) | Generic IoT | LSK + HD | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | SA
Protocol 4 (Kumar et al., 2023) | WSN | PW + SC + BD | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\times$ | WA
Protocol 5 (Azrour et al., 2021) | Healthcare IoT | PW + SC | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | WA
Protocol 6 (Ali et al., 2020) | Healthcare | PW + SC + BD | $\checkmark$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | WA
Protocol 7 (Uysal and Akgün, 2023) | Client-Server | TOTP + PUF | $\times$ | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\times$ | WA
Protocol 8 (Sadhukhan et al., 2020) | Generic IoT | UID + PW + BD | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | WA
Protocol 9 (Dhillon and Kalra, 2018) | Healthcare | PW + SC + BD | $\checkmark$ | $\checkmark$ | $\times$ | $\times$ | $\times$ | $\checkmark$ | $\times$ | WA
Protocol 10 (Melki et al., 2020) | Generic IoT | SSID + SCP | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | WA

Description of notations: LSK: Long-term Shared Key, TGK” Tag Generation Key,
HD: Historical Data, HDT: Historical Data Tags, $X^{c}$: factor $X$ is only
for Client, $X^{s}$: factor $X$ is only for Server, PW: Password, SC: Smart
Card, BD: Biometric Data, TOTP: Time-based Ontime Password, PUF: Physical
Unclonable Function, UID: User Identity, SSID: Secret Session Identifier, SCP:
Secret Channel-based Parameter, WA: Weak Adversary, SA: Strong Adversary
---

###  5.4. Comparative performance analysis

Although most MFA protocols mainly focus on their security guarantee, their
performance overhead (or the security-efficiency tradeoff) should not be
neglected. In fact, some protocols employ too many authentication factors
without considering the penalty in performance. However, performance is
usually equally critical as security, especially in resource and real-time
constrained systems, such as IoT and CPS. Therefore, it is essential to assess
the performance of MFA protocols as well. To do such assessment, researchers
use different types of performance metrics. The most commonly used ones are
computation cost (i.e., the amount of resources required to execute the
authentication protocol), communication bits (i.e., the amount of data
required to be transmitted between entities), communication passes (i.e., the
number of messages exchanged between the client and the server to complete the
authentication process), authentication time (i.e., the time taken to complete
the authentication process), and the storage cost (i.e., the storage size
required to complete the authentication process). Therefore, we also used
these metrics to perform a comparative performance analysis of the ten
protocols investigated. The overall performance analysis is summarized in
Table 3. We believe that this helps future researchers to easily obtain the
performance information of the protocols in a single reference point.

Table 3. Performance comparison of the 10 MFA protocols

Protocol |  Computation Cost |  Communication
Bits |  Communication Passes |  Time Taken
(ms) |  Storage
Required
---|---|---|---|---|---
Protocol 1 (Jin et al., 2023) ($\pi_{woFS}$) |  $326T_{h}+1T_{aed}$ |  3992 |  2 |  22.39 |  -
Protocol 1 (Jin et al., 2023) ($\pi_{\text{FS}}$) |  $328T_{h}+4T_{ecc}+1T_{aed}$ |  4748 |  3 |  $115.549^{\\#}$ |  -
Protocol 2 (Ghafouri Mirsaraei et al., 2022) |  $18T_{h}+14T_{x}+2T_{fe}+2T_{ecc}$ |  1024 |  1 |  198.21 |  -
Protocol 3 (Zahednejad et al., 2023) |  $4T_{me}+(2z+3)T_{m}+(2z)T_{a}+(2z+26)T_{h}$ |  2720 |  4 |  11.28 |  3.4GB + 252B
Protocol 4 (Kumar et al., 2023) |  $26T_{h}+2T_{ed}$ |  2000 |  3 |  - |  -
Protocol 5 (Azrour et al., 2021) |  $17T_{h}\\#$ |  1312* |  3 |  - |  -
Protocol 6 (Ali et al., 2020) |  $15T_{h}+1T_{fe}+3T_{ed}$ |  2144 |  2 |  8.9385 |  -
Protocol 7 (Uysal and Akgün, 2023) |  $4T_{h}+2T_{p}$ |  640 |  1 |  - |  404 GB
Protocol 8 (Sadhukhan et al., 2020) |  $5T_{h}+2T_{ecc}+8T_{ed}$ |  1600 |  3 |  80.6 |  480 bits
Protocol 9 (Dhillon and Kalra, 2018) |  $1T_{me}+7T_{h}$ |  448* |  1 |  - |  -
Protocol 10 (Melki et al., 2020) |  $10T_{h}+10T_{x}+1T_{fe}$ |  896 |  2 |  - |  -

Description of notations: $T_{h}$: hash operation, $T_{\text{ecc}}$: ECC
multiplication, $T_{\text{ed}}$: symmetric encryption decryption,
$T_{\text{aed}}$: SLHAE encryption and decryption, $T_{x}$: XOR operation,
$T_{\text{fe}}$: fuzzy extraction operation, $T_{p}$: PUF computation,
$T_{\text{me}}$: modular exponential operation, $T_{a}$: addition operation,
$T_{m}$: multiplication operation, # : XOR operations ignored, * : Estimated
value, -: no information provided.
---

##  6\. Recommended mitigation strategies

In Section 5, we demonstrated that most MFA protocols are not without
weaknesses and flaws. Adversaries can potentially target such weaknesses to
gain unauthorised access to systems and applications. In this section, we
discuss a wide range of mitigation strategies that can potentially address the
identified weaknesses and flaws and minimize the risk exposure of the systems
and applications. Some of the strategies are our suggestions based on our
perspectives while some others are best practices that we compiled from
existing works.

###  6.1. Mutual authentication

Mutual authentication can be achieved in many ways. One of the most commonly
adopted approaches is using digital certificates in which users authenticate
each other through their respective CA-issued public keys. However, due to its
high performance overhead, it is not the ideal solution for most resource
constrained systems, such as IoT. An ideal approach to address this problem is
a cryptographic construction where both parties can present provable
credentials or factors to prove their identity. One such approach is properly
utilizing shared cryptographic keys in a challenge-response manner. For
example, the server can compute the response to a random nonce with the shared
cryptographic key and compare it with the response computed by the client. If
the response matches, the client is authenticated. Similarly, the client will
compute the response to another random nonce with the shared cryptographic key
and compare it with the response computed by the server. The server is
authenticated if the responses match. Kim et al. (Kim et al., 2023) (as
demonstrated in Figures A.4 and A.2) used such approach to ensure mutual
authentication between entities. It was achieved by verifying messages that
were computed using shared secret parameters distributed during the
registration phase. Using the shared secret parameter $S_{i}^{1}$, the user
and the gateway will mutually authenticate each other by verifying the
correctness of messages $GM_{5}$ and $U_{i}$$M_{8}$, respectively.

Oh et al. (Oh et al., 2021) also adopted a similar approach (as demonstrated
in Figures A.5 and A.9) to achieve mutual authentication. The shared secret
keys $K_{MUG}$ and $K_{GSD}$ stored in the Home Gateway (HGW) are used to
verify the identity of the user and smart device, respectively. The user and
smart device will also utilise the same keys to verify the identity of the HGW
to achieve mutual authentication.

Another interesting approach to achieve mutual authentication is by proving a
possession of a piece of data that allows both parties to authenticate each
other. For example, Zahednejad et al. (Zahednejad et al., 2023) utilized
historical data that were shared between the parties, which allows them to
prove each other’s identity in a challenge-response manner.

For higher assurance, a more rigorous approach can be adopted using formal
methods such as BAN logic (Burrows et al., 1990; Wikimedia Foundation, 2023)
that several researchers used to evaluate the security of their MFA protocols
(Chen et al., 2023; Zhang et al., 2022; Khalid et al., 2021; Othman, 2023;
Wang et al., 2022; Oh et al., 2021), to further prove mutual authentication.

###  6.2. Distinctiveness of authentication factors

For an MFA protocol to be fully effective, one of the key design criteria
should be distinctiveness of its authentication factors. That means, the
protocol should involve distinct authentication factors that are drawn from
different categories, such as knowledge, possession, inherent, and location
factors. This is because, the authentication factors of the same category
often have a relatively similar security level. Hence, if the adversary
manages to break one authentication factor, he can do so on others by applying
a similar technique, as seen in (Ometov et al., 2018). For example, Jin et al.
(Ometov et al., 2018) (see the discussion in Section 5.2.1), used a preshared
symmetric key and a tag generation symmetric key as first and second
authentication factors for the client, respectively. Here, both are possession
factors, and an adversary may apply a similar technique to break them.
Therefore, ensuring the distinctiveness of the authentication factors is an
essential strategy that MFA protocol designers should follow.

###  6.3. Independence of authentication factors

The generation of an authentication factor must be unique and independent from
others to ensure that the compromise of one authentication factor does not
result in the compromise of other authentication factors. For example, an
authentication factor must not be derived from other authentication factors.
In addition, an authentication factor must not be used to protect the
confidentiality of another authentication factor.

By combining multiple independent authentication factors, an adversary must
acquire the different authentication factors in order to gain access to the
targeted system. For example, a three-factor authentication protocol should
utilise three independent authentication factors where the compromise of one
should not affect other. This improves the overall security of the MFA
protocol and the underlying systems. Lee et al. (Lee et al., 2021)
demonstrated the independence of authentication factors in its MFA protocol
and compromise to any of the authentication factors will not result in further
compromise to other authentication factors. Vinoth et al. (R. et al., 2020)
also demonstrated in their MFA protocol that in the event whereby $N-1$
authentication factors are compromised, the remaining authentication factor
will stay secret, and the overall authentication process will not be
compromised. A snapshot of the approach and authentication steps of Vinoth et
al. (R. et al., 2020) is provided in Figure A.8.

###  6.4. Key leakage resilience

Ensuring key leakage resilience is a sophisticated and critical task in the
design of an MFA protocol and has to be extensively deliberated to address
every possible key leakage scenario. There is no one-size-fits-all design to
achieve key leakage resilience and every MFA protocol would require a tailored
approach based on the requirements of the systems and the potential threats
the system is exposed to. However, there are some guiding principles that can
be adhered to achieve the objective.

Given that the initial authentication process is typically conducted through
open communication channels, researchers should ensure that not all parameters
utilised in the session key generation are transmitted in clear. In addition,
the parameters used in the generation of session keys should not be easily
computed using information obtained through the open communication channels
and compromise of the authentication factors. One example is the MFA protocol
designed by Kwon et al. (Kwon et al., 2021), which is illustrated in Figure
A.7. In this protocol, the equation used to compute the session key is
$SK=h(h(N_{2}||HID_{i})||N_{3}||N_{1})$. As shown in Figure A.7, none of the
parameters used in the computation of the session were transmitted in plain
through the open communication channel. To obtain the random nonces $N_{1}$,
$N_{2}$ and $N_{3}$, the adversary would either need to compromise all three
components i.e., User, Gateway, and Sensor Node, or compromise other secret
keys or both authentication factors to obtain parameters that are used to
protect the random nonces.

Although not specifically discussed in the papers relating to MFA protocols,
attaining a high entropy of the cryptographic keys and random nonces, and
proper key management is equally important in achieving the objective the MFA
protocol aims to deliver. High entropy reduces the likelihood of adversaries
from acquiring the sensitive information through guessing or brute-force
attacks that directly or indirectly results in the compromise of the session
keys (mis, nda). Key security is not only about generation, but comprises of
other aspects such as distribution, storage, usage, rotation, and disposal.
Therefore, proper key management adhering to guidelines by reputable
organisations such as NIST (mis, nda, ndb, ndc) would provide a higher
assurance in the overall security of the authentication process. With
technological evolution, cryptographic key lengths once thought to be secure
may become vulnerable. Therefore, it is important to keep current with the
latest cryptographic standards recommended (Computer Security Division, I. T.
L., nd), and regularly review the security of the MFA protocols.

###  6.5. User Anonymity

Ensuring anonymity can be achieved through the use of anonymous credentials,
such as issuing the user with a pseudo identity that will not reveal their
actual identity. For example, in the registration phase of the MFA protocol by
Kim et al. (Kim et al., 2023) shown in Figure A.4, the Gateway generates a
pseudo identity $TID_{i}$ using the values of the user’s actual identity
$ID_{i}$, the Gateway’s secret key $K_{GW}$, and a randomly generated nonce
$R_{GW}^{1}$. The pseudo identity $TID_{i}$ instead of the actual identity
$ID_{i}$ is then used in the authentication process. In addition, the pseudo
identity $TID_{i}$ is refreshed every time with a new pseudo identity
$TID_{i}^{new}$ during the authentication process. Alternatively,
cryptographic techniques can be employed to protect the anonymity of
individuals during the authentication process. These include encryption,
hashing, and other mathematical operations such as concatenation, XOR, etc. In
the proposed MFA protocol by Bouchaala et al. (Bouchaala et al., 2022), the
actual identity of user $ID_{u}$ is never transmitted in plain. Instead,
cryptographic techniques were employed to generate $PID_{u}$, which is used in
the authentication process, with the following equation:

$PID_{u}=(ID_{u}||C_{1})\oplus h(B_{1}||B_{3})$

As the value of $B_{3}$ changes every time, the $PID_{u}$ value will also be
different for every authentication session, making it hard to determine the
actual identity of the user. Similarly, in the design by Lee et al. (Lee et
al., 2021), cryptographic techniques were employed to achieve anonymity. The
actual identity $ID_{u}$, as shown in Figure A.3, is not transmitted in plain
through the open communication channel. Instead, $ID_{u}$, together with
$PWB_{i}$, were used to derive $UID_{u}$ and used for the authentication
process. $UID_{u}$ is obfuscated further using cryptographic techniques before
it is transmitted to the Cloud Server.

###  6.6. Resistance to known attacks

There are several possible approaches to resist known attacks and actual
security mitigation strategies are dependent to specific requirements and
constraints present. The following paragraphs will focus on the weaknesses and
flaws identified in the protocols analysed in Section 5 and provide examples
on the mitigating strategies that can be applied. It is typically not feasible
to communicate via encrypted channel during the initial authentication
process. The client and server are required to have prior trust established
and the required information to establish the secure communication channel
which is one of the key objectives of the authentication process. Therefore,
appropriate assumption had to be accorded that the MFA protocol is unavoidably
susceptible to interception during the initial authentication process,
regardless if the adversaries are weak or strong. Mitigation strategies
discussed in Section 6.3 are applicable in mitigating the potential impacts of
client and server impersonation attacks. Researchers have to ensure that only
non-sensitive information that does not directly or indirectly affects the
security of the MFA protocols is transmitted through the open communication
channel. Oh et al. (Oh et al., 2021) demonstrated how impersonation attack is
mitigated in their design. Even if the adversary can successfully compromise
the first authentication factor i.e. mobile device to obtain the credentials
${A_{1},A_{2},A_{3},A_{4},PID_{M}U}$ and intercept the information i.e.,
${PID_{MU},M_{1},C_{1},V_{MU}}$ transmitted through the open communication
channel, the adversary will not be succeed in impersonating the user as the
adversary does not possess information relating to the second authentication
factor that is necessary to generate a spoofed authentication request that is
valid. Similarly, although the adversary can intercept the information
${PID_{MU},M_{3},C_{2},V_{MUG}}$ and ${M_{5},V_{GSD}}$, the adversary is
unable to generate a spoofed response that is valid without information
relating to the second authentication factor. In addition, in both scenarios,
the adversary is unable to obtain the random nonces i.e., $RN_{MU}$ and
$RN_{G}$ which are required in the computation of a valid request and
response. From the analysis, time-based nonces i.e., timestamps and/or
randomly generated nonces were commonly employed to resist replay attacks.
However, it is worthy to note that the utilisation of time-based nonces may
potentially result in other issue such as DoS attack. The entities involve in
the authentication process must have their clocks synchronised in order for
authentication process to work effectively. In the event of a significant time
difference or clock drift between the entities, it can lead to authentication
failures, resulting in DoS. It is therefore recommended to adopt the use of
randomly generated nonces to eliminate the need to depend on external factors,
in this case time synchronisation. As demonstrated in (Oh et al., 2021) and
shown in Figure A.5, randomly generated nonces are employed to ensure the
“freshness” of the authentication request and is able to resist replay
attacks. However, if time-based nonces must be adopted for any reasons,
additional control measures shall be implemented to ensure accuracy in time
synchronisation to minimize the occurrence of time discrepancies.

###  6.7. Adversary assumption

Assumption of the adversary’s capability is vital in determining the necessary
security mitigation strategies required to satisfy the security requirements
and reduce the likelihood of the risks occurring to the lowest possible. As
indicated by Zahednejad et al. (Zahednejad et al., 2023), assuming a weak
adversary that is only capable of obtaining a small portion of information may
not truly reflect the actual reality. It is therefore important to adopt a
more realistic approach and accord the adversary with the necessary respect so
that security mitigation strategies can designed and implemented to
successfully thwart the attacks.

###  6.8. Summary

Table 4 provides a summary of the possible mitigation strategies that can be
applied to mitigate the weaknesses and flaws identified in Section 5. As
shown, the mitigation strategies are nothing out of the ordinary and have been
implemented in the design of MFA protocols by other researchers (Bouchaala et
al., 2022; Lee et al., 2021; Zahednejad et al., 2023; R. et al., 2020; Oh et
al., 2021; Kwon et al., 2021; Kim et al., 2023).

Table 4. Summary of possible mitigation strategies Security Evaluation Criteria |  Possible Mitigation Strategies
---|---
Mutual Authentication |  – Both parties presenting appropriately provable credentials or factors to each other to prove their identity.
– Cryptographic computations and verifications using shared secret keys.
– Perform security analysis using methods such as BAN logic to formally prove
the security properties.
Distinctiveness of factors |  – Ensure that the authentication factors are from distinct categories.
Independence of factors |  – Generation of authentication factor must be unique and cannot be derived from the knowledge of another authentication factor.
– One authentication factor must not be used to protect the confidentiality of
another authentication factor.
Key Leak Resilience |  – Do not transmit all parameters utilized in the session key generation in clear.
– Parameters utilized in the generation of session keys should not be easily
derived from the information transmitted in clear.
– Achieve high entropy of the cryptographic keys and random nonces.
– Perform proper key management in line with guidelines by reputable
organizations such as NIST.
Perfect-forward secrecy |  – Construct the MFA protocol (including its authentication factors) in such a way that ensures the leakage of long-term keys of both client and server cannot compromise the security of previous sessions. In other words, previous session keys should not be computed from long-term keys of the client and the server.
User Anonymity |  – Employ strong user privacy-preserving approaches (even beyond the use of pseudonymous identities).
– Utilize cryptographic techniques to protect the anonymity of individuals.
Resistance to Known Attacks i.e., impersonation and DoS attacks |  – Do not transmit sensitive information in clear that directly or indirectly affects the security of MFA protocols.
– Protect parameters such as random nonces using cryptographic techniques and
ensure that compromise to $N-1$ authentication factors would not affect the
security of the MFA protocols.
Adversary Assumption |  – Adopt a realistic approach and accord the adversary with appropriate capabilities.

##  7\. Conclusion

With the focus on authentication, several MFA protocols specifically tailored
for the various domains have been developed in recent years. However, common
but yet critical security criteria that should have been considered and
applied were observed to be omitted in some of the proposed MFA protocols. In
some cases, claims of the MFA protocols were capable of satisfying certain
security criteria were proved otherwise. In this work, we reviewed several MFA
protocols and analyzed potential vulnerabilities heuristically. In particular,
we systematically analyzed security flaws in the construction of the protocols
using a set of security evaluation criteria we employed.

Consequently, we managed to identify several vulnerabilities in ten of the MFA
protocols. We provided a detailed discussion of the vulnerabilities
identified. We also highlighted relevant mitigation strategies for those
vulnerabilities. We believe that the consolidated information would provide a
single reference point for researchers to be aware of the potential security
issues that require attention and apply the necessary mitigation strategies
when designing MFA protocols. It is also worth noting the importance of
performance alongside its security. The performance of the MFA protocol should
not be overlooked. Complementing it with an efficient performance will improve
the adoption rate of the secure MFA protocol, thus enhancing the overall
security.

To further strengthen the design and implementation of an MFA protocol, a
security-by-design approach (mis, ndd) should be considered. In the future,
this work can be further extended by employing a formal analysis of the
protocols. Emerging security concerns, such as the security risk posed by the
advent of quantum computing, can also be included as additional evaluation
criteria.

## Acknowledgment

This research is supported by the National Research Foundation, Singapore and
Infocomm Media Development Authority under its Trust Tech Funding Initiative
(DTC-T2FI-CFP-0002). Any opinions, findings and conclusions or recommendations
expressed in this material are those of the author(s) and do not reflect the
views of National Research Foundation, Singapore and Infocomm Media
Development Authority.

## References

  * (1)
  * mis (2019) 2019\.  NOTICE ON CYBER HYGIENE.  https://www.mas.gov.sg/-/media/mas/notices/pdf/psn06-notice-on-cyber-hygiene.pdf
  * mis (2022) 2022\.  Multi-factor Authentication Fact Sheet.  https://www.cisa.gov/sites/default/files/publications/MFA-Fact-Sheet-Jan22-508.pdf
  * mis (2023) 2023\.  Importance of Using Secure Multi-Factor Authentication Methods — csa.gov.sg.  https://www.csa.gov.sg/alerts-advisories/Advisories/2023/ad-2023-006.  [Accessed 22-08-2023].
  * mis (nda) n.d.a.  Recommendation for key management Part 1 - NIST.  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf.
  * mis (ndb) n.d.b.  Recommendation for key management Part 2.  https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt2r1.pdf.
  * mis (ndc) n.d.c.  Recommendation for key management Part 3 - NIST.  https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-57pt3r1.pdf.
  * mis (ndd) n.d.d.  Security by Design Framework - Cyber Security Agency of Singapore.  https://www.csa.gov.sg/docs/default-source/csa/documents/legislation_supplementary_references/security_by_design_framework.pdf?sfvrsn=560b9ff3_0.
  * Abiew et al. (2020) Nuku Abiew, Maxwell Dorgbefu Jnr, and Samuel Banning. 2020\.  Design and Implementation of Cost Effective Multi-factor Authentication Framework for ATM Systems.  _Asian Journal of Research in Computer Science_ (04 2020), 7–20.  https://doi.org/10.9734/ajrcos/2020/v5i330135
  * Aburbeian and Fernández-Veiga (2024) AlsharifHasan Mohamad Aburbeian and Manuel Fernández-Veiga. 2024\.  Secure Internet Financial Transactions: A Framework Integrating Multi-Factor Authentication and Machine Learning.  _AI_ 5, 1 (2024), 177–194.
  * Ahmadi et al. (2021) Fardin Ahmadi, Sonia Garg, Gaurav Gupta, Preety Baglat, Puja Thakur, and Syed Zahra. 2021\.  Multi-factor Biometric Authentication Approach for Fog Computing to ensure Security Perspective.  https://doi.org/10.1109/INDIACom51348.2021.00031
  * Al-Saggaf et al. (2022) Alawi Al-Saggaf, Tarek Sheltami, Hoda Alkhzaimi, and Gamil Ahmed. 2022.  Lightweight Two-Factor-Based User Authentication Protocol for IoT-Enabled Healthcare Ecosystem in Quantum Computing.  _Arabian Journal for Science and Engineering_ 48 (09 2022), 1–11.  https://doi.org/10.1007/s13369-022-07235-0
  * Aleroud and Zhou (2017) Ahmed Aleroud and Lina Zhou. 2017.  Phishing Environments, Techniques, and Countermeasures: A Survey.  _Computers & Security_ 68 (04 2017).  https://doi.org/10.1016/j.cose.2017.04.006
  * Ali et al. (2020) Zeeshan Ali, Sajid Hussain, Rana Rehman, Asmaa Munshi, Misbah Liaqat, Neeraj Kumar, and Shehzad Chaudhry. 2020.  ITSSAKA-MS: An improved three-factor symmetric-key based secure AKA scheme for multi-server environments.  _IEEE Access_ PP (06 2020), 1–1.  https://doi.org/10.1109/ACCESS.2020.3000716
  * Alkatheiri et al. (2022) Mohammed Alkatheiri, Sajid Saleem, Mohammed Alqarni, Ahmad Aseeri, Sajjad Chauhdary, and Yu Zhuang. 2022\.  A Lightweight Authentication Scheme for a Network of Unmanned Aerial Vehicles (UAVs) by Using Physical Unclonable Functions.  _Electronics_ 11 (09 2022), 2921.  https://doi.org/10.3390/electronics11182921
  * Altulaihan et al. (2022) Esra Altulaihan, Mohammed Amin Almaiah, and Ahmed Aljughaiman. 2022.  Cybersecurity threats, countermeasures and mitigation techniques on the IoT: Future research directions.  _Electronics_ 11, 20 (2022), 3330.
  * Amin et al. (2018) Ruhul Amin, SK Islam, P. Vijayakumar, Khurram Khan, and Victor Chang. 2018.  A robust and efficient bilinear pairing based mutual authentication and session key verification over insecure communication.  _Multimedia Tools and Applications_ 77 (2018).  https://doi.org/10.1007/s11042-017-4996-z
  * Ang et al. (2023) Wei Herng Ang, Huaqun Guo, and Eyasu Getahun Chekole. 2023\.  VulnGen: Vulnerable Virtual Machine Generator. In _2023 IEEE International Conference on Service Operations and Logistics, and Informatics (SOLI)_. IEEE, 1–8.
  * Azrour et al. (2021) Mourade Azrour, Jamal Mabrouki, and Rajasekhar Chaganti. 2021\.  New Efficient and Secured Authentication Protocol for Remote Healthcare Systems in Cloud-IoT.  _Security and Communication Networks_ 2021 (05 2021), 1–12.  https://doi.org/10.1155/2021/5546334
  * Barkadehi et al. (2018) Mohammadreza Barkadehi, Mehrbaksh Nilashi, Othman Ibrahim, Ali Fardi, and Sarminah Samad. 2018\.  Authentication Systems: A Literature Review and Classification.  _Telematics and Informatics_ 35 (03 2018).  https://doi.org/10.1016/j.tele.2018.03.018
  * Barman et al. (2019) S. Barman, H. P. H. Shum, S. Chattopadhyay, and D. Samanta. 2019\.  A secure authentication protocol for multi-server-based E-healthcare using a fuzzy commitment scheme.  _IEEE Access_ 7 (2019), 12557–12574.
  * Bellare et al. (1998) Mihir Bellare, Ran Canetti, and Hugo Krawczyk. 1998\.  Modular approach to the design and analysis of authentication and key exchange protocols. In _Conference Proceedings of the Annual ACM Symposium on Theory of Computing_.
  * Bouchaala et al. (2022) Mariem Bouchaala, Cherif Ghazel, and Leila Saidane. 2022\.  Enhancing security and efficiency in cloud computing authentication and key agreement scheme based on smart card.  _The Journal of Supercomputing_ 78 (01 2022), 1–26.  https://doi.org/10.1007/s11227-021-03857-7
  * Burrows et al. (1990) Michael Burrows, Martin Abadi, and Roger Needham. 1990\.  A logic of authentication.  _ACM Trans. Comput. Syst._ 8, 1 (February 1990), 18–36.  https://doi.org/10.1145/77648.77649
  * Chan et al. (2016a) Aldar Chan, Jun Wen, Jianying Zhou, and Joseph Teo. 2016a.  Scalable Two-Factor Authentication Using Historical Data, Vol. 9878. 91–110.  https://doi.org/10.1007/978-3-319-45744-4_5
  * Chan et al. (2016b) A. C.-F. Chan, J. W. Wong, J. Zhou, and J. Teo. 2016b.  Scalable two-factor authentication using historical data. In _Proc. ESORICS_ , Vol. 9878. Springer, 91–110.
  * Chekole et al. (2020) Eyasu Getahun Chekole, Sudipta Chattopadhyay, Martín Ochoa, Huaqun Guo, and Unnikrishnan Cheramangalath. 2020.  Cima: Compiler-enforced resilience against memory safety attacks in cyber-physical systems.  _Computers & Security_ 94 (2020), 101832.
  * Chekole et al. (2021) Eyasu Getahun Chekole, Martín Ochoa, and Sudipta Chattopadhyay. 2021.  Scope: Secure compiling of plcs in cyber-physical systems.  _International Journal of Critical Infrastructure Protection_ 33 (2021), 100431\.
  * Chen et al. (2022) Rui Chen, Yongcong Mou, and Min Zhang. 2022.  A novel three-factor authentication scheme with high security for multi-server environments.  _Wireless Personal Communications_ 124, 1 (2022), 763–781.
  * Chen et al. (2024) Xiao Chen, BaoCheng Wang, and Haibin Li. 2024.  A privacy-preserving multi-factor authentication scheme for cloud-assisted IoMT with post-quantum security.  _Journal of Information Security and Applications_ 81 (2024), 103708\.
  * Chen et al. (2023) Zigang Chen, Zhiquan Cheng, Wenjun Luo, Jin Ao, Yuhong Liu, Kai Sheng, and Long Chen. 2023.  FSMFA: Efficient firmware-secure multi-factor authentication protocol for IoT devices.  _Internet of Things_ 21 (04 2023), 100685.  https://doi.org/10.1016/j.iot.2023.100685
  * Chenchev (2023) Ivaylo Chenchev. 2023\.  Framework for Multi-factor Authentication with Dynamically Generated Passwords. In _Future of Information and Communication Conference_. Springer, 563–576.
  * Computer Security Division, I. T. L. (nd) Computer Security Division, I. T. L. n.d..  Cryptographic standards and guidelines: CSRC.  https://csrc.nist.gov/Projects/Cryptographic-Standards-and-Guidelines.
  * Cue (2023) Cue. 2023.  Scams to watch out for in 2023.  The Straits Times.  https://www.straitstimes.com/business/invest/scams-to-watch-out-for-in-2023.
  * Cui et al. (2022) Jie Cui, Fangzheng Cheng, Hong Zhong, Qingyang Zhang, Chengjie Gu, and Lu Liu. 2022\.  Multi-factor based session secret key agreement for the Industrial Internet of Things.  _Ad Hoc Networks_ 138 (09 2022), 102997.  https://doi.org/10.1016/j.adhoc.2022.102997
  * Cvetković et al. (2021) Aleksandar Sandro Cvetković, Vesna Radojčić, and Saša Adamović. 2021\.  Multi-factor Authentication for the Internet of Things.  _ZBORNIK RADOVA UNIVERZITETA SINERGIJA_ 22\.  https://doi.org/10.7251/ZRSNG2101013C
  * Default (2023) Default. 2023\.  Importance of using secure multi-factor authentication methods.  https://www.csa.gov.sg/alerts-advisories/Advisories/2023/ad-2023-006.  Accessed on: [insert date].
  * Dhillon and Kalra (2018) Parwinder Dhillon and Sheetal Kalra. 2018.  Multi-factor user authentication scheme for IoT-based healthcare services.  _Journal of Reliable Intelligent Environments_ 4 (2018).  https://doi.org/10.1007/s40860-018-0062-5
  * Durairaj and Ramachandran (2021) Prabakaran Durairaj and Shyamala Ramachandran. 2021.  Multi-Factor Authentication for Secured Financial Transactions in Cloud Environment.  _Computers, Materials and Continua_ 70 (09 2021), 1781–1798.  https://doi.org/10.32604/cmc.2022.019591
  * Gassend et al. (2002) Blaise Gassend, Dwaine Clarke, Marten van Dijk, and Srinivas Devadas. 2002.  Silicon physical random functions. In _Proceedings of the 9th ACM conference on Computer and communications security (CCS ’02)_. Association for Computing Machinery, New York, NY, USA, 148–160.  https://doi.org/10.1145/586110.586132
  * GDPR.eu (nd) GDPR.eu. n.d..  General Data Protection Regulation (GDPR) compliance guidelines.  https://gdpr.eu/.
  * Ghafouri Mirsaraei et al. (2022) Amir Hossein Ghafouri Mirsaraei, Ali Barati, and Hamid Barati. 2022\.  A secure three-factor authentication scheme for IoT environments.  _J. Parallel and Distrib. Comput._ 169 (11 2022), 87–105.  https://doi.org/10.1016/j.jpdc.2022.06.011
  * Han et al. (2024) Yiran Han, Hua Guo, Jianwei Liu, Brou Bernard Ehui, Yapeng Wu, and Sijia Li. 2024\.  An Enhanced Multifactor Authentication and Key Agreement Protocol in Industrial Internet of Things.  _IEEE Internet of Things Journal_ 11, 9 (2024), 16243–16254.  https://doi.org/10.1109/JIOT.2024.3355228
  * Hassan and Shukur (2021) Md Hassan and Zarina Shukur. 2021.  A Secure Multi Factor User Authentication Framework for Electronic Payment System. 1–6.  https://doi.org/10.1109/CRC50527.2021.9392564
  * Hegarty (2017) Christopher J Hegarty. 2017\.  The global positioning system (GPS).  _Springer handbook of global navigation satellite systems_ (2017), 197–218.
  * House (2021) The White House. 2021\.  Executive Order on Improving the Nation’s Cybersecurity.  https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/
  * Humayun et al. (2020) Mamoona Humayun, Mahmood Niazi, NZ Jhanjhi, Mohammad Alshayeb, and Sajjad Mahmood. 2020.  Cyber security threats and vulnerabilities: a systematic mapping study.  _Arabian Journal for Science and Engineering_ 45 (2020), 3171–3189.
  * Jardine et al. (2021) A Jardine, TD Ramotsoela, and Gerhard P Hancke. 2021.  Biometric authentication system for industrial applications using iris recognition. In _2021 IEEE 30th International Symposium on Industrial Electronics (ISIE)_. IEEE, 01–06.
  * Jin et al. (2023) Chenglu Jin, Zheng Yang, Tao Xiang, Sridhar Adepu, and Jianying Zhou. 2023.  HMACCE: Establishing Authenticated and Confidential Channel From Historical Data for Industrial Internet of Things.  _IEEE Transactions on Information Forensics and Security_ 18 (2023), 1080–1094.  https://doi.org/10.1109/TIFS.2023.3234873
  * Karapanos et al. (2015) Nikolaos Karapanos, Claudio Marforio, Claudio Soriente, and Srdjan Capkun. 2015.  $\\{$Sound-Proof$\\}$: Usable $\\{$Two-Factor$\\}$ authentication based on ambient sound. In _24th USENIX security symposium (USENIX security 15)_. 483–498.
  * Khalid et al. (2021) Haqi Khalid, Shaiful Hashim, Sharifah Mumtazah, Fazirulhisyam Hashim, and Muhammad Chaudhary. 2021\.  SELAMAT: A New Secure and Lightweight Multi-Factor Authentication Scheme for Cross-Platform Industrial IoT Systems.  _Sensors_ 21 (02 2021), 1428.  https://doi.org/10.3390/s21041428
  * Kim et al. (2023) Keunok Kim, Jihyeon Ryu, Youngsook Lee, and Dongho Won. 2023\.  An Improved Lightweight User Authentication Scheme for the Internet of Medical Things.  _Sensors_ 23 (2023), 1122.  https://doi.org/10.3390/s23031122
  * Kumar et al. (2023) Ravi Kumar, Samayveer Singh, and Pradeep Singh. 2023\.  A secure and efficient computation based multifactor authentication scheme for Intelligent IoT-enabled WSNs.  _Computers and Electrical Engineering_ 105 (01 2023), 108495\.  https://doi.org/10.1016/j.compeleceng.2022.108495
  * Kwon et al. (2021) DeokKyu Kwon, Sungjin Yu, JoonYoung Lee, SeungHwan Son, and YoungHo Park. 2021.  WSN-SLAP: Secure and Lightweight Mutual Authentication Protocol for Wireless Sensor Networks.  _Sensors_ 21 (2021), 936.  https://doi.org/10.3390/s21030936
  * Lee et al. (2021) HakJun Lee, Dongwoo Kang, Youngsook Lee, and Dongho Won. 2021\.  Secure Three-Factor Anonymous User Authentication Scheme for Cloud Computing Environment.  _Wireless Communications and Mobile Computing_ 2021 (07 2021).  https://doi.org/10.1155/2021/2098530
  * Lee et al. (2020) Joonyoung Lee, Sungjin Yu, Myeonghyun Kim, Youngho Park, and Ashok Kumar Das. 2020.  On the Design of Secure and Efficient Three-Factor Authentication Protocol Using Honey List for Wireless Sensor Networks.  _IEEE Access_ PP (06 2020), 1–1.  https://doi.org/10.1109/ACCESS.2020.3000790
  * Li et al. (2020) Zengpeng Li, Zheng Yang, Pawel Szalachowski, and Jianying Zhou. 2020\.  Building Low-Interactivity Multi-Factor Authenticated Key Exchange for Industrial Internet-of-Things.  _IEEE Internet of Things Journal_ PP (07 2020), 1–1.  https://doi.org/10.1109/JIOT.2020.3008773
  * Liu et al. (2021) Bowen Liu, Qiang Tang, and Jianying Zhou. 2021.  _Bigdata-Facilitated Two-Party Authenticated Key Exchange for IoT_.  95–116.  https://doi.org/10.1007/978-3-030-91356-4_6
  * Ma and He (2022) Zhiqiang Ma and Jun He. 2022.  Outsider key compromise impersonation attack on a multi-factor authenticated key exchange protocol. In _International Conference on Applied Cryptography and Network Security_. Springer, 320–337.
  * Maltoni et al. (2009) Davide Maltoni, Dario Maio, Anil K Jain, Salil Prabhakar, et al. 2009\.  _Handbook of fingerprint recognition_. Vol. 2.  Springer.
  * Meher and Amin (2022) Bimal Meher and Ruhul Amin. 2022.  A location-based multi-factor authentication scheme for mobile devices.  _International Journal of Ad Hoc and Ubiquitous Computing_ 41 (04 2022).  https://doi.org/10.1504/IJAHUC.2022.10050034
  * Melki et al. (2020) Reem Melki, Hassan Noura, and Ali Chehab. 2020.  Lightweight Multi-Factor Mutual Authentication Protocol for IoT Devices.  _International Journal of Information Security_ 19 (2020).  https://doi.org/10.1007/s10207-019-00484-5
  * NIST (2022) NIST. 2022.  Multi-factor authentication.  https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication.
  * Oh et al. (2021) JiHyeon Oh, Sungjin Yu, JoonYoung Lee, SeungHwan Son, MyeongHyun Kim, and YoungHo Park. 2021\.  A Secure and Lightweight Authentication Protocol for IoT-Based Smart Homes.  _Sensors_ 21 (02 2021), 1488.  https://doi.org/10.3390/s21041488
  * Ometov et al. (2018) Aleksandr Ometov, Sergey Bezzateev, Niko Mäkitalo, Sergey Andreev, Tommi Mikkonen, and Yevgeni Koucheryavy. 2018.  Multi-factor authentication: A survey.  _Cryptography_ 2, 1 (2018), 1.
  * Othman (2023) Soufiene Othman. 2023\.  Secure and Lightweight Authentication Protocol for Privacy Preserving Communications in Smart City Applications.  (03 2023).  https://doi.org/10.3390/su15065346
  * Otta et al. (2023) Soumya Otta, Subhrakanta Panda, Maanak Gupta, and Chittaranjan Hota. 2023.  A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure.  _Future Internet_ 15 (04 2023), 146.  https://doi.org/10.3390/fi15040146
  * Ozkan and Bicakci (2020) Can Ozkan and Kemal Bicakci. 2020.  Security Analysis of Mobile Authenticator Applications. 18–30.  https://doi.org/10.1109/ISCTURKEY51113.2020.9308020
  * Petitcolas (2011) Fabien A. P. Petitcolas. 2011\.  _Kerckhoffs’ Principle_.  Springer US, Boston, MA, 675–675.  https://doi.org/10.1007/978-1-4419-5906-5_487
  * R. et al. (2020) Vinoth R., Lazarus Deborah, P. Vijayakumar, and Neeraj Kumar. 2020.  Secure Multi-factor Authenticated Key Agreement Scheme for Industrial IoT.  _IEEE Internet of Things Journal_ PP (12 2020).  https://doi.org/10.1109/JIOT.2020.3024703
  * Rabkin (2008) Ariel Rabkin. 2008\.  Personal Knowledge Questions for Fallback Authentication: Security Questions in the Era of Facebook.  _In SOUPS 2008: Proceedings of the 4th Symposium on Usable Privacy and Security, vol 23_ , 13–23.  https://doi.org/10.1145/1408664.1408667
  * Rafique et al. (2022) Farva Rafique, Mohammad S Obaidat, Khalid Mahmood, Muhammad Faizan Ayub, Javed Ferzund, and Shehzad Ashraf Chaudhry. 2022.  An efficient and provably secure certificateless protocol for industrial Internet of Things.  _IEEE Transactions on Industrial Informatics_ 18, 11 (2022), 8039–8046.
  * Sabeeh and Yassin (2022) Mohammad Sabeeh and Ali adil Yassin. 2022.  Privacy-preserving multi-factor authentication and role-based access control scheme for the E-healthcare system.  _Bulletin of Electrical Engineering and Informatics_ 11 (08 2022), 2131–2141.  https://doi.org/10.11591/eei.v11i4.3658
  * Sadhukhan et al. (2020) D. Sadhukhan, S. Ray, G.P. Biswas, M.K. Khan, and M. Dasgupta. 2020.  A lightweight remote user authentication scheme for IoT communication using elliptic curve cryptography.  _The Journal of Supercomputing_ 77 (2020), 1114–1151.