User attribute aware multi-factor authentication framework for cloud based systems

Abstract

Cloud computing has drawn a lot of attention in recent years. The facilities offered in the form of Software as a Service (Saas), Platform as a Service (PaaS)and Infrastructure as a Service (IaaS) are very promising. Current usage of cloud services are increasing day-by-day but it is not upto the level as it has been expected, mainly because of many security concerns that include client authentication, data integrity, data confidentiality, data privacy, different security attacks, lack of trusts, etc. Authentication issue is the primary pit from the security point of view that cloud system vendors must address. A lot of work has been done to build robust authentication techniques though it is still a matter of worry for the cloud vendors. As a remedy for current security flaws, we have proposed a multi-factor authentication framework for cloud based systems utilizing three factors. Our first factor is traditional UserID-password. Second factor is software/hardware token generated TOTP. Our third factor is Authentication Score, which is calculated from clients host, network, location and learned attributes. Cloud server collects those dynamic parameters from the client device using a light agent called Profile Acquisition Program (PAP). PAP runs and provides data only during the time of client login request. We have simulated our proposed multi-factor authentication framework in java (Desktop system) and android (Mobile system). Our proposed MFA framework for cloud is found to be resilient against many of the authentication attacks where existing solution fails.