COMPARATIVE ANALYSIS OF MODERN MULTI-FACTOR AUTHENTICATION METHODS IN CYBERSECURITY SYSTEMS

Abstract. The article investigates modern multi-factor authentication (MFA) methods as one of the key mechanisms for ensuring cybersecurity in the context of digital transformation, cloud computing development, remote work expansion, and the implementation of the Zero Trust concept. The relevance of the study is determined by the rapid increase in cyberattacks associated with compromised user credentials, phishing campaigns, Adversary-in-the-Middle (AiTM) attacks, and the use of social engineering techniques to bypass traditional security mechanisms.

The paper analyzes the theoretical foundations of multi-factor authentication and examines the modern classification of authentication factors, including knowledge, possession, biometric, contextual, and behavioral factors. The operating principles of the most widespread MFA technologies are considered, including SMS OTP and Email OTP mechanisms, software tokens based on HOTP and TOTP algorithms, push authentication systems using the Number Matching mechanism, as well as the cryptographic standards FIDO2 and WebAuthn. Their architectural features, advantages, disadvantages, and resistance to contemporary cyber threats are analyzed.

To ensure an objective evaluation of the studied methods, a multi-criteria mathematical model based on the weighted-sum method was proposed. The assessment was carried out according to phishing resistance, communication channel security, usability, operational autonomy, and total cost of ownership. Based on the developed efficiency matrix, a comparative analysis of modern MFA solutions was conducted and their integral efficiency indicators were determined.

The results of the study indicate that traditional authentication methods based on one-time passwords delivered via SMS or e-mail no longer provide an adequate level of protection against modern phishing attacks. It has been established that software-based TOTP solutions offer a higher level of security but remain vulnerable to real-time attacks. Push authentication demonstrates an improved user experience but remains partially dependent on the human factor.

The highest efficiency indicators were demonstrated by FIDO2 and WebAuthn standards, which employ asymmetric cryptography and cryptographic binding of credentials to the service domain, thereby providing inherent protection against phishing and AiTM attacks. Particular attention is paid to promising directions in the development of authentication systems, including adaptive risk-based authentication using machine learning techniques and the integration of post-quantum cryptographic algorithms into future generations of FIDO protocols. Based on the obtained results, practical recommendations for implementing multi-factor authentication in the corporate sector and information systems with enhanced security requirements are formulated.