Multiple-Tiered Security Hierarchy for Web Applications Using Central Authentication and Authorization Service

The central authentication service (CAS) is a middleware for constructing a single sign on infrastructure for Web applications and has been developed by JA-SIG. In this paper, we investigate a multiple-tiered security hierarchy infrastructure for Web applications, by extending CAS to the central authentication and authorization service (CAS²). Since the new version of CAS (CAS3) supports the X.509 client certificate authentication, we use it as leverage to realize our multiple-tiered security hierarchy mechanism. As a result, CAS² uses X.509 client certification for not only authentication, but also authorization

1. Introduction

Most higher educational institutions are struggling to provide efficient and effective information services due to the hierarchical and silo structure of service units. For example, a section that serves students independently works from a section that serves faculties for research. Therefore, each section has a tendency to provide its own information system that has its own authentication and authorization functions. As a result, various authentication and authorization functions are introduced; however, the existence of many authentication functions gives rise to a lot of authentication data for each person. It is well-known that such a situation induces not only increases in management costs but also decreases the security of information systems. Therefore, institutions are trying to introduce “unified authentication databases” to decrease management costs and to strengthening security.