Secure Multi-Tenant API Architectures Using OAuth 2.0 and JWT for Cloud-Native Platforms
DOI:
https://doi.org/10.22399/ijcesen.5550Keywords:
OAuth 2.0, JSON Web Token (JWT), Cloud-Native Security, Multi-Tenant API Architecture, Distributed Authentication SystemsAbstract
Cloud-native computing has revolutionized the current digital infrastructure through the provision of scalable and distributed application designs that are based on microservices and containerized workloads. Services can most easily communicate with each other via Application Programming Interfaces (APIs), which makes services interoperable and enables system design to be modular. Popularization of API-based architectures, however, has been a major challenge in security particularly in the multi tenant cloud computing where one infrastructure is shared by many users or organisations under logical isolation. It is therefore required that secure authentication and authorization be in place so as to prevent cross-tenant access to sensitive data and ensure that only authenticated and authorized users can access protected resources. This review examines secure multi-tenant API architectures that are based on OAuth 2.0 authorization models, and JSON Web Tokens (JWT) authentication models, on cloud-native platforms. The article reviews the current literature in the field of distributed authentication model, token validation scheme, identity management system and tenant isolation method. Special focus is on architectural implementations which include API gateway protection, service mesh authentication and hybrid token lifecycle management strategies. The literature reviewed suggests that token-based authentication systems have a high level of scalability and performance benefits compared to the more traditional session-based authentication. The analyzed literature indicates that stateless JWT validation enables resource servers to authenticate claims of authentication locally, thus reducing latency and enhancing system throughput. To large-scale systems, however, there remain challenges of revocation of tokens, control of cryptographic keys and tenant specific policies. It appears that new solutions that combine JWT-based authentication with mutual TLS authentication and zero-trust security ideas have a bright future in the creation of scalable and secure API ecosystems. Future studies would involve better management of token lifecycle, automatic vulnerability detection, anomaly detection using machine learning, and distributed identity systems with edge and serverless environments.
References
[1] Wang, L., Chen, D., & Tao, Y. (2018). Secure token-based authentication for cloud applications. Future Generation Computer Systems, 86, 370–382.
[2] Jamshidi, P., Pahl, C., Mendonça, N. C., Lewis, J., & Tilkov, S. (2018). Microservices: The journey so far and challenges ahead. IEEE Software, 35(3), 24–35. DOI: https://doi.org/10.1109/MS.2018.2141039
[3] Soldani, J., Tamburri, D. A., & van den Heuvel, W.-J. (2018). The pains and gains of microservices: A systematic grey literature review. Journal of Systems and Software, 146, 215–232. DOI: https://doi.org/10.1016/j.jss.2018.09.082
[4] Di Francesco, P., Lago, P., & Malavolta, I. (2019). Architecting with microservices: A systematic mapping study. Journal of Systems and Software, 150, 77–97. DOI: https://doi.org/10.1016/j.jss.2019.01.001
[5] Rahman, M., Williams, L., & Parnin, C. (2019). Continuous security: A systematic literature review. Journal of Systems and Software, 155, 1–17.
[6] Jin, M., Lv, A., Zhu, Y., Wen, Z., Zhong, Y., Zhao, Z., Wu, J., Li, H., He, H., & Chen, F. (2020). An anomaly detection algorithm for microservice architecture based on robust principal component analysis. IEEE Access, 8, 226397–226408. DOI: https://doi.org/10.1109/ACCESS.2020.3044610
[7] Waseem, M., Liang, P., & Shahin, M. (2020). A systematic mapping study on microservices architecture in DevOps. Journal of Systems and Software, 170, 110798. DOI: https://doi.org/10.1016/j.jss.2020.110798
[8] Yu, L., Xue, Y., Li, X., & Qian, J. (2020). Security analysis of microservice architecture. IEEE Access, 8, 173615–173627.
[9] Ferretti, L., Magnanini, F., Andreolini, M., & Colajanni, M. (2021). Survivable zero trust for cloud computing environments. Computers & Security, 110, 102419. DOI: https://doi.org/10.1016/j.cose.2021.102419
[10] Hannousse, A., & Yahiouche, S. (2021). Securing microservices and microservice architectures: A systematic mapping study. Computer Science Review, 41, 100415. DOI: https://doi.org/10.1016/j.cosrev.2021.100415
[11] Nasab, A. R., Shahin, M., Liang, P., Basiri, M. E., Hoseyni Raviz, S. A., Khalajzadeh, H., Waseem, M., & Naseri, A. (2021). Automated identification of security discussions in microservices systems: Industrial surveys and experiments. Journal of Systems and Software, 181, 111046. DOI: https://doi.org/10.1016/j.jss.2021.111046
[12] Pereira-Vale, A., Fernandez, E. B., Monge, R., Astudillo, H., & Márquez, G. (2021). Security in microservice-based systems: A multivocal literature review. Computers & Security, 103, 102200. DOI: https://doi.org/10.1016/j.cose.2021.102200
[13] Wang, Y., Kadiyala, H., & Rubin, J. (2021). Promises and challenges of microservices: An exploratory study. Empirical Software Engineering, 26, 63. DOI: https://doi.org/10.1007/s10664-020-09910-y
[14] Waseem, M., Liang, P., Shahin, M., Di Salle, A., & Márquez, G. (2021). Design, monitoring, and testing of microservices systems: The practitioners’ perspective. Journal of Systems and Software, 182, 111061. DOI: https://doi.org/10.1016/j.jss.2021.111061
[15] Berardi, D., Giallorenzo, S., Mauro, J., Melis, A., & Montesi, F. (2022). Microservice security: A systematic literature review. PeerJ Computer Science, 8, e779. DOI: https://doi.org/10.7717/peerj-cs.779
[16] Chatterjee, A., Gerdes, M. W., Khatiwada, P., & Prinz, A. (2022). SFTSDH: Applying Spring Security Framework with TSD-based OAuth2 to protect microservice architecture APIs. IEEE Access, 10, 41914–41934. DOI: https://doi.org/10.1109/ACCESS.2022.3165548
[17] de Almeida, M. G., & Canedo, E. D. (2022). Authentication and authorization in microservices architecture: A systematic literature review. Applied Sciences, 12(6), 3023. DOI: https://doi.org/10.3390/app12063023
[18] Gortney, M. E., Harris, P. E., Cerny, T., Al Maruf, A., Bures, M., Taibi, D., & Tisnovsky, P. (2022). Visualizing microservice architecture in the dynamic perspective: A systematic mapping study. IEEE Access, 10, 119999–120012. DOI: https://doi.org/10.1109/ACCESS.2022.3221130
[19] He, Y., Huang, D., Chen, L., Ni, Y., & Ma, X. (2022). A survey on zero trust architecture: Challenges and future trends. Wireless Communications and Mobile Computing, 2022, 6476274. DOI: https://doi.org/10.1155/2022/6476274
[20] Ponce, F., Soldani, J., Astudillo, H., & Brogi, A. (2022). Smells and refactorings for microservices security: A multivocal literature review. Journal of Systems and Software, 192, 111393. DOI: https://doi.org/10.1016/j.jss.2022.111393
[21] Assunção, W. K. G., Krüger, J., Mosser, S., & Selaoui, S. (2023). How do microservices evolve? An empirical analysis of changes in open-source microservice repositories. Journal of Systems and Software, 204, 111788. DOI: https://doi.org/10.1016/j.jss.2023.111788
[22] Devi Priya, V. S., Sethuraman, S. C., & Khan, M. K. (2023). Container security: Precaution levels, mitigation strategies, and research perspectives. Computers & Security, 135, 103490. DOI: https://doi.org/10.1016/j.cose.2023.103490
[23] Nasab, A. R., Shahin, M., Hoseyni Raviz, S. A., Liang, P., Mashmool, A., & Lenarduzzi, V. (2023). An empirical study of security practices for microservices systems. Journal of Systems and Software, 198, 111563. DOI: https://doi.org/10.1016/j.jss.2022.111563
[24] Xi, N., Liu, J., Li, Y., & Qin, B. (2023). Decentralized access control for secure microservices cooperation with blockchain. ISA Transactions, 141, 44–51. DOI: https://doi.org/10.1016/j.isatra.2023.07.018
[25] Zeng, Q., Kavousi, M., Luo, Y., Jin, L., & Chen, Y. (2023). Full-stack vulnerability analysis of the cloud-native platform. Computers & Security, 129, 103173. DOI: https://doi.org/10.1016/j.cose.2023.103173
[26] Zhong, C., Zhang, H., Li, C., Huang, H., & Feitosa, D. (2023). On measuring coupling between microservices. Journal of Systems and Software, 200, 111670. DOI: https://doi.org/10.1016/j.jss.2023.111670
[27] Zdun, U., Quèval, P.-J., Simhandl, G., Scandariato, R., Chakravarty, S., Jelic, M., & Jovanovic, A. (2023). Microservice security metrics for secure communication, identity management, and observability. ACM Transactions on Software Engineering and Methodology, 32(1), Article 16. DOI: https://doi.org/10.1145/3532183
[28] Antunes, P., & Guimarães, N. (2024). Guiding the implementation of data privacy with microservices. International Journal of Information Security, 23(6), 3591–3608. DOI: https://doi.org/10.1007/s10207-024-00907-y
[29] Fernandez, E. B., & Brazhuk, A. (2024). A critical analysis of zero trust architecture (ZTA). Computer Standards & Interfaces, 89, 103832. DOI: https://doi.org/10.1016/j.csi.2024.103832
[30] Flora, J., & Antunes, N. (2024). Evaluating intrusion detection for microservice applications: Benchmark, dataset, and case studies. Journal of Systems and Software, 216, 112142. DOI: https://doi.org/10.1016/j.jss.2024.112142
[31] Glöckler, J., Sedlmeir, J., Frank, M., & Fridgen, G. (2024). A systematic review of identity and access management requirements in enterprises and potential contributions of self-sovereign identity. Business & Information Systems Engineering, 66(4), 421–440. DOI: https://doi.org/10.1007/s12599-023-00830-x
[32] Itodo, C., & Ozer, M. (2024). Multivocal literature review on zero-trust security implementation. Computers & Security, 141, 103827. DOI: https://doi.org/10.1016/j.cose.2024.103827
[33] Patel, D. G. (2025). Automating multi-cloud workflows with Packer and Terraform. International Journal of Creative Research Thoughts, 13(6), a987–a999.
[34] Nicolas-Plata, A., Gonzalez-Compean, J. L., & Sosa-Sosa, V. J. (2024). A service mesh approach to integrate processing patterns into microservices applications. Cluster Computing, 27(6), 7417–7438. DOI: https://doi.org/10.1007/s10586-024-04342-5
[35] Panahandeh, M., Hamou-Lhadj, A., Hamdaqa, M., & Miller, J. (2024). ServiceAnomaly: An anomaly detection approach in microservices using distributed traces and profiling metrics. Journal of Systems and Software, 209, 111917. DOI: https://doi.org/10.1016/j.jss.2023.111917
[36] Yang, W., Chen, P., Yu, G., Zhang, H., & Zhang, H. (2024). Network shortcut in data plane of service mesh with eBPF. Journal of Network and Computer Applications, 222, 103805. DOI: https://doi.org/10.1016/j.jnca.2023.103805
[37] Zanasi, C., Russo, S., & Colajanni, M. (2024). Flexible zero trust architecture for the cybersecurity of industrial IoT infrastructures. Ad Hoc Networks, 156, 103414 DOI: https://doi.org/10.1016/j.adhoc.2024.103414
[38] [Aldea, C. L., & Bocu, R. (2025). Authentication challenges and solutions in microservice architectures. Applied Sciences, 15(22), 12088. DOI: https://doi.org/10.3390/app152212088
[39] Chen, Q., Liu, Y., Tan, R., Jin, Z., Xiao, J., Wang, X., Zhang, F., & Liu, Q. (2025). Shadowkube: Enhancing Kubernetes security with behavioral monitoring and honeypot integration. Cybersecurity, 8, 63. DOI: https://doi.org/10.1186/s42400-025-00372-7
[40] Chuang, Y.-T., & Tu, C.-H. (2025). Mitigating DDoS attacks in containerized environments: A comparative analysis of Docker and Kubernetes. Journal of Parallel and Distributed Computing, 204, 105130. DOI: https://doi.org/10.1016/j.jpdc.2025.105130
[41] Escaleira, P., Cunha, V. A., Barraca, J. P. B., Gomes, D., & Aguiar, R. L. (2025). A systematic review on security mechanisms for serverless computing. Cluster Computing, 28, 465. DOI: https://doi.org/10.1007/s10586-025-05371-4
[42] Genfer, P., Serbout, S., Simhandl, G., Zdun, U., & Pautasso, C. (2025). Understanding security tactics in microservice APIs using annotated software architecture decomposition models: A controlled experiment. Empirical Software Engineering, 30, 66. DOI: https://doi.org/10.1007/s10664-024-10601-1
[43] Lilhore, U. K., Simaiya, S., Alroobaea, R., Baqasah, A. M., Alsafyani, M., Alhazmi, A., & Khan, M. M. (2025). SmartTrust: A hybrid deep learning framework for real-time threat detection in cloud environments using zero-trust architecture. Journal of Cloud Computing, 14, 35. DOI: https://doi.org/10.1186/s13677-025-00764-7
[44] Ma, Z., Wei, H., Jiang, J., Wang, B., Wang, H., & Di, Z. (2025). A lightweight zero-trust authentication architecture for IoT via unified enhanced FAST-SM9 and dynamic re-authentication. PLOS ONE, 20(10), e0332943. DOI: https://doi.org/10.1371/journal.pone.0332943
[45] Ponce, F., Verdecchia, R., Miranda, B., & Soldani, J. (2025). Microservices testing: A systematic literature review. Information and Software Technology, 188, 107870. DOI: https://doi.org/10.1016/j.infsof.2025.107870
[46] Rodrigues, H., Rito Silva, A., & Avritzer, A. (2025). Assessment of performance and its scalability in microservice architectures: Systematic literature review. Journal of Systems and Software, 230, 112500. DOI: https://doi.org/10.1016/j.jss.2025.112500
[47] Schneider, S., Bakhtin, A., Li, X., Soldani, J., Brogi, A., Cerny, T., Scandariato, R., & Taibi, D. (2025). Comparison of static analysis architecture recovery tools for microservice applications. Empirical Software Engineering, 30(5), 128. DOI: https://doi.org/10.1007/s10664-025-10686-2
[48] Shin, D., Kim, J., Pawana, I. W. A. J., & You, I. (2025). Enhancing cloud-native DevSecOps: A zero trust approach for the financial sector. Computer Standards & Interfaces, 93, 103975. DOI: https://doi.org/10.1016/j.csi.2025.103975
[49] Sreelatha, G., Tak, T. K., Kalimuthu, R., Kshirsagar, P. R., Maram, B., & Venkatakrishnamoorthy, T. (2025). Detecting hidden communication threats in cloud systems using advanced pattern and threat propagation analysis. Journal of Cloud Computing, 14, 55. DOI: https://doi.org/10.1186/s13677-025-00778-1
[50] Tanveer, F., Iradat, F., Iqbal, W., & Ahmad, A. (2025). Towards secure APIs: A survey on RESTful API vulnerability detection. Computers, Materials & Continua, 84(3), 4223–4257. DOI: https://doi.org/10.32604/cmc.2025.067536
[51] Wang, C., Tang, H., Zhao, Y., You, W., Yang, J., & Qiu, H. (2026). Losing control: Exposing security weaknesses of Kubernetes control plane interfaces. Computers & Security, 160, 104704. DOI: https://doi.org/10.1016/j.cose.2025.104704
[52] Arfan Uddin, M., Weerasinghe, S., Gajewski, D., Akbarsharifi, M., Akbarsharifi, R., Stoner, C., Cerny, T., & He, S. (2026). Microservice logs analysis employing AI: A systematic literature review. Journal of Systems and Software, 236, 112786. DOI: https://doi.org/10.1016/j.jss.2026.112786
[53] Kamyszek-Mały, E., Mongay Batalla, J., Kelner, J. M., & Mavromoustakis, C. X. (2026). Opportunities and challenges of service mesh in multi-access edge computing. Computer Networks, 280, 112208. DOI: https://doi.org/10.1016/j.comnet.2026.112208
[54] Pizzato, F., Bringhenti, D., Sisto, R., & Valenza, F. (2026). Intent-driven network isolation for the cloud computing continuum. Journal of Network and Systems Management, 34, 6. DOI: https://doi.org/10.1007/s10922-025-09986-1
[55] Zaritto, F., Bravi, E., Sisinni, S., & Lioy, A. (2026). Extending Kubernetes for pods integrity verification. Journal of Network and Systems Management, 34, 14. DOI: https://doi.org/10.1007/s10922-025-09988-z
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 International Journal of Computational and Experimental Science and Engineering
This work is licensed under a Creative Commons Attribution 4.0 International License.
