# A Secure CDM-Based Data Analysis Platform (SCAP) in Multi-Centered Distributed Setting
## 2 Related Work
### Authentication Methods  
Most modern applications implement procedures to verify the authenticity of users. In this section, we introduce communication schemes used for authentication.  
The Json web token (JWT) securely transfers information between two parties in a lightweight and self-contained way using JSON objects [19]. The terminology'self-contained' means that it has all the information needed for a claim in it. In other words, all the information required for authentication is included in the token. JWT consists of header, payload, and signature; each part is base64 encoded and separated by a dot. The header contains the algorithm for the signature generation. In the signature part, the digital signature for the payload, calculated by the algorithm specified in the header, is located. The payload holds the information to be contained in the token. This information is called claims and includes registered claims, public claims, and private claims as specified in the standard. JWT does not require a special storage because it contains all information necessary for user authentication in the token itself. However, it is difficult to set an appropriate token life cycle, and the more information the payload contains, the larger the token size.  
Open authorization (OAuth) 2.0 is an open standard for delegating access of websites or applications to their information on other websites without the users providing passwords [20]. OAuth 2.0 deals with both authentication and authorization. The users (resource owner) are authenticated by the application (client) with their credentials. The client uses these credentials to request an access token from the authorization server. Authorization server verifies the received credentials and issues an access token. The client presents the access token and obtains the resources from the resource server. OAuth 2.0 is not only adopted as a popular authentication and authorization method in modern web services, it can also be used very conveniently by a user. In addition, services share resources with each other and can be easily extended with more functionalities. However, OAuth 2.0 is used only on HTTPS, and the access tokens should be managed securely. Since this scheme supports many authentication methods, developers need to correctly understand the specification, so that setting up the operating environment correctly.  
Lastly, Kerberos provides a ticket-based centralized authentication service [23]. In an environment where services are distributed on a network, users typically should prove their identity for each service. The services should maintain a storage for the user's authentication information and so, it is vulnerable to security breaches. To resolve this inconvenience, Kerberos provides a simplified authentication mechanism using an authentication server (AS), a ticket-granting server (TGS), and a service server (V). The users prove their identity to the AS and receive a token. The users present the token and the ID of V to access to TGS, and receive a ticket. This ticket is presented when the users access V and is used to authenticate the users by TGS. If the users access another V, without repeating authentication from the beginning, the users obtain a new ticket by presenting the token of the AS and the ID of the new V. Owing to this simplified authentication process, Kerberos is often employed to implement single sign-on (SSO) functionality. However, Kerberos allows access to only one service at a time, although outside the scope of the protocol design.