CATMS: A Centralized Authentication and Token Mediation Framework for Zero Trust Enterprise Microservices

Abstract

Modern enterprise systems are composed of heterogeneous distributed services that implement diverse authentication mechanisms, including OAuth 2.0, JSON Web Tokens (JWT), API keys, and Basic Authentication. This diversity creates significant interoperability challenges, introduces credential exposure risks, and increases the complexity of client-side security implementations. This paper proposes the Centralized Authentication and Token Mediation System (CATMS), a middleware framework that unifies authentication and authorization across distributed enterprise applications under a Zero Trust Architecture (ZTA) model. CATMS validates client-submitted tokens at a centralized boundary, resolves target backend services through a service registry, retrieves and transforms credentials through a secure mediation layer, and routes authenticated requests to target APIs without exposing backend credentials to clients. Within this model, Zero Trust principles require that every request boundary be verified and trusted: no internal services are trusted by default, even if they are within the same organization. Metrics are proposed to quantify the performance of the mediation layer, including Authentication Mediation Success Rate (AMSR) to measure the correctness of the request result, Token Mediation Overhead Index (TMOI) to measure impact on transaction latency, and Credential Exposure Reduction Score (CERS) to measure reduction of credential surface area. Evaluation across five enterprise backend services shows an average AMSR of 98.8%, an average TMOI of 11.0%, and a CERS of 85.7%, demonstrating that CATMS delivers high accuracy and strong credential protection at acceptable performance cost. The proposed framework provides a scalable, interoperable foundation for enterprise IAM in microservices and multi-cloud environments.