Abstract:Reflective middleware opens up the implementation details of middleware platform and applications at runtime for improving the adaptability of middleware-based systems. However, such openness brings new challenges to access control of the middleware-based systems. Some users can access the system via reflective entities, which sometimes cannot be protected by access control mechanisms of traditional middleware. To deliver high adaptability securely, reflective middleware should be equipped with proper access control mechanisms for potential access control holes induced by reflection. One reason of integrating these mechanisms in reflective middleware is that one goal of reflective middleware is to equip applications with reflection capabilities as transparent as possible. This paper studies how to design a reflective J2EE middleware - PKUAS with access control in mind. At first, a computation model of reflective system is built to identify all possible access control points induced by reflection. Then a set of access control mechanisms, including the wrapper of MBeans and a hierarchy of Java class loaders, are equipped for controlling the identified access control points. These mechanisms together with J2EE access control mechanism form the access control framework for PKUAS. The paper evaluates the security and the performance overheads of the framework in quality and quantity.

An Access Control Framework for Reflective J2EE Application Server

An Access Control Framework for Reflective Middleware

An improved HTTP session management model in distributed environment

Research on security extensions based on Java 2 security architecture

Research and Advance of Reflective Middleware

Semantic-Aware Access Control for Grid Application

PKUAS: An Architecture-Based Reflective Component Operating Platform

Towards Autonomic Computing Middleware via Reflection.

Recom: A Reflective Architecture Of Middleware

Research and Implementation of RBAC-based Security Architecture of J2EE

Enforcing Enterprise-wide Policies over Standard Client-Server Interactions.

Access Control Service for Enterprise Applications

STUDY OF APPLICATION SERVER-WEB-BASED MIDDLEWARE SYSTEM INTEGRATED FRAMEWORK

A Generalized Framework for Access Control Based on J2EE

Access Control for OSGi-Based Reconfigurable RFID Middleware

An Approach for Generation of J2EE Access Control Configurations from Requirements Specification.

A Performance Tradeoff-Enabled Permission Management Framework for Reflective Middleware

A Reflective Framework for Authentication in Grid Computing Environments

Research and Implement of the Security Interface of a Message-oriented Middleware

Access Control Model Based on JAAS Enterprise

A New Grid Security Framework with Dynamic Access Control