Enforcing Role-Based Access Controls in Software Systems with an Agent Based Service Oriented Approach

Abstract

of new software systems. However, constant innovation of information technology and ever-changing requirements Access Control is often used to make restrictions to the relegate more and more existing software to legacy status. resources in a system so that these resources can only be Organisations are in fear of replacing their legacy systems. accessed by those who have the corresponding privilege.A major reason why organisations fear the replacement of Role-Based Access Controls (RBAC) model introduces legacy information systems is that those legacy systems roles into Access Control so that the privilege is assigned are enormously valuable assets. Having stood the test of to role and Access Control can be managed easily by time and evolved, they provide the most accurate defining the role of the users and inheritance structure of statement of current business practices. Legacy systems, the roles. Although the RBAC model has been well then, are not an issue that will simply be given up and this accepted, it turns out to have some problems in applying raises additional questions that must be addressed: Can the RBAC to an existing system: an existing system is RBAC be used to enforce the high-level security and generally not organised in roles; it is very hard to add the privacy policies for a legacy system? How can a legacy Access Control functions to each module of an existing system be integrated to RBAC? How can a promising system. In this paper, an agent-based service oriented RBAC portal solution be offered if two organisations are approach that helps existing systems be migrated to merged? The growing demands of Business to Business RBAC for software evolution is proposed. The collaborations, for dynamically integrating heterogeneous architecture and working flow of the approach are systems with minimum cost, have fuelled this challenge. presented and an example showing how to use the In this paper, research on how to apply RBAC model to proposed framework and methodology is illustrated. enhance the safety of an existing system is explored. Section 2 surveys some basic concepts discussed in this