Reflective middleware opens up the implementation details of middleware platform and applications at runtime to improve the adaptability of traditional middleware.However

such openness brings new threats to security of middleware platform and applications.This paper studies how to protect a reflective J2EE application server with a set of access control mechanisms.At first

a computation model of reflective middleware is built up and illustrates that the access control of reflective middleware is far more com plex and difficult to implement than that of traditional middleware.With the model

all potential access control points are identified while only some of the points require access control mechanisms.It reveals that the complexity and cost of the access control framework are mainly related to the concrete implementation of reflective mechanisms.At last

the framework is implemented mainly by reusing the access control mechanisms existing in traditional middleware and the performance is evaluated.