Design and implementation of a RESTful API for access control based on the OrBAC model in an organization. Case: Main Department of the Treasury and State Accounting (DGTCP) in the Republic of Benin

Mouale Moutouama N’dahBienvenue, Sambienou Kouwimmitou Caleb, Kouame Gnabro Yannick

Information systems security is particularly important today as public and private companies are in constant reorganization, expansion or enhancement of their information system in order to be more efficient. For example, the head office of task (DGTCP), a strategic public administration in the Benin government’s policy, is engaged in a process of restructuring it to meet functional requirements in order to improve the quality of the offered services. This reorganization has a significant impact on the information system. Indeed, the procedures have become more complex and ensuring IT system security has become a very important issue. In this dissertation, we proposed implementation of an access control system based on the Organization Based Access Control (OrBAC) model to strengthen the security of this (government) organization. This system will consider the organization’s security policy and will be implemented as a RESTFull API, allowing existing or future business applications to access the organization’s resources depending on the employees’ rights and context. Simulation tests have been performed to ensure that the system is working as intended.

Keywords:Access control, OrBAC, Web API, security policy, security, DGTCP