Abstract: Based on the research status of access control for Web services and according to the shortcoming in current models,a TRBAC-based dynamic multilevel access control model for Web services was proposed．The model defines some concepts and gives the formal representation and constraint rules．To achieve fine-grained permission,the model introduces services and services attributes,and designs the mechanism of three levels access control．The concepts of Role Actor and Task Manager were presented．The connotation of role constraint and task constraint were extended and defined strictly．The model combines temporal constraint,task context,task state and SSOD principle to describe dynamic permission,and improves the security of Web services and the mechanism of access control for Web services．The preliminary result of the model applied in the condition security system of some defense industry enterprise is good.

Key words: TRBAC,Dynamic multilevel,Web services,Access control