信息系统中的访问控制技术研究

访问控制是信息系统安全的核心策略之一，它与信息加密、身份验证、安全审计、入侵检测等系统安全理论与技术有机结合，构成了信息系统中存储、处理和传输数据的安全基础设施。访问控制作为计算机信息保护中的重要环节，近年来得到了广泛的重视。文中讨论了自主访问控制、强制访问控制和基于角色的访问控制，给出了它们的形式化定义及基本规则，分析了它们各自的优缺点。经对基于角色的访问控制技术的讨论和分析，得出RBAC更加适合应用的需要。

Research on Access Control in Information System

Access control is one of the kernel policies of information system security, and it constitutes the security infrastructure used for saving, processing and transmitting data in information system with cryptography, authentication, auditing, intrusion detection etc. Access control is a very important aspect of the computer information protection, which has been greatly emphasized in recent years. In this paper, several main technologies, such as discretionary access control, mandatory access control, role-based access control, are introduced. The formal definition and some rules are given, then the advantage and disadvantage of each technology is analyzed. Role-based access control is discussed in detail,and prove that the RBAC adapts the application requirement evenmore.