访问控制技术现状及展望  

The Retrospect and Prospect of Access Control Technology

作　　者：罗霄峰[1] 王文贤[2,3] 罗万伯[3] 

机构地区：[1]四川大学锦江学院,四川成都610065 [2]四川大学网络空间安全研究院,四川成都610065 [3]四川大学计算机学院,四川成都610065

出　　处：《信息网络安全》2016年第12期19-27,共9页Netinfo Security

基　　金：国家科技支撑计划[2012BAH18B05]

摘　　要：访问控制是信息安全的关键技术之一,它依赖于其他安全服务并与这些服务共存于信息系统中,从而保障信息的安全。为了有助于访问控制技术研究、发展及推广应用,文章在对访问控制技术原理及发展历程研究的基础上,介绍了当前实际应用的主流访问控制技术,如自主访问控制、强制访问控制和基于角色的访问控制,并探讨了访问控制技术的发展方向,包括基于属性和策略的访问控制、风险自适应的访问控制和新一代访问控制。针对访问控制技术的发展和实际应用情况,提出应该在加强有关基础研究的同时,开展符合中国国情的访问控制标准化、规范化研究和建设。Access control is one of the key technologies of information security. It relies on other security services and coexists with these services in the information system, so as to ensure the security of information. In order to help research, development and adoption of access control technologies, based on study of access control technology and its development course, some meaningful access control technologies in practical applications are introduced, like discretionary access control, mandatory access control and role-based access control. Then some directions of access control technology development are discussed, including attribute and policy-based access control, risk-adaptable access control and next generation access control. For the development and practical application of access control, we should strengthen the basic research on the same time, in line with the situation in China to carry out access control standardization, deployment, application research and construction.

关 键 词：访问控制 访问控制策略 风险自适应 安全策略 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]