访问控制是一种很流行的信息保护机制,被广泛应用在信息系统中。十多年来,在这个领域已取得了很多成就。传统的访问控制已经被更加灵活强大的系统代替了,如基于角色的访问控制(RBAC)和灵活授权框架(FAF)。但是,在访问控制系统中,对系统管理员的绝对信赖一直是对信息安全的潜在威胁。为了克服这个威胁,分等级的加密被发展作为访问控制的替补方法。通过使用分等级的加密,信息系统中的所有信息被加密:由低层安全类加密的数据可以被高层的安全类解密。文章描述了基于数据和基于密钥的两种加密方法实现加密的访问控制。 Access control is a very popular information protection mechanism and is widely used in information systems. For more than a decade, many achievements have been made in this area. Traditional access control has been replaced by more flexible and powerful systems such as RBAC and FAF. However, in the access control system, the absolute trust of system administrators has been a potential threat to information security. To overcome this threat, hierarchical encryption was developed as a replacement for access control. By using hierarchical encryption, all information in the information system is encrypted: data encrypted by the lower-level security classes can be decrypted by higher-level security classes. The article describes an encryption-based access control based on both data and key-based encryption methods.