Keywords formal model,confidentiality policy,integrity policy,least privilege principle,noninterference theory,information flow,capability,model hierarchy;

• 形式模型;机密性策略;完整性策略;极小特权原理;无干扰理论;信息流;权能;模型层次结构;