在许多大型计算机信息系统、管理系统及通讯系统中,全体用户的数据安全关系可以抽象为一个通用模型,即安全层次系统。本文首先给出了安全层次系统的形式定义,然后讨论了利用它实现数据约束共享的重要途径——密码技术,并提出一个密钥生成与分配的通用机制。接着依次介绍了基于该通用机制的两类典型算法:自顶向下和自下而上密钥生成算法,并分析了它们的安全性与效率。 In many large computer information systems, management systems and communication systems, the data security relationship of all users can be abstracted as a general model, that is, the security hierarchy system. First of all, this paper gives the formal definition of security hierarchy system, and then discusses the use of it to achieve an important way to share data constraints - cryptography, and proposes a common mechanism for key generation and distribution. Then two types of typical algorithms based on this general mechanism are introduced in turn: top-down and bottom-up key generation algorithms, and their security and efficiency are analyzed.