Objective

All information security technologies are designed to achieve certain security goals. The core of these technologies includes five security objectives: confidentiality, integrity, availability, controllability, and non-repudiation. 

Confidentiality refers to the prevention of unauthorized entities from accessing information. It is a characteristic inherent in the inception of information security and is also one of the main research topics in this field. More simply put, it means that unauthorized users cannot obtain sensitive information. For paper document information, we only need to protect the files from being accessed by unauthorized individuals. However, for information in computer and network environments, not only must unauthorized users be prevented from reading the information, but also authorized users must be prevented from transmitting the accessed information to unauthorized individuals, so as to avoid information leakage. 

Integrity refers to the prevention of unauthorized alteration of information. It is about safeguarding the original state of the information and ensuring its authenticity. If these pieces of information are deliberately modified, inserted, deleted, etc., resulting in false information, it will cause serious consequences. 

Availability refers to the ability of the authorized entity to obtain services promptly when information is needed. Availability is a new requirement for information security proposed during the information security protection stage, and it is also an essential information security requirement in the networked space. 

Controlability refers to the process of implementing secure monitoring and management over information and information systems, in order to prevent the unauthorized use of such information and systems. 

Non-repudiation refers to the property that in a network environment, neither party involved in the information exchange can deny the act of sending or receiving information during the exchange process. 

The confidentiality, integrity and availability of information security mainly emphasize the control over unauthorized entities. But how to control the improper behavior of authorized entities? The controllability and non-repudiation of information security precisely achieve effective supplementation to confidentiality, integrity and availability by controlling the authorized entities. It mainly emphasizes that authorized users can only conduct legal access within the authorized scope and their behaviors can be supervised and reviewed. 

In addition to the above five aspects of information security, there are also aspects such as auditability and authenticity of information security. The auditability of information security refers to the fact that the actors in the information system cannot deny their information processing actions. Compared with the determinability of behavior in the non-repudiation information exchange process, the meaning of auditability is broader. The visibility and authenticity of information security refer to the ability of the recipient of the information to determine the identity of the sender. It is also a concept related to non-repudiation. 

Principle 

In order to achieve the goal of information security, the application of various information security technologies must adhere to some basic principles. 

The principle of separation of powers and checks and balances. In an information system, all permissions should be appropriately divided, so that each authorized entity can only have a part of the permissions, enabling mutual restraint and supervision among them to jointly ensure the security of the information system. If an authorized entity is assigned too much permission without supervision and restraint, it implies potential risks such as "abuse of power" and "one person's word being the final word". 

Principle of Security Isolation. Isolation and control are the fundamental methods for achieving information security, and isolation is the basis for control. One of the basic strategies for information security is to separate the subject and object of information, and implement the access of the subject to the object under certain security policies and within the scope of controllability and security. 

Based on these fundamental principles, some additional implementation principles have been summarized during the production practice process. These principles are the concrete manifestations and extensions of the fundamental principles. They include: the overall protection principle, the principle of who is in charge is responsible, the hierarchical principle of moderate protection, the domain-based protection principle, the dynamic protection principle, the multi-level protection principle, the deep protection principle, and the information flow principle, etc.