# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 3 Implementation
### Map Policies to Rules
There are eight levels that are the source of IP, the destination of IP, the source of the port, the destination of the port, the protocol type, the time, the characteristic, and the action. See Formula (36):  
\[ \begin{split} Forest\_rule\{\\ Forest\_rule\ parent;\\ List<Forest\_rule>child\_list;\\ Union\{List<Interval>data\_list;\\ Enumerate\ action;\\ }\}list\_action;\\ \}.\end{split}  \tag{36}\]  
The policies can be mapped to the rules by Algorithm 3. The initialization of it also needs to be finished by Algorithm 2. It merges each policy tree in the policy file into the forest policy. In the process, the algorithm simultaneously merges the policies and detects conflicts. Each policy \(p\) in the list is regarded as a tree, so policies \(f\) can be considered as a forest. Both forest and trees are three-layer structures. The layers represent source domain, destination domain, and app, respectively. As for app nodes, they all contain an action field (\(BLACK/WHITE/SCOPE\)). The function of Algorithm 2 is to merge trees into a forest. ```
Input: Single policy \(p\), forest policies \(f\) Output: forest policies \(f\)
1 for\(i\) = 0; \(i\) < \(f.child\_list.size()\); \(i\)++do
2\(f\_root_{i}\)=\(f.child\_list.size()\); \(f\_root_{i}\)=\(f.child\_list.size()\); \(f\_node_{j}\)=\(f.root_{i}.child\_list.get()\); \(p\_node\)=\(p.child\_list.get(0)\); if\(f\_node_{j}\)==\(p\_node\)then
3 fork\(k\) = 0; \(k\) < \(p.node.child\_list.size()\); \(k\)++do
4\(p\_app_{k}\)=\(p.node.child\_list.get(k)\); for\(l\) = 0; \(l\) < \(f.node_{j}.child\_list.size()\); \(l\)++do
5\(f\_app_{l}\)=\(f.node_{j}.child\_list.get(l)\); if\(f\_app_{l}\)==\(p.app_{k}\)then
6 if\(f\_app_{l}.action==SCOPE\)then
7 if\(p.app_{k}.action==BLACK\) or WHITEthen
8\(f\_app_{k}.action\) = \(p.app_{l}.action\);
9
10
11 end if
12
13 end if
14
15 else
16 if\(f\_app_{l}.action!\) = SCOPEthen
17 if\(p.app_{k}.action!\) = SCOPEthen
18 throw \"conflict detection!\";
19
20 end if
21 if\(f\_app_{l}.action!\) = SCOPEthen
22\(f\_app_{k}.action=p.app_{l}.action\);
23
24 end if
25
26 end if
27
28 end if
29
30 end if
31
32 end if
33 return\(f\_root_{i}.child\_list.add(p\_node)\);
34
35 end if
36
37 end if
38 return\(f.child\_list.add(p)\);
```  
**Algorithm 2**Merge trees into forest  
Algorithm 2 is described precisely as follows:  
Travel through every tree in the forest and try to merge policy \(p\) into the tree. If it fails to merge policy \(p\) into any tree in the forest, just add policy \(p\) into \(f.child\_list\). The method of merging trees is as follows. First, compare the root node of policy \(p\) with that of the \(i\)-th tree in the forest, which are denoted as \(t\) and \(f\_root_{i}\), respectively. If they are different, policy \(p\) cannot be merged into the \(i\)-th tree. Try to merge it into another tree. If they are the same, compare their child nodes which are denoted as \(p\_node\) and \(f\_node\). If a child node of \(f\_root_{i}\) denoted as \(f\_node_{j}\) is the same as \(p\_node\), compare their child nodes which are denoted as \(f\_app\) and \(p\_app\), or add \(p\_node\) to \(f\_root_{i}.child\_list\). For each \(p\_app\), if there is no \(f\_app\) like it, add it to \(f\_node_{j}.child\_list\). If there is an \(f\_app\) denoted as \(\_app_{l}\) which is the same as \(p\_app_{k}\), compare their actions. If one is \(SCOPE\) and the other is \(BLACK\) or \(WHITE\), then \(f\_app_{k}.action=BLACK\) or \(WHITE\). If they are different and neither is \(SCOPE\), throw \"conflict detection!\". Algorithm 3 is described precisely as follows:  
In Algorithm 3, it maps forest policies \(f\), \(p\) into forest rules \(r\), \(t\). For each tree in the forest \(f\), \(p\), use the following method to turn it into a rule tree. As mentioned above, the trees of policy forest are three-layer structure, representing source domain, destination domain and app, respectively. Thus, given the root of the \(i\)-th tree, we can get the source domain, and further obtain the source IP address \(srcip_{i}\) by searching the set of relationships \(R_{mdr}\).