# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 1 Introduction
### Related Work  
Due to the importance of fine-grained multi-domain interconnection security control to high-traffic network platforms and devices, various methods have been used to solve the problems related to multi-domain interconnection, conflict detection, rule transformation, and fine-grained control. In this section, we'll review existing technologies and describe the differences from FMNICF. Regarding multi-domain interconnection management, [PERSON] et al. [16] proposed a network orchestrator based on ODENOS (object-defined network allocation system) for orchestrating multi-layer and multi-domain networks. The network orchestrator can dynamically provide end-to-end paths according to requests of network services. [PERSON] et al. [17] proposed a controller cluster-based interconnecting framework based on load balance, which can be implemented through two levels of controller coordination, i.e., inter-cluster and intra-cluster interconnection. However, they have not carefully demonstrated and considered the security issues among domains. For the map from policies to rules, [PERSON] et al. [18] proposed a policy generation method for a control system in open environments. The main idea is to formalize the description of the control policy step by step, associate each stage of the policy generation in an automatic way, and reduce the difficulty of the description, generation, and final application of the policy. [PERSON] et al. [19] proposed RuleBender, a rule set transformation technique that encodes decision tree search structures into the transformed rule set, which in turn can be traversed significantly faster. However, they have not demonstrated the security of rule map in detail, and there are more ways to utilize the traversal speed of rule set. Aiming at rule conflict detection, [PERSON] et al. [20] proposed a security policy analysis framework Brew based on OpenDaylight SDN controller, which identified and solved cross-layer conflicts by using global priority ranking technology for convection rules in a decentralized environment. [PERSON] et al. [21] proposed an algorithm for dynamic detection of both intra and inter conflicts of an IPsec security policy. The proposed algorithm is based on a simple and comprehensive mechanism that uses Boolean functions to classify and identify. The resolution of intra-policy conflict is also integrated into the algorithm. However, there is no detailed discussion of the semantic security of the rules. For fine-grained management control, [PERSON] et al. [22] proposed a fine-grained two-factor authentication (2 FA) access control system for web-based cloud computing services, which requires a user key and a lightweight security device to complete fine-grained access control of the system and enhance the security of the system. [PERSON] et al. [23] proposed a fine-grained access control method for the cloud resources, and the basic idea is to use XACML as an access control language and optimize policies by data fragmentation and policy refinement algorithms. The XACML language can determine whether users can access web resources or not. [PERSON] et al. [24] proposed a new fine-grained multi-source measurement platform DCART. DCART is a distributed platform running over an operational network (RENATER, the French research and education network); it gathers data from several sources.