# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 1 Introduction  
In recent years, the complex network environment represented by the integrated air-ground network [1, 2], IOT [3, 4], and the complex private network [5, 6] has developed rapidly, which has brought great convenience to people's daily life and also generated a lot of security related problems, especially those dealing with data security. Therefore, as an advanced technology to protect the legitimate access to data, the research on access control technology in complex network environment is particularly necessary. The integrated air-ground network is multiple domain networks with a set of shared communication infrastructures. The differences among the securities of the multi-domain [7] require the communication in the application scenarios to have the complex adaptive ability. This adaptability includes the following aspects, that is, in the network, the business type/feature/security level changes with the spatiotemporal characteristics of multi-domain and multi-user. The integrated air-ground network can form physical or virtual network domains due to different user types, business types, and security levels. In order to ensure the security of the cross-domain communication, a security gateway needs to be set among the domains. We call this gateway the security interconnection gateway. The security interconnection gateway is a device that can connect the multi-domain networksaccording to the security policies. It is set up in a domain interconnection node of isolated physical or virtual networks. The complex network environment has the characteristics of dynamic device access, heterogeneous network segment, and frequent information flow across domains. For example, the integrated air-ground network is composed of heterogeneous networks such as space-based backbone networks, space-based access networks, ground-based node networks, ground Internet, and mobile communication networks. In this network, a large number of ground users have frequent dynamic access, and the real-time ground information obtained by the space-based access network flows to ground nodes via the space-based backbone network. These characteristics bring many new requirements for access control technology in a complex network environment. 1. fine-grained control: the complex network environment has a huge amount of information, and different users have different permissions to use the information, so that the coarse-grained control will bring lots of security problems. 2. policy tracking: data information flows frequently between networks. If the corresponding control policy does not follow the data information ontology to the new network, users will lose control of the data. 3. policy semantic normalization: data information flows across different networks, and inconsistencies in policy languages between networks may cause errors in policy transformation between networks. Existing packet filtering techniques [8; 9; 10; 11; 12] were initially used in the network to provide security protection. The access control function of the network packet is implemented on the router, and the security function of it is separated. The working principle of the program of this technology is that in a interconnected network device, it works by loading some special instructions such as allowing or prohibiting packet transfer from specific source address, destination address, TCP terminal number, etc. Through the corresponding instructions for series of equipment inspections of packets, it can restrict dangerous packets in and out of the internal network. The advantages of the control are obvious. It can keep high transparency to users, and high work efficiency. However, he also has serious shortcomings. For example, the manager can't fully control information flow in the network. It only can control the most basic security maintenance. In the face of the high technical content of attack without resistance, it is difficult to upgrade maintenance, and so can't maintain the security of users.