# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 5 Performance  
The operation interface of the three procedure in the framework FMNICF is shown as follows:  
Figure 6(a) shows the configuration of a security policy on a web browser. The newly added security policy is saved in the database, and then the user can see it in the list. Figure 6(b) shows the deployment of security rules to the gateway through a web browser. While clicking the \"Distribute\" button, the system automatically converts security policies into security rules and deploys them to the gateway. Figure 6(c) shows the gateway loading security rules sent by the visual management system into the gateway through the security rules loader. Thus, the interconnected security gateway can filter fine-grained packets. We test the performance of three processes of the framework FMNICF. Since instructions are distributed by socket communication, the selection of operating system version does not affect FMNICF deployment. The test hardware environment, software environment and running speed under different configurations are given below:  
Table 1 shows the interconnected security gateway and the hardware environment of the visual management system. Interconnection security gateway, controlled by the visual management system, can accept or drop the packets passing through the network according to the instructions sent by the system. We use software \"iPerf3\" [26] as the packet sending tool. It simulates communication scenarios in the network. Table 2 shows the software environment of each state during the rule life cycle management. In the policy transfer phase, a database is required to store security policies, security rule data, and other management information. The data caching software in the web background improves the speed of data query in the system. Web service programs rely on JVM and rapid development framework spring. Fine-grained web management requires support from Shiro components. In the front-end, JavaScript provides rich support of the running script. In the phase of rule loading and packet filtering, the network modules in the kernel are used to provide support. After setting up the running environment, we can test the three processes in the framework FMNISCF. The first step is to write the policy configuration file. Transform policies into rules through the map. The following is the rate at which rule profiles are generated under different semantic environments in a multi-domain network. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**CPU** & **DDR4** & **OS** & **Test Unit** \\ \hline Intel(R) Xeon(R) & 128 G & Centos 7 & Policy translation \\ E5-2670 0 2.60 GHz & & & \\ Intel(R) Xeon(R) & 4 G & Ubuntu 14 & Rule loading \\ E3-1220 V2 3.10 GHz & & & Packet filter \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The Relation between test unit and running environment of hardware. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Software** & **Version** & **Test Unit** \\ \hline database & MySQL 5.0 & Policy translation \\ in-memory data & redis 4.0 & Policy translation \\ structure store & & \\ JVM & JDK1.8.0 & Policy translation \\ web framework & spring MVC 4.2 & Policy translation \\ persistence framework & mybatis 4.2 & Policy translation \\ Java security framework & Apache Shiro 1.2.5 & Policy translation \\ JavaScript library & JQuery 1.8.3 & Policy translation \\ netfilter & linux kernel & Rule loading \\  & 3.10.0-862.el7.x86.64 & Packet filter \\ iPerf3 & iperf-3.1.3 & Packet sending \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The relation between test unit and running environment of FMNISCF. Figure 7: Operation interface. (**a**) map from policy to rule and distribution; (**b**) add policy configuration; (**c**) packet filter execution. In Figure 8, the time of generating security rules increases linearly with the number of policies.