# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 3 Implementation
### Map Policies to Rules
The destination IP address \(dstip_{j}\) can be obtained similarly. Then, add it to \(srcip_{i}.child\_list\). From the app, we can get the information of protocol, source port, destination port, time, reg and action. Add them to the \(child\_list\) of their previous element respectively and make \(reg\) the leaf node of the rule tree. Leaf nodes of rule trees contain an action field which is the same as the app node of the original policy tree. ```
Input: Forest policies \(fp\) Output: Forest rules \(rt\)
1 initialization: \(fp.\)init(), \(rt.\)init();
2 for\(i=0\); \(i<fp.child\_list.size()\); \(i++\)do
3\(root=fp.child\_list.\)get(\(i\));
4\(srcip_{i}=\pi_{IP}(\sigma_{D=root}R_{mdr})\);
5 for\(j=0\); \(j<root.child\_list.size()\); \(j++\)do
6\(node=root.child\_list.\)get(\(j\));
7\(dstip_{j}=\pi_{IP}(\sigma_{D=node}R_{mdr})\);
8\(srcip_{i}.child\_list.\)add(\(destip_{j}\));
9 for\(k=0\); \(k<node.child\_list.size()\); \(k++\)do
10\(app=node.child\_list.\)get(\(k\));
11\(protocol_{k}=\pi_{PROTOCOC}(\sigma_{APP=app}R_{mdr})\); \(dstip_{j}.child\_list.\)add(\(protocol_{k}\));
12\(srcport_{k}=[0\)-\(65535]\);
13\(protocol_{k}.child\_list.\)add(\(srcport_{k}\));
14\(dstport_{k}=\pi_{PORT}(\sigma_{APP=app}R_{mdr})\);
15\(srcport_{k}.child\_list.\)add(\(destport_{k}\));
16\(time_{k}=\pi_{TIME}(\sigma_{APP=app}R_{mdr})\);
17\(dstport_{k}.child\_list.\)add(\(time_{k}\));
18\(reg_{k}=\pi_{REG}(\sigma_{APP=app}R_{mdr})\);
19\(time_{k}.child\_list.\)add(\(reg_{k}\));
20\(leaf_{k}=app.action\);
21\(reg_{k}.action=leaf_{k}\);
22
23 end for
24
25 end for
26\(rt.list.\)add(\(srcip_{i}\));
27
28 end for
```  
**Algorithm 3**Map policies to rules  
Time coding is divided into absolute time and relative time. Time elements such as year, month, day, week, hour, minute and second are used to encode relative time. Absolute time is encoded in seconds that have elapsed since 1 January 1970. The relative time of the base structure from low to high is 60, 60, 24, 7, 31, and 12. Of these, number 7 means that the week is unlimited. Number 31 means days are unlimited. Number 12 means month is unlimited. For the time format \"\(yyyy-mm-ddhh:MM:ss\)\",  
\[ \begin{split}\text{intToRe}(mm,dd,w,hh,MM,ss)&=ss \times 1+MM\times 60+hh\times 60\times 60+w\times 24\times 60\times 60\\ +dd\times 7\times 24\times 60\times 60+mm\times 31\times 7\times 24 \times 60\times 60,\end{split}  \tag{37}\]  
where the week \(w\) can be calculated using the library function provided by \"time.h\". For example, from 9:00 a.m. to 10:00 a.m. every day, the code of relative time is Formulas (38) and (39):  
\[287485200=\text{intToRe}(12,31,7,9,0,0), \tag{38}\]  
\[287488800=\text{intToRe}(12,31,7,10,0,0). \tag{39}\]  
If it's 0:00 a.m. to 0:00 a.m. per day, this means that there's no limit about time. For \"\(\text{intToAb}(\cdot)\)\", we first reverse calculate \([mm,dd,w,hh,mm,ss]=\text{intToRe}^{-1}(\cdot)\), obtain the current absolute time via \"\(time(\cdot)\)\", then assign the rest to the absolute time structure, and finally calculate the absolute time value through the library function \"\(mktime(\cdot)\)\". Algorithm 4 is described precisely as follows. In Algorithm 4, given the relative time interval which begins with \(stamp_{1}\) and ends with \(stamp_{2}\), the corresponding absolute time interval can be obtained. Time stamp is an integer and can be converted into relative time or absolute time through function \"\(\text{intToRe}(\cdot)\)\" or \"\(\text{intToAb}(\cdot)\)\". Using function \"\(\text{intToRe}^{-1}(\cdot)\)\" for \(stamp_{1}\) and \(stamp_{2}\), we can get six pairs of numbers representing the restrictions on month, date, day of week, hour, minute, and second. Placing restrictions on month means the period from one month to one month every year and no restriction implies January to December. Similarly, for date, day of week, hour, minute, and second, whether to make restrictions or not is optional.