# FMNSCF: Fine-Grained Multi-Domain Network Interconnection Security Control Framework
## 3 Implementation
### Map Policies to Rules
If the _listbody_ is \(\varepsilon\), translate \(\varepsilon\) as follows (all other parts of the signed \({}^{*}\) are the same). When there is only one configuration, from Formula (12), we have: \[config :: ID\ ``-\"\ ID\ ``,\"\ application\ ``;\".\] From script (34), we get the domain set \(\{A,B,C\}\) and the application set \(\{app_{1},app_{2},app_{3}\}\). For example, the domain of \(A\) corresponds to IP interval [10.0.0.1-10.0.0.3 10.0.0.5, 10.0.0.7]. Similarly, the IP interval of the domain \(B\) is [6,8-9]. For the language element \(A-B\) of the security policy script, it can be translated into the source IP interval, and the destination IP interval of the language element in the security rules script respectively. It can be written as [1-3,5,7,10],[6,8-9]. Similarly, \(a-c\) can be translated into [1-3,5,7,10],[10,12]. 4. Ignoring the control characters \",\" and \";\", we consider the second half of the formula \"\(application\)\". We mark these \(APPs\) as \(app_{i}\). By Definition 3, for each \(ID\), it can obtain the protocol type, destination port, time, and characteristics via relational operation expression \(\pi_{PROTOCOL,PORT,TIME,REG}(\sigma_{APP=app_{i}}(R_{mdr}))\). The source port is used for its own side to receive messages and is randomly assigned with no restrictions. Covert this relational structure into a tree structure in order. The application element is translated into protocol type interval, source port interval, destination port interval and time interval characteristics in security rules. By searching for application name in scripts, we can get a security rule subtree with an application from the multi-domain network. For example, \(app_{1}\) uses TCP, UDP and ICMP protocols. Among them, TCP uses port 80 as the destination port, and UDP uses port 90 as the destination port. The usage time of app1 is limited to 5:00 a.m.-11:00 a.m. per day. The algorithm is illustrated by the following Figure 6:
5. In steps 3 and 4, multiple tree merges are involved. Our approach is the same merge, different splits. Combining the whitelist tree of step 2, the security policy language is finally translated into the security rules script. In this process, the subtrees of the step 2 are connected, and the corresponding actions are added to the final rule part in combination with the black and white list action of the whitelist tree. In the implementation, the packet filter module will call the mutual exclusion of the two operations through the synchronization variable _lock_ when loading the forest rules or filtering the packet. Algorithm 1 is described precisely as follows:  
Figure 6: Transform from relationship to application match tree. ```
Input: Packet \(t\), Forest rules \(rt\) Output: Action \(r\)
1 initialization: Synchronous \(lock\), int \(status\);
2 P(\(lock\));
3 if\(status==LOAD\_RULES\)then
4 parse_policies(\(rt\));
5 merge trees into forest (*Algorithm 2*);
6 map policies to rules (*Algorithm 3*);
7 convert absolute Time to relative time (*Algorithm 4*);
8
9 else
10 if\(status==FILTER\_PACKET\)then
11 update time interval (*Algorithm 5*);
12 V(\(lock\));
13 return \(r\) = filtering_packet(\(t\));
14
15 end if
16
17 end for
18 V(\(lock\));
19 return NOACTION;
```  
**Algorithm 1**Fine-grained packet filter  
We define a type named _Forest_policy_ whose type can be seen in Formula (35):  
\[ \begin{split} Forest\_policy\{\\ Forest\_policy\ parent;\\ List<Forest\_policy>child\_list;\\ Union\{List<Interval>data\_list;\\ Enumerate\ action;\\ \}list\_action;\\ \},\end{split}  \tag{35}\]  
where _parent_ is the parent of this level, and _child_list_ is its children. _child_action_ is the data of the node. There are four levels of the forest which has been built. They are the source of the domain, the destination of the domain, the application, and the action of the forest policy, respectively. Corresponding to _Forest_policy_, we also define _Forest_rule_.