Abstract:Based on the through study of the problem to keep security in architectural refinement in MLS system
a refinement function and several refinement rules were presented to refine the architecture.The refinement function refined the security domain into several sub-domains.The relation between sub-domain and other security domains and the relation between sub-domains were limited by the refinement rules.Four theorems were given to prove that noninterference remains in the architecture after refinement.