Based on the through study of the problem to keep security in architectural refinement in MLS system,a refinement function and several refinement rules were presented to refine the architecture.The refinement function refined the security domain into several sub-domains.The relation between sub-domain and other security domains and the relation between sub-domains were limited by the refinement rules.Four theorems were given to prove that noninterference remains in the architecture after refinement.
