## 5 Application and Analysis
### Access Control Policy Composition in Multilayer Rail Transit System  
After illustrating the application of the access control framework, we will discuss the specific operations involved in policy composition. For the four security domains, trunk railway, intercity railway, suburban railway, and urban rail transit, we assume their contents of \(Pt\), \(Pi\), \(Ps\), and \(Pu\) to be shown in Table 4.  
Results of policy composition for the four security domains are analyzed as follows:  
1. The results of policy composition between trunk rail and intercity railway  
Figure 6: A policy regulating access to multilayer rail transit systems. Considering that _Pt_ and _Pi_ are compatible policies, the possible composition results of policies _Pt_ and _Pi_ are as follows:  
1. If trunk railway agrees that \"access not allowed by intercity railway should not be accessed\", the composition result is \(pt\wedge pi=pi\). 2. If intercity railway agrees with \"access allowed by trunk railway should be accessed \", the composition result is \(pt\lor pi=pt\). 3. If both trunk railway and intercity railway take a step back, the composition result could be realized by _fw_ (_Pt_, _Pi_), where _fw_ is the mean operator, and is expressed as: \[\left. \begin{array}{l}f\omega(Pt,Pi)=\\ sa_{1}.level>5>,obj.level\leq 2,\ obj.quality\leq 0.75,\\ link=\ secure,\ date<2022.12.30,T>0.8,S<2.5,\ op=read\end{array} \right\}\]  
Assuming a subject \(Q\) in a trunk railway system, whose current trust level is 0.9 with a secure level exceeding 5, requests to read the target resource in intercity railway with a security level of 2 and a sensitivity level of 2.3. The current link state is secure, and the access time is 15 December 2022. The attribute authorization item is \(ATT_{Q}=\) {<5>, <2, 0.7>, <secure, 2022.12.15>, <0.9>, <2.3>, <read>}. According to Table 4, \(ATT_{Q}\in f\omega(Pt,Pi)\) satisfies the policy composition result, so \(Q\) is authorized to read the target resource in this case. Since the trust level of the subject and sensitivity of the object are dynamically updated, when the access subject interacts with the resource target, if the received feedback indicates a decrease in trust level, it implies that the access subject was deceptive during the previous interaction, leading to restricted authority. Since a decrease in trust level may indicate a malicious node, the currently granted permission should be revoked and reauthorized to protect the security of the resource target. As for the sensitivity, if the object is confronted with growth in visits, the sensitivity may increase and access authorization for this object should be more careful. The policy composition result between trunk railway and intercity railway demonstrates that the union and intersection operators can perform traditional set operations, and the average value function can be implemented using modal operators. This allows modal operators to handle more complex policy composition scenarios. What is more, the trust and sensitivity attribute can be used to periodically monitor the behavior of access control subjects, preventing illegal activities and ensuring the security of resource targets. The policy composition result between trunk railway and suburban railway. Note that the policies _Pt_ and _Ps_ are incompatible due to the fact that _Ps_ does not consider the data quality attribute. The compatible results are as follows:  
1. If trunk railway agrees that \"access allowed by suburban railway is permitted\", the composition result is \(Pt\lor Ps\)\(\sim\)\(obj.quality\)\(\sim\)0.7 = _Ps_. 2. If suburban railway agrees that \"access not allowed by trunk railway should not be accessed\". the composition result is \(Pt\wedge Ps\)\(\sim\)\(obj.quality\)\(\leq\)0.7 = _Pt_ It demonstrates that \"con operators can transform incompatible policies during policy composition and support constraint operators [8]. In TSABAC, the trust level attribute of the access subject and sensitivity of the target object are both crucial.