## 1 Introduction  
With the continuous expansion of the rail transit network and the continuous improvement of rail transportation services in China, the spatial and temporal distances within the metropolitan area have been greatly reduced, which has effectively promoted the transformation and upgrading of regional industries and accelerated the cultivation, development, and growth of urban clusters [1]. At the same time, since the rise of urban clusters has entered the stage of high quality development, the needs for transportation services are presenting new characteristics, which bring both challenges and opportunities for the development of rail transit. China has been promoting the development of a multilayer rail transit system through top-level design, explicitly stating the goal of building \"modern metropolitan areas on rail\" and carrying out the \"four-network integration\" of trunk railways, intercity railways, suburban railways, and urban rail transit. Therefore, in the context of gradually integrating and coordinating multiple rail transit modes after the road network reaches a certain scale, the concept of synergetic regional rail transportation and services has emerged [2]. Aiming to leverage the advantages of a regional rail transit network and fully tap into its transport capacity, the multilayer rail transit integration raises standards of service, provides strong support for urban cluster construction, and promotes the intelligence of rail transit with the metropolitan area expanding. Currently, data of the four rail transit networks are often stored and used separately, resulting in data silos where the data cannot be smoothly connected or interact with each other. To achieve true \"four-network integration\", data integration is of utmost importance [3]. It involves breaking down the barriers between the four rail networks and enabling data flow across different entities. However, such cross-entity, cross-responsibility, and cross-domain data interactions can bring about severe security issues within enterprises and may even lead to the leakage of personal privacy or even significant national data. From the point view of the SRIDE Threat Model, the impropriate access to information resources may lead to tampering and information disclosure. For example, modification of automatic train supervision system data and configuration files may cause service degradation or termination, resulting in impact on security functions; collecting by means of maintenance tools (port scanning, network packet capture tools, etc.) or additional hardware (eavesdropping, monitoring of transmitted signals) may also cause severe data disclosure. Since access control is one of the most effective technical means to prevent the above issues, an effective framework for multilayer rail transit data interactions is important to protect the privacy of individuals and railway business resources [4]. However, due to the enormity and complexity of the rail transit systems, current structure of control over data exchange processes is insufficient. Generally, each rail system has its own access control scheme, so as to protect the data flow within the system. Thus, the key point of cross-domain interaction is to combine different policy schemes and realize fine-grained access according to the principle of least privilege. To achieve the global access control, it first requires the universal evaluation on the security characteristics of an access request, then different policy sets should be integrated with a combination algorithm. In the case of incompatible problems due to various models, conflict resolution is ought to be executed. There has been some research on access control strategies in rail transit systems. A mandatory access control system for application security was proposed for gateway devices in railway information systems [5].