## 5 Application and Analysis
### Application of Cecess Control Architecture in Multilayer Rail Transit Systems  
In multilayer rail transit system, there are generally four security domains, namely the trunk railway, urban railway, intercity railway, and urban metro. This article assumes that each security domain is based on its own access control policy model according to the security requirements. It then uses a unified set of attributes to describe policies and performs policy composition with user-defined operators to accomplish secure cross-domain access. The access control policies for each of these systems are as follows: trunk railway--_Pt_, suburban railway--_Ps_, intercity railway--_Pi_, and urban rail transit--_Pu_. Cross-domain access is achieved through policy composition between logical security domains. By synthesizing policies from different security domains, information resources can be shared across domains with uniform access control management.  
Assuming a scenario where a hub station aims to achieve seamless passenger transfers between trunk railway and urban rail transit. They need to share passenger information and provide passenger guidance within the station.  
First, let us take a look at the access control architecture for data sharing in multi-domain transportation systems at a macro level [20], as shown in Figure 6. In an urban rail transit system, production management system (PMS) and production auxiliary systems (PAS) are related to the passenger transport as the first-level subclass of business, and the overall policy is represented as \(P_{\mathit{l}\mathit{l}\mathit{l}\mathit{R}}=P_{\mathit{P}\mathit{P}\mathit{S} }\lor P_{\mathit{P}\mathit{S}}\). PAS has two s-level subclass information systems, i.e., auto fare collection (APC) system and passenger information system (PIS). AFC provides passenger travel information, including the passenger's onboard and offboard time, travel distance, fare, and other relevant information. The PIS system utilizes these data to calculate estimated arrival times, train operation status, which can be displayed to passengers through displays at stations and inside train cabins, on-board broadcasting, mobile applications, and websites. The ticketing internet platform (TIP) uses these data to update ticket availability, prices, and seat selection information for users to purchase tickets online. Therefore, the policy of PAS and PMS are expressed as \(P_{PAS}=P_{AFC}\lor P_{PIS}\), \(P_{PMS}=P_{TIP}\).  
While in trunk railway, the information systems associated with passenger transport are the ticket reservation system (TRS), passenger transport marketing decision-support system (PTDS), passenger service systems (PSS), and passenger transport management system (PTMS). The first three of these belong to the business subclass of passenger transport marketing (PTM), and the last one is part of transportation production organization (TPO). Since TRS has a higher hierarchy, the three parts of PTM have different hierarchical definitions, we assume that access to any TRS resource is forbidden to users blacklisted for interaction of rules (e.g., honor code). Therefore, we can write \(P_{PTM}=P_{PTDS}\lor P_{PSS}\lor P_{TRS}[blacklisted(s)]\) and \(P_{TR}=P_{PTM}\lor P_{TPO}\).