## 3 Access Control Policy Combination Method for Data Fusion in Railway Traffic Systems
### Policy of TSABAC  
A TSABAC access policy has three main components [17]: a target, a conditionand an effect. The target defines a set of subjects, resources, and operations that the rule applies to; the condition specifies restrictions on the attributes in the target and refines the applicability of the rule; the effect is either permit, in which case we call the rule a permit rule, or deny, in which case we call it a deny rule. In multilayer rail transit systems, the subject refers to the active entities such as users and processes that request access, and \(SA=(sa_{1},sa_{2},\,\ldots,\,sa_{m})\) is the subject attribute set. The object refers to the passive entities in the information system that are being accessed, including data, devices, networks, etc., and \(OA=(oa_{1},\,\(\alpha a_{2}\), \(\ldots\), \(\alpha a_{n}\)) represents the object attribute set. The operation refers to the access request actions performed by the subject on the object, such as reading, writing, editing, deleting, copying, searching, and modifying. The condition represents dynamic factors independent of the subject and object, and plays an important role in access control decision-making, such as time, geographical location, and network performance, and \(CA=(\alpha a_{1}\), \(\alpha a_{2}\), \(\ldots\), \(\alpha a_{k})\) represents conditional attribute set. To characterize the dynamic authorization relationship between the subject and the object, the model of TSABAC policy is:  
\[pol=<SA,\ OA,\ CA,\ T,\ S,OP,eff> \tag{9}\]  
Meanwhile, to express a specific access request, attribute authorization items can be formally defined as:  
\[att=(SA,OA,CA,T,S,OP) \tag{10}\]  
If a request satisfies both the rule target and rule condition, the policy is applicable to the request and yields the decision specified by the effect element; otherwise, the policy is not applicable to the request and yields the decision not applicable. Thus, four-valued logic is used to describe the effect of an access request. Re \(\in\)\(\Sigma\) = {0(deny), 1(permit), \(\bot\)(not applicable), and \(\top\)(conflict)}. The essential difference between four-valued logic and classical two-value logic is whether \"there is information which supports \(att\)\" is equivalent to \"there is no information which opposes \(att\)\". This definition can intuitively represent the two states of information and the four states of results integration between the evaluation results [17]. If the attribute tuples in two attribute authorization items are exactly the same, the attribute authorization items are called compatible. Otherwise, the extended formation is proposed to maintain consistency in attribute authorization items. When it comes to synthesizing two or more attribute authorization items in the access control policy, if there is no corresponding attribute value for a certain entity attribute, we use \(\Delta\) to represent the null value. In the process of synthesis, this value is considered non-existent and does not participate in any calculations. Therefore, different policy calculations can be implemented by extending the attribute authorization items. For example, if we have two entity attribute authorization items \(att_{1}\) = {(level > 2), (T \(\geq\) 0.4)} and \(att_{2}\) = {(level > 3), (S \(\geq\) 0.8)}, the extended versions would be \(att^{\prime}\)1 = {(level > 2), (T\(\geq\) 0.4), \(\Delta_{1}\)} and \(att^{\prime}\)2 = {(level > 3), \(\Delta_{2}\), (S \(\geq\) 0.8)}.