## 5 Application and Analysis
### Access Control Policy Composition in Multilayer Rail Transit System
They reflect the subject's credibility and help protect the security of the resource target. The current trust and sensitivity value participates in the calculation of the next authorization request, serving as the basis for the next authorization. The policy composition result between trunk railway and urban rail transit  
Note that the policies _Pt_ and _Pu_ are incompatible, due to the fact that _Pu_ does not consider the subject quality attribute. The compatible results are achieved by negotiation as follows. Based on the policy merging principles agreed upon by trunk railway and urban rail transit, which include trunk railway agreeing with urban rail transit in terms of subjectsand effective dates, avoiding the leakage of high-security-level information in terms of object security levels and link security, and taking the average value in terms of data quality attribute, the merged result can be obtained as follows:  
\[ \begin{array}{l}f\varpi(Pt,Pu)=\\ \left\{\begin{array}{l}sub.level>5,sub.quality\geq 3,\ obj.level\leq 2,\ obj. quality\leq 0.75,\\ link=secure,\ date<2022.12.31,T>0.8,S<3,\ op=read\end{array}\right\}\end{array} \]  
D. The policy composition result among trunk railway, intercity railway, suburban railway, and urban rail transit  
In the first scenario, the common part of the access control policies of trunk railway, intercity railway, suburban railway, and urban rail transit is taken, which requires that the attribute authorization items must be satisfied simultaneously to grant the corresponding access permissions to the authorized subjects. The composited policy is:  
\[ \begin{array}{l}Pt\wedge Pi\wedge Ps\wedge Pu\\ =\left\{\begin{array}{l}sub.level>5,\ sub.quality\geq 3,\ obj.level\leq 2,\ obj. quality\leq 0.7,\\ link=secure,\ date<2022.12.30,T>0.8,S<2,\ op=read\end{array}\right\}\end{array} \]  
In the second scenario, we assume \(TV_{(3,4)}\) (\(Pt,\ Pi,\ Pm,\ Pu\)), where the trunk railway is where the resource is located, so the policy composition must include \(Pt\). Therefore, the policy composition is:  
\[ \begin{array}{l}TV_{(2,3)}(Pi,Ps,Pu)\wedge Pt\\ =\left\{\begin{array}{l}sub.level>5,\ sub.quality\geq 3,\ obj.level\leq 2,\ obj. quality\leq 0.7,\\ link=secure,\ date<2022.12.30,T>0.8,S<3,\ op=read\end{array}\right\}\end{array} \]  
It should be noted that although the composition algebra provides operators to describe the combination of policies, the choice of operators depends on the specific application scenario. The selection of composition operator involves multi-party security policy constraints, which is related to specific application scenarios. As described in this section, the choice of synthesis operator is not the same among organizations. For example, in scenario A, trunk railway chooses the \(\wedge\) operator in case (1) and chooses the \(\vee\) operator in case (2); in scenario B, urban rail transit may choose different synthesis operators. Since the parties may choose different synthesis operators, different synthesis results may be obtained. Therefore, the evaluation of the synthesis results of each party is helpful to the selection of the final synthesis operator. The quality of the composite result is generally evaluated according to the negotiation result (i.e., the common protection requirements for the aggregated resources agreed by all parties).