Patent ID: 8966576
Filing Date: 2015-02-24
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for producing at least one Security Descriptor Definition Language, SDDL, rule from an eXtensible Access Control Markup Language, XACML, policy (P), said method comprising: providing, on a non-transitory computer readable media, a XACML policy (P) that, when implemented by a processor, is configured to control access to one or more resources in a computer network; feeding the XACML policy (P) to a transformation engine, the transformation engine including software that, when executed by a processor, creates the at least one SDDL rule; producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, by the transformation engine based on the reverse query, the XACML policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v deriving, by the transformation engine, variable assignments (RC creating, by the transformation engine, the at least one SDDL rule based on said variable assignments (RC loading the at least one SDDL rule onto a non-transitory computer readable media of an SDDL system; and controlling access to the one or more resources in the computer network using the at least one SDDL rule.