Patent ID: 9223992
Filing Date: 2015-12-29
Classification: G06F

Abstract:
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, said method comprising the steps of: i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a set (R) of two or more access requests to the ABAC policy, each of which comprises one or more attributes appearing in the ABAC policy and explicit values assigned to these; ii) extracting attributes to which all access requests in the set (R) assign identical values by studying each of the attributes appearing in the access requests in the set (R) to discover whether equal or different values are assigned to them, wherein an attribute is extracted if all requests assign equal values to the attribute; iii) reducing the ABAC policy at least by substituting said equal values for each of the extracted attributes; iv) caching the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v vi) deriving all variable assignments (c vii) extracting, based on the variable assignments thus derived, all access requests from the set (R) for which the ABAC policy (P) yields the given decision (d); and viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.