Patent Document ID: 20130227639
Application ID: 13777789
Patent Flag: 0

Claim One:
1. A computer-implemented method for producing at least one Security Descriptor Definition Language, SDDL, rule from an eXtensible Access Control Markup Language, XACML, policy (P), wherein said at least one SDDL rule is enforceable for controlling access to one or more resources in a computer network, said method comprising: producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, based on the reverse query, the XACML policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2,. .. ); deriving variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 ,. .. ], j=1, 2,. .. ) satisfying the logic proposition; and creating at least one SDDL rule based on said variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 ,. .. ], j=1, 2,. .. ) satisfying the logic proposition.