Patent Document ID: 9646164
Application ID: 14748903

Base Claim:
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, said method comprising the steps of: i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing a partial request (r partial ), from the subset (R) of access requests; iii) reducing the ABAC policy in accordance with the partial request; iv) caching the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (vi, i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value; vi) deriving all variable assignments (cj=[v1=xj1, v2=xj2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.

---

Claim 12:
12. The method of claim 1 , wherein step iii includes: determining an implicit reference defined by a value of one of said extracted attributes together with the ABAC policy; and fetching, in accordance with this implicit reference, at least one attribute value from a remote source.