Patent Document ID: 10158641
Application ID: 15589296

Base Claim:
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforceable to control access to one or more resources in a computer network, said method performed by a processing device and comprising the steps of: i) receiving by the processing device a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing by the processing device a partial request (r partial ) from the subset (R) of access requests; iii) reducing by the processing device the ABAC policy in accordance with the partial request; iv) caching by the processing device the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating by the processing device the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value; vi) deriving by the processing device all variable assignments (c j =[v 1 =x j1 , v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing by the processing device the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) determining by the processing device, from each variable assignment processed in step vii, a set of potential access requests for which the ABAC policy would evaluate to the given decision (d) and where each request belongs to subset R.

---

Claim 9:
9. The method of claim 1 , wherein step vii includes assessing, for each request (r) in the subset (R) of requests, whether it corresponds to any of the variable assignments satisfying the logic expression; and, if it does, extracting this access request.