System and method for evaluating a reverse query
First Claim
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, said method comprising the steps of:
- i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests;
ii) constructing a partial request (rpartial), from the subset (R) of access requests;
iii) reducing the ABAC policy in accordance with the partial request;
iv) caching the ABAC policy after said reducing, as a simplified policy (P′
) comprising at least one functional expression dependent on an attribute;
v) translating the cached simplified policy (P′
) and the given decision (d) into a satisfiable logic proposition in Boolean variables (vi, i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value;
vi) deriving all variable assignments (cj=[v1=xj1, v2=xj2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition;
vii) processing the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and
viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.
2 Assignments
0 Petitions
Accused Products
Abstract
Real-time techniques for determining all access requests to an attribute-based access control policy which evaluate to a given decision, “permit” or “deny”. The policy is enforced to control access to one or more resources in a computer network. In one embodiment, a method includes: (i) receiving a reverse query and a set of admissible access requests, each of which includes one or more attributes in the policy and values of these; (ii) extracting attributes to which all access requests in the set assign identical values; (iii) reducing the ABAC policy by substituting values for the extracted attributes; (iv) caching the policy as a simplified policy; (v) translating the simplified policy and the given decision into a satisfiable logic proposition; (vi) deriving all solutions satisfying the proposition; and (vi) extracting, based on the solutions, all access requests from the set for which the policy yields the given decision.
30 Citations
18 Claims
-
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, said method comprising the steps of:
-
i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing a partial request (rpartial), from the subset (R) of access requests; iii) reducing the ABAC policy in accordance with the partial request; iv) caching the ABAC policy after said reducing, as a simplified policy (P′
) comprising at least one functional expression dependent on an attribute;v) translating the cached simplified policy (P′
) and the given decision (d) into a satisfiable logic proposition in Boolean variables (vi, i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value;vi) deriving all variable assignments (cj=[v1=xj1, v2=xj2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 15, 16, 17, 18)
-
-
13. A non-transitory computer-readable storage medium storing computer-executable instructions for performing a method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P), comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, the method comprising:
-
i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing a partial request (rpartial) from the subset (R) of access requests; iii) reducing the ABAC policy in accordance with the partial request; iv) caching the ABAC policy after said reducing, as a simplified policy (P′
) comprising at least one functional expression dependent on an attribute;v) translating the cached simplified policy (P′
) and the given decision (d) into a satisfiable logic proposition in Boolean variables (vi, i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value;vi) deriving all variable assignments (cj=[v1=xj1, v2=xj2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.
-
-
14. A computer system configured for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network,
wherein the reverse query indicates a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, each of which comprises one or more attributes appearing in the ABAC policy and explicit values assigned to these, wherein the subset (R) is defined by constraints over the set of possible access requests, said computer system comprising: -
a data memory operable to store one or more ABAC policies; a partial request generation means operable to construct, based on said subset (R) of access requests, a partial request (rpartial); a policy decision partial evaluation means connected to said partial request generation means and to the data memory, and operable to reduce evaluate said ABAC policy (P) in accordance with said partial request (rpartial), thereby yielding a simplified policy (P′
);a translation means, connected to said policy decision means and operable to translate said simplified policy (P′
), said subset of access requests, and said given decision (d) into a satisfiable logic proposition (F) in Boolean variables (vi, i=1, 2, . . . ), wherein the translation means is configured to replace, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value;an analyzing means, connected to said translation means and operable to analyze said satisfiable propositional logic proposition formula (F) in order to determine a sequence ([c1, . . . , ck]) of conditions over requests, each condition defining a variable assignment (cj=[v1=Xj1, v2=Xj2, . . . ], j=1, 2, . . . ); a conversion means connected to said analyzing means, and operable to process said sequence ([c1, . . . , ck]) of conditions satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and a controller controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.
-
Specification