1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforced to control access to one or more resources in a computer network, said method comprising the steps of: i) receiving a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing a partial request (r partial ), from the subset (R) of access requests; iii) reducing the ABAC policy in accordance with the partial request; iv) caching the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (vi, i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value; vi) deriving all variable assignments (cj=[v1=xj1, v2=xj2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) controlling access to the one or more resources in the computer network based on the access decision resulting from the evaluation of the ABAC policy.
5. The method of claim 1 , wherein step iv includes caching the simplified policy (P′) represented with a tree structure, wherein step v includes, whenever a sub-tree in the tree structure represents a Boolean expression but at least one of its children evaluates to a non-Boolean value, replacing said whole sub-tree by a variable (vi).