1. A computer-implemented method for producing at least one Security Descriptor Definition Language (SDDL) rule from an attribute-based access control (ABAC) policy (P), said method comprising: providing, on a non-transitory computer readable media, a ABAC policy (P) that, when implemented by a processor, is configured to control access to one or more resources in a computer network; feeding the ABAC policy (P) to a transformation engine, the transformation engine including software that, when executed by a processor, creates the at least one SDDL rule; producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, by the transformation engine based on the reverse query, the ABAC policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ); deriving, by the transformation engine, variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; creating, by the transformation engine, the at least one SDDL rule based on said variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition, wherein the at least one SDDL rule, when implemented by a processor, is configured to control access to the one or more resources in a computer network; loading the at least one SDDL rule onto a non-transitory computer readable media of an SDDL system; and controlling access to the one or more resources in the computer network using the at least one SDDL rule.
1. A computer-implemented method for producing at least one Security Descriptor Definition Language (SDDL) rule from an attribute-based access control (ABAC) policy (P), said method comprising: providing, on a non-transitory computer readable media, a ABAC policy (P) that, when implemented by a processor, is configured to control access to one or more resources in a computer network; feeding the ABAC policy (P) to a transformation engine, the transformation engine including software that, when executed by a processor, creates the at least one SDDL rule; producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, by the transformation engine based on the reverse query, the ABAC policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ); deriving, by the transformation engine, variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; creating, by the transformation engine, the at least one SDDL rule based on said variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition, wherein the at least one SDDL rule, when implemented by a processor, is configured to control access to the one or more resources in a computer network; loading the at least one SDDL rule onto a non-transitory computer readable media of an SDDL system; and controlling access to the one or more resources in the computer network using the at least one SDDL rule. 7. The method of claim 1 , wherein the set (R) of admissible access requests is a subset of the set (R tot ) of all admissible access requests, wherein each of the set (R) comprises one or more attributes appearing in the ABAC policy (P) and explicit values assigned to these, wherein the translation comprises: extracting attributes to which all access requests in the set (R) assign identical values; reducing the ABAC policy (P) at least by substituting values for the extracted attributes; caching the policy as a simplified policy (P′) after said reducing; translating the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ).