1. A computer-implemented method in an attribute-based access control policy (ABAC) transformer of transforming an ABAC policy to facilitate evaluation in a policy decision point (PDP) of an access request against the ABAC policy, wherein the PDP is communicatively coupled over a communication link to at least one remote attribute source (RAS), and wherein the ABAC policy comprises hierarchically ordered functional expressions, one or more of the functional expressions having at least one other functional expression and/or at least one attribute as a subordinate, the value of each attribute being either locally available at the PDP or remotely available in response to a query submitted from the PDP to one of said at least one RAS, the method comprising: a processor in the ABAC policy transformer identifying, in the ABAC policy, a first functional expression comprising at least one mathematical operator; the processor in the ABAC policy transformer forming, on the basis of a sub-hierarchy having said first functional expression as its hierarch, a remote query intended for a first RAS in such manner that output data from execution of the remote query correspond to the outcome of an evaluation of the first functional expression; and the processor in the ABAC policy transformer transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression representing the remote query.
1. A computer-implemented method in an attribute-based access control policy (ABAC) transformer of transforming an ABAC policy to facilitate evaluation in a policy decision point (PDP) of an access request against the ABAC policy, wherein the PDP is communicatively coupled over a communication link to at least one remote attribute source (RAS), and wherein the ABAC policy comprises hierarchically ordered functional expressions, one or more of the functional expressions having at least one other functional expression and/or at least one attribute as a subordinate, the value of each attribute being either locally available at the PDP or remotely available in response to a query submitted from the PDP to one of said at least one RAS, the method comprising: a processor in the ABAC policy transformer identifying, in the ABAC policy, a first functional expression comprising at least one mathematical operator; the processor in the ABAC policy transformer forming, on the basis of a sub-hierarchy having said first functional expression as its hierarch, a remote query intended for a first RAS in such manner that output data from execution of the remote query correspond to the outcome of an evaluation of the first functional expression; and the processor in the ABAC policy transformer transforming the ABAC policy by replacing the sub-hierarchy by a second functional expression representing the remote query. 12. The method of claim 1 , wherein at least one of the attributes referenced by the remotely executable sub-hierarchy is a multiple-valued attribute.