1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforceable to control access to one or more resources in a computer network, said method performed by a processing device and comprising the steps of: i) receiving by the processing device a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing by the processing device a partial request (r partial ) from the subset (R) of access requests; iii) reducing by the processing device the ABAC policy in accordance with the partial request; iv) caching by the processing device the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating by the processing device the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value; vi) deriving by the processing device all variable assignments (c j =[v 1 =x j1 , v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing by the processing device the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) determining by the processing device, from each variable assignment processed in step vii, a set of potential access requests for which the ABAC policy would evaluate to the given decision (d) and where each request belongs to subset R.
1. A computer-implemented method for real-time evaluation of a reverse query to an attribute-based access control (ABAC) policy (P) comprising functional expressions dependent on attributes, wherein the ABAC policy is evaluable for an access request if the access request assigns a value to at least one of said attributes, wherein an access decision resulting from said evaluation is enforceable to control access to one or more resources in a computer network, said method performed by a processing device and comprising the steps of: i) receiving by the processing device a reverse query indicating a given access decision (d), which is one of permit access and deny access, and further indicating a subset (R) of two or more access requests to the ABAC policy, wherein the subset (R) is defined by constraints over the set of possible access requests; ii) constructing by the processing device a partial request (r partial ) from the subset (R) of access requests; iii) reducing by the processing device the ABAC policy in accordance with the partial request; iv) caching by the processing device the ABAC policy after said reducing, as a simplified policy (P′) comprising at least one functional expression dependent on an attribute; v) translating by the processing device the cached simplified policy (P′) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ), including replacing, by a Boolean variable, any Boolean expression in the policy representing a comparison of an attribute and a fixed value; vi) deriving by the processing device all variable assignments (c j =[v 1 =x j1 , v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; vii) processing by the processing device the variable assignments satisfying the logic proposition on the basis of a correlation between each Boolean variable and the comparison which it replaces; and viii) determining by the processing device, from each variable assignment processed in step vii, a set of potential access requests for which the ABAC policy would evaluate to the given decision (d) and where each request belongs to subset R. 5. The method of claim 1 , wherein step iv includes caching the simplified policy (P′) represented with a tree structure, wherein step v includes, whenever a sub-tree in the tree structure represents a Boolean expression but at least one of its children evaluates to a non-Boolean value, replacing the whole sub-tree by a variable (v i ).