1. A computer-implemented method for producing at least one Security Descriptor Definition Language (SDDL) rule from an attribute-based access control (ABAC) policy (P), said method comprising: providing, on a non-transitory computer readable media, a ABAC policy (P) that, when implemented by a processor, is configured to control access to one or more resources in a computer network; feeding the ABAC policy (P) to a transformation engine, the transformation engine including software that, when executed by a processor, creates the at least one SDDL rule; producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, by the transformation engine based on the reverse query, the ABAC policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ); deriving, by the transformation engine, variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; creating, by the transformation engine, the at least one SDDL rule based on said variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition, wherein the at least one SDDL rule, when implemented by a processor, is configured to control access to the one or more resources in a computer network; loading the at least one SDDL rule onto a non-transitory computer readable media of an SDDL system; and controlling access to the one or more resources in the computer network using the at least one SDDL rule.
1. A computer-implemented method for producing at least one Security Descriptor Definition Language (SDDL) rule from an attribute-based access control (ABAC) policy (P), said method comprising: providing, on a non-transitory computer readable media, a ABAC policy (P) that, when implemented by a processor, is configured to control access to one or more resources in a computer network; feeding the ABAC policy (P) to a transformation engine, the transformation engine including software that, when executed by a processor, creates the at least one SDDL rule; producing a reverse query indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests; translating, by the transformation engine based on the reverse query, the ABAC policy (P) and the given decision (d) into a satisfiable logic proposition in Boolean variables (v i , i=1, 2, . . . ); deriving, by the transformation engine, variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition; creating, by the transformation engine, the at least one SDDL rule based on said variable assignments (RC j =[ARC j1 : v 1 =x j1 , ARC j2 : v 2 =x j2 , . . . ], j=1, 2, . . . ) satisfying the logic proposition, wherein the at least one SDDL rule, when implemented by a processor, is configured to control access to the one or more resources in a computer network; loading the at least one SDDL rule onto a non-transitory computer readable media of an SDDL system; and controlling access to the one or more resources in the computer network using the at least one SDDL rule. 8. The method of claim 1 , wherein the given decision (d) is permit access.