PROVISIONING ACCESS CONTROL USING SDDL ON THE BASIS OF AN XACML POLICY

摘要

A method is disclosed, and a corresponding data carrier and policy converter, for producing at least one Security Descriptor Definition Language, SDDL, rule from an eXtensible Access Control Markup Language, XACML, policy (P), wherein said at least one SDDL rule is enforceable for controlling access to one or more resources in a computer network. A reverse query is produced indicating a given decision (d), which is one of permit access and deny access, and a set (R) of admissible access requests. Based on the reverse query, the XACML policy (P) and the given decision (d) are translated into a satisfiable logic proposition in Boolean variables (v_i, i=1, 2, . . . ) From said ROBDD, variable assignments (RC_j=[ARC_j1:v₁=x_j1, ARC_j2:v₂=x_j2, . . . ], j=1, 2, . . . ) satisfying the logic proposition are derived and at least one SDDL rule is created based on said variable assignments (RC_j=[ARC_j1:v₁=x_j1, ARC_j2:v₂=x_j2, . . . ], j=1, 2, . . . ) satisfying the logic proposition.