Scalable firewall policy management platform

A computer network system with distributed access control, comprising:

• a plurality of security client computers, the client computers located in multiple physical locations, each having a connection to a network and configured for implementing a respective network access control program for controlling network access to that client computer based on a policy comprising one or more Access Control Rules (ACRs), the client computers collectively implementing a plurality of services, wherein some of the services require information from others of the services;
• a non-transitory computer readable storage media storing a plurality of subnet group definitions, wherein each subnet group definition may include a plurality of subnets, and each subnet may include a plurality of the client computers;
• the storage media storing security zone information comprising respective associations of client computers to security zones comprising more secure zones and less secure zones;
• the storage media storing roles information comprising role definitions associated with one or more subnets;
• an access rule formation engine configured to receive access control policy requests, the requests identifying at least a first role definition for accessed hosts and a second role definition for accessing hosts, and one or more specified ports, to access the security zone information to determine whether each client computer associated with each second role definition is associated with a security zone at least as secure as the client computers associated with the first role definition, to produce logical access control rules for each client computer specified in the first role definitions, to merge rules containing redundant information, and to output resulting non-redundant rules, wherein the access control rules comprise one or more fields for specifying the accessing hosts, the accessed hosts and the specified ports on which connections can be initiated;
• and
• a deployment manager to receive the non-redundant rules, to format the rules into client computer specific policies, and permit access by each client computer to its respective policy.

A method of implementing resource access control in a distributed network, comprising:

• for a network of hosts collectively spanning multiple physical locations and organized into multiple subnets, defining a plurality of security zones, including a more secure and a less secure zone, and associating each of the hosts with a respective security zone of the plurality;
• defining a plurality of roles, and associating one or more hosts with each of the roles, wherein any host can be associated with multiple of the plurality of roles, each role indicative at least of a common service provided by each of the hosts in that role;
• receiving an access request that accessing hosts in a first role of the plurality of roles have permission to access a service provided by accessed hosts of a second role of the plurality;
• formulating, for each accessed host of the second role, an access control policy comprehending both the request that accessing hosts of the first role have permission to access the service provided by accessed hosts of the second role, and the respective security zones associated with each of the accessing hosts of the first role, the respective access control policies restricting its accessed host from accepting connections from any accessing host of the first role that is associated with a less secure security zone than that accessing host;
• and
• distributing the formulated respective access control policies to the accessed hosts of the second role.

A method of administering access control in a distributed network, comprising:

• receiving a plurality of access requests, each including logical host identifier information for accessing hosts and accessed hosts;
• forming a respective access control policy for each accessed host comprising components of network address information for accessing hosts specified in each of the plurality of access requests corresponding to that accessed host, the components representing consolidated network address information formed by consolidating the logical information in the plurality of access requests into fewer components;
• formulating, for each accessed host associated with any second role included in a plurality of access requests, a respective access control policy defining which accessing hosts of the network may access said accessed host, the policy allowing access by any given accessing host associated with one of said plurality zones at least as secure as said accessed host, and said given accessing host is associate with a first role identified in an access request that includes a second role associated with said accessed host;
• and
• providing for distribution of the formulated access control policies to the respective accessed hosts of the second role, for controlling access to the accessed host at said accessed host.

A controlled access distributed heterogeneous network system, comprising:

• a plurality of serving hosts, each serving host operable to serve data corresponding to applications, the serving hosts interconnected in a network distributed among a plurality of physical locations, having a plurality of subnets;
• a plurality of served hosts, each served host requiring access to data corresponding to one or more of the applications, the served hosts comprising hosts considered part of the network and hosts accessing the serving hosts through the Internet;
• a user interface for receiving access control requirements about which of the served hosts require access to data on which of the serving hosts;
• logic for collecting the access control definitions, and forming respective access control policies for each of the serving hosts, wherein an access rule formation engine configured to receive access control policy requests, the requests identifying at least a first role definition for serving hosts and a second role definition for served hosts, to access the security zone information to determine whether each client computer associated with each second role definition is associated with a security zone at least as secure as the client computers associated with the first role definition, to produce logical access control rules for each client computer specified in the first role definitions;
• and
• each of the serving hosts is operable to obtain their respective access control policies and use them in determining which of the served hosts can initiate communication with that respective host, and for what type of communication.