Patent ID: 8635686

Claim:
An apparatus, comprising: a master processing module implemented in a machine accessible medium to process on a gateway; and a memory to store a policy database to be shared by the master processing module and a plurality of slave modules, the policy database including file system privilege rules and network interception policy rules associated by keys, each of the network interception policy rules providing policies that control connection requests to a requested system resource, each of the file system privilege rules limiting access to a connected system resource, and each slave module of the plurality of slave modules being assigned a key of the keys as its slave module operating system identifier such that the key simultaneously and uniquely identifies at least one file system privilege rule and at least one network interception policy rule to be used by the slave module to service requests distributed thereto, the master processing module configured to select an assigned slave module from the plurality of slave modules to service a request based on a request type of the request and a first key of the keys assigned to the assigned slave module as its slave module operating system identifier, the first key simultaneously and uniquely identifying the at least one network interception policy rule and the at least one file system privilege rule to be used by the assigned slave module, the assigned slave module configured to prevent the request from connecting to system resources targeted by the request using the at least one network interception policy rule identified by the first key, or to prevent the request from modifying at least a portion of the system resources connected by the request using the at least one file system privilege rule identified by the first key.