Patent ID: 7882540

Claim:
A method, in a data processing system, for configuring a data flow filtering device that filters data flows to a plurality of protected client computers that are protected from an external network by the data flow filtering device, comprising: the data processing system establishing, in default configuration information of the data flow filtering device, one or more portions of configuration information for the data flow filtering device that are modifiable by a protected client computer in a plurality of protected client computers and one or more portions of configuration information for the data flow filtering device that are not modifiable by the protected client computer; the data processing system receiving a request from the protected client computer to modify a portion of configuration information for the data flow filtering device that was previously established as modifiable by the protected client computer; in response to receiving the request, the data processing system modifying a configuration profile of the protected client computer to incorporate the modification to the portion of the configuration information, wherein the configuration profile is used by the data flow filtering device to filter a data flow to or from the protected client computer; the data processing system determining if there is a conflict between a security policy/rule in the modified configuration profile and a security policy/rule in the default configuration information of the data flow filtering device; and in response to determining the conflict, the data processing system determining whether to use the security policy/rule in the modified configuration policy or the security policy/rule in the default configuration information of the data flow filtering device based on a security policy/rule conflict resolution policy; wherein each protected client computer of the plurality of protected client computers has a respective configuration profile such that the each protected client computer has its own customizable configuration profile that does not affect how the data flow filtering device operates with regard to other protected client computers of the plurality of protected client computers.