Patent ID: 8146134

Claim:
A method of implementing resource access control in a network comprising host computers (hosts) and network equipment allowing the hosts to communicate, comprising: defining a plurality of security zones, including a more secure zone and a less secure zone, and associating each of the hosts with a respective security zone of the plurality; defining a plurality of roles, and associating one or more of the hosts with each of the roles, wherein any host can be associated with multiple of the plurality of roles, each role indicative at least of a common service provided by each of the hosts in that role; receiving a plurality of access requests, each access request including a respective first role of the plurality and a respective second role of the plurality; interpreting each of the access requests as requesting that accessing hosts associated with the respective first role have access to the service provided by accessed hosts associated with the respective second role; formulating, for each accessed host associated with any second role included in the plurality of access requests, a respective access control policy defining which accessing hosts of the network may access said accessed host, the policy allowing access by any given accessing host associated with one of said plurality zones at least as secure as said accessed host, and said given accessing host is associated with a first role identified in an access request that includes a second role associated with said accessed host; and distributing the formulated access control policies to the respective accessed hosts of the second role.