Patent ID: 8763074

Claim:
A method of managing access control rules in a network, comprising host computers (hosts) and network equipment, in view of changes to the network configuration comprising: defining a plurality of roles each indicative at least one service provided by a host computer, wherein the host computers (hosts) are assigned to a plurality of security zones, including a more secure zone and a less secure zone, and associating each of the hosts with a respective security zone of the plurality; receiving, by a computing device, a role update request to change the network configuration within one of the plurality of security zones; comparing, by the computing device, the role update request regarding the change to the network configuration to a role information in a database; detecting, by the computing device, if an access control policy of one of the plurality of security zones needs to change based on the comparing, wherein the access control policy allows access to an accessed host by any accessing host associated with one of the plurality of security zones as least as secure as the accessed host; defining, by the computing device, a plurality of changes to one or more access control policies based on the detecting; queuing, by the computing device, the plurality of changes; determining whether to implement the queued change or to reject the queued change; updating an access control policy based on the determining; and distributing the updated access control policy to the respective accessed host.