Patent ID: 8037519

Claim:
An apparatus comprising: a processor; and a memory comprising computer program code, the memory and computer program code configured to, with the processor, cause the apparatus to at least: receive a captured traffic unit intended for a network service, the captured traffic unit being one into which incoming traffic has been assembled based on a filter, from a list of one or more filters, describing which incoming traffic to capture and how to assemble the respective incoming traffic into the captured traffic unit; determine whether to allow the captured traffic unit to pass to one or more applications configured to implement the respective network service based on a passlet and a service mapping document for the respective network service, the passlet comprising one or more access permissions to a particular user for accessing the respective network service, or for accessing a device hosting the respective network service, and the service mapping document describing how to map one or more user-level permissions to one or more corresponding system-level actions; and cause instruction of a firewall to allow the captured traffic unit to pass to the respective one or more applications or to reject the captured traffic unit based on the determination.