Patent ID: 7673323

Claim:
A system for maintaining security in a distributed computing environment, comprising: (1) a policy manager, coupled to a network, including a database for storing a security policy including a plurality of rules that control user access to applications; and a policy distributor, coupled to the database, for distributing the plurality of rules through the network, wherein the policy manager comprises a processor; (2) a security engine located on a client coupled to the network and stored on a computer readable storage medium, said security engine storing a set of the plurality of rules constituting a local customized security policy received through the network from the policy distributor, and enforcing the local customized security policy with respect to an application at the client wherein enforcing the local customized security policy includes evaluating an access request by matching it to one or more of the plurality of rules of the local customized security policy and granting or denying access to the application based on the evaluation; and (3) the application, coupled to the security engine, wherein the security engine guards access to the particular application to which said security engine is coupled, each separate application in the system being guarded by a different access authorization service such that separate applications do not share authorization services; and wherein the security policy is updated by recording a series of incremental changes to the security policy, determining which of said incremental changes are applicable to said security engine, computing an accumulated delta that reflects the series of incremental changes applicable to said security engine and sending the accumulated delta to the security engine from the policy manager such that the security engine uses the accumulated delta to update the local customized security policy, wherein a previously enforced version of the local customized security policy is reconstructed by generating an accumulated reversing delta at the policy manager and sending the accumulated reversing delta to the security engine, wherein the accumulated reversing delta comprises a sequence of incremental changes in a reverse order.