Patent ID: 7853687

Claim:
An access control list generation and validation system that protects network computers of a communication network, the system comprising: a memory and a processor that executes security functions; a tables generation unit stored in the memory that creates a flows table, a roles definition table and an enforcement points table; a tables management unit stored in the memory that creates an interaction table from said flows table, said roles definition table, and network configuration information while validating data contained in said flows table, said roles definition table and said enforcement points table and validating accuracy of the interaction table against the network configuration information before deployment of access control lists; an access control rules generation unit stored in the memory that generates generic access control rules for each enforcement point listed in said enforcement points table using said interaction table and said enforcement points table; and a rules translation and deployment unit stored in the memory that translates said generic access control rules into a format specific to each respective enforcement point and deploys access control rules having said specific format to said respective enforcement points.