Patent ID: 8484695

Claim:
A method for network access control, comprising: at a control device, receiving a first network communication from a first application running on a client device communicatively connected to the control device, the network communication being destined for a network communicatively connected to the control device; determining whether the client device is authorized to access the network based on at least one interface specific rule; if the client device is not authorized to access the network, applying a first global rule; if the client device is authorized to access the network, applying a second global rule; receiving a second network communication from the first application or a second application running on the client device; processing the second network communication according to a plurality of stages, including a client discrimination stage and a user specific rule stage; at the client discrimination stage: extracting information associated with the client device from the second network communication; and associating the second network communication with user specific traffic control rules and user specific firewall rules; and at the user specific rule stage: accessing the user specific traffic control rules and the user specific firewall rules based on the extracted information associated with the client device; and applying the user specific traffic control rules and the user specific firewall rules to the second network communication as governed by user specific provisioning rules.