Method and apparatus for centralized policy programming and distributive policy enforcement

摘要

A method and apparatus for centralized policy programming and distributive policy enforcement is described. A method comprises centrally maintaining a plurality of policy definitions for one or more subscribers, generating policy configurations using the plurality of policy definitions, each of the policy configurations being specific to one of the plurality of policy definitions, and disseminating the policy configurations to the appropriate ones of the subscribers' networks.

主权项

1. A method comprising:
centrally maintaining a plurality of policy definitions for one or more subscribers; generating policy configurations using the plurality of policy definitions, each of the policy configurations being specific to one of the plurality of policy definitions, wherein each of the policy configurations defines a required software configuration; disseminating the policy configurations to one or more host devices within the subscribers' networks; determining at each of said one or more host devices if that host device complies with the required software configuration defined by the appropriate one of the policy configurations, wherein said determining includes scanning a registry of that host device; transmitting by each of said one or more host devices a configuration status indicating whether it complies with the appropriate one of the policy configurations; and restricting at a choke point external access of all packets of those host devices within the subscribers' networks that do not have the appropriate one of the policy configurations and those host devices whose configuration status is not consistent with the appropriate one of the policy configurations, wherein the choke point is a device separate from the host devices.