Association of target groups with policy groups

摘要

Method and apparatus for assigning policies [210] which are rules [210] that govern the use of or access to network [120] services. Each rule [210] defines conditions that when evaluated true trigger actions to allow or deny the service. Techniques are disclosed which provide for explicit, flexible, and centralized assignment of policy [210] to targets [110] which are specified network services. These techniques include explicitly associating a policy [210] with a network resource or process, grouping policy [210] related processes, grouping related targets [110], associating groups of targets [300] with groups of policies [400], mapping a user name contained in a policy [210] to an associated network address such as an Internet Protocol (IP) address, and providing dynamically mapped policy identified user and host names with associated network addresses, such as IP addresses, to client processes.