Abstract: A remote client terminal sends a request for a resource controlled by a host. The host responds by providing a reference to a policy discovery script. The policy discovery script controls the client terminal to make a test resource request to a policy service domain. A policy service executes a policy decision for the test resource request in accordance with any policy existent for the remote client terminal. The policy service transmits an indication of any deny decision to the remote client terminal. The policy discovery script processes the indication of the deny decision to output an indication of policy existent for the remote client terminal. The indication of existent policy can be outputted to the host, to a user agent at the client terminal, or to the user, so as to facilitate content modification or replacement or to inform the user of the policy.

Abstract: A policy service enforces network policy for clients and servers of a computer network. The servers are accessible to the clients by way of hostnames and network addresses. Hostnames are stored in association with network addresses and update information. The update information indicates a priority with which to update a particular network address of a particular host. Such updates can be made using forward domain name system (DNS) resolutions. A subset of the hosts is prioritized for update based on the update information. A predictive process can be used to define the prioritized subset of hosts. The network addresses of the prioritized subset of hosts can then be updated before other network addresses of other hosts are updated. The association of hostnames and network addresses can be converted into a routing table, which can be loaded onto a router of the network.

Abstract: Requests for remote network resources can be denied by a policy service by redirecting a requesting user agent to an authorization portal. The authorization portal can authenticate the user agent and redirect the user agent to the originally requested resource with a token. The policy service can be configured to detect the token, and redirect the requesting user agent to the resource with a cookie. The policy service can be configured to reference such cookies when applying policy. Accordingly, an authenticated user agent can be allowed to access the remote network resource and resources at the same host/domain by virtue of the cookie and without additional authentication.

Abstract: A remote client terminal sends a request for a resource controlled by a host. The host responds by providing a reference to a policy discovery script. The policy discovery script controls the client terminal to make a test resource request to a policy service domain. A policy service executes a policy decision for the test resource request in accordance with any policy existent for the remote client terminal. The policy service transmits an indication of any deny decision to the remote client terminal. The policy discovery script processes the indication of the deny decision to output an indication of policy existent for the remote client terminal. The indication of existent policy can be outputted to the host, to a user agent at the client terminal, or to the user, so as to facilitate content modification or replacement or to inform the user of the policy.

Abstract: A policy service logging system includes one or more servers connected by a network. The one or more servers are configured to provide a graph structure having a plurality of nodes. Each node is in communication with at least one other node. The graph structure is configured to process log entries of network resource requests subject to policy implemented by a policy service. As log entries flow through the graph structure, the nodes perform operations on the log entries.

Abstract: A policy service enforces network policy for clients and servers of a computer network. The servers are accessible to the clients by way of hostnames and network addresses. Hostnames are stored in association with network addresses and update information. The update information indicates a priority with which to update a particular network address of a particular host. Such updates can be made using forward domain name system (DNS) resolutions. A subset of the hosts is prioritized for update based on the update information. A predictive process can be used to define the prioritized subset of hosts. The network addresses of the prioritized subset of hosts can then be updated before other network addresses of other hosts are updated. The association of hostnames and network addresses can be converted into a routing table, which can be loaded onto a router of the network.

Abstract: Requests for remote network resources can be denied by a policy service by redirecting a requesting user agent to an authorization portal. The authorization portal can authenticate the user agent and redirect the user agent to the originally requested resource with a token. The policy service can be configured to detect the token, and redirect the requesting user agent to the resource with a cookie. The policy service can be configured to reference such cookies when applying policy. Accordingly, an authenticated user agent can be allowed to access the remote network resource and resources at the same host/domain by virtue of the cookie and without additional authentication.

Abstract: A policy service logging system includes one or more servers connected by a network. The one or more servers are configured to provide a graph structure having a plurality of nodes. Each node is in communication with at least one other node. The graph structure is configured to process log entries of network resource requests subject to policy implemented by a policy service. As log entries flow through the graph structure, the nodes perform operations on the log entries.