Patent ID: 8468268
Filing Date: 2013-06-18
Classification: G06F,H04L

Abstract:
1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising: initiating a workload on a first device; authenticating the workload to an identity service to establish a workload identity; setting access privileges, role assignments, and policies as acquired from the identity service and in response to the workload identity; registering the workload via the workload identity as a customized network, the customized network based on: the workload identity, the role assignments, and the policies and the customized network is a Virtual Private Network (VPN) that defines all resources and devices that the workload can see and can access and at least some devices dynamically register and join the VPN and initially the customized network just includes the workload by itself on an initial device and subsequently other workloads and devices dynamically register and join in the customized network; and building one or more network routes for the workload that identifies network access routes to other devices and/or other workloads on the customized network based on: the workload identity, the role assignments, and the policies.