A computer-implemented method, comprising: sending data to a remote identity service associated with a remote processing environment; receiving an encrypted version of the data from the remote identity service; decrypting the encrypted version to verify the data; establishing a secure channel with the remote identity service when the encrypted version is verified; acquiring operating metadata unique to the remote processing environment via the secure channel, wherein the operating metadata is one or more of an Internet Protocol, "IP", subnet of the remote processing environment, an IP address for the remote processing environment, and disk or storage subsystem configuration settings for the remote processing environment, and generating a unique identity for the remote processing environment, wherein the unique identity for the remote processing environment is unique to a resource across a given context that the resource may engage in over a network, for example a given service interaction, a given processing environment or a given virtual processing environment; and transmitting the unique identity to the remote identity service associated with the remote processing environment for subsequent authentication and deployment of policy restrictions within the remote processing environment, wherein decrypting further comprises using a public key associated with a secure device, which is located in the remote processing environment, to decrypt the encrypted version, wherein a private key is known to just the secure device and previously used by the secure device to produce the encrypted version, and the private key is not transmitted or communicated from the secure device to the remote identity service, and wherein the secure device supplies the encrypted version to the remote identity service for delivery, wherein transmitting further includes using the policy restrictions within the remote processing environment to distribute, clone, move, or terminate a virtual processing environment, the virtual processing environment being a software constructed sub processing environment that is carved from a portion of the remote processing environment. sending data to a remote identity service associated with a remote processing environment; receiving an encrypted version of the data from the remote identity service; decrypting the encrypted version to verify the data; establishing a secure channel with the remote identity service when the encrypted version is verified; acquiring operating metadata unique to the remote processing environment via the secure channel, wherein the operating metadata is one or more of an Internet Protocol, "IP", subnet of the remote processing environment, an IP address for the remote processing environment, and disk or storage subsystem configuration settings for the remote processing environment, and generating a unique identity for the remote processing environment, wherein the unique identity for the remote processing environment is unique to a resource across a given context that the resource may engage in over a network, for example a given service interaction, a given processing environment or a given virtual processing environment; and transmitting the unique identity to the remote identity service associated with the remote processing environment for subsequent authentication and deployment of policy restrictions within the remote processing environment, wherein decrypting further comprises using a public key associated with a secure device, which is located in the remote processing environment, to decrypt the encrypted version, wherein a private key is known to just the secure device and previously used by the secure device to produce the encrypted version, and the private key is not transmitted or communicated from the secure device to the remote identity service, and wherein the secure device supplies the encrypted version to the remote identity service for delivery, wherein transmitting further includes using the policy restrictions within the remote processing environment to distribute, clone, move, or terminate a virtual processing environment, the virtual processing environment being a software constructed sub processing environment that is carved from a portion of the remote processing environment.