Patent ID: 8204991

Claim:
A computerized method comprising: retrieving a plurality of records for a plurality of subscribers associated with a plurality of end stations connected to a single network device through a plurality of links, wherein each of the plurality of subscribers is associated with a different one of the plurality of records; authenticating each of the plurality of subscribers based on the one of the plurality of records retrieved for that subscriber; authorizing each of the subscribers to determine what that subscriber can do after being authenticated based on the one of the plurality of records retrieved for that subscriber, wherein each of the plurality of records comprises information indicating which of a plurality of virtual networks the respective subscriber can access, wherein the plurality of virtual networks are virtually isolated from each other, wherein the single network device comprises a plurality of virtual network machines that are virtually independent but share a set of physical resources of the single network device, wherein each of the virtual network machines is one of a virtual router and a virtual bridge, and wherein each of the plurality of virtual network machines belongs to a different one of the plurality of virtual networks; coupling different ones of the plurality of end stations to different ones of the virtual network machines according to said authorizing through dynamic bindings; forwarding information flows of the plurality of end stations via the different respective virtual network machines to which the corresponding subscriber end station is coupled based on control and policy information in separate independently administrable network databases of the virtual network machines, wherein each of the separate independently administrable network databases includes address, policy and control information; and accounting for the network activity of each of the plurality of end stations in the plurality of virtual network machines.