Patent ID: 8832820

Claim:
A method for enhanced isolation and security hardening between workloads in a multi-tenant networked environment, said method comprising: a querying networked entity connected to a computer network generating and attempting to transmit a broadcast or multicast query to a target networked entity connected to the computer network by means of a physical switch connected to the computer network, wherein the broadcast or multicast query requests a media-access control address of the target networked entity, wherein the querying networked entity comprises a first virtual machine running on a first processor, a virtual switch running on the first processor that is configured to disable the querying networked entity's ability to send broadcast or multicast messages, and a virtual-machine agent running on the first processor, wherein the target networked entity is distinct from the querying networked entity, wherein the target networked entity is selected from a group comprising a second computer system, a second virtual machine running on a second processor of a second computer system, and an other networked device, wherein the virtual-machine agent prevents the querying networked entity from sending the broadcast or multicast query to the physical switch by intercepting the broadcast or multicast query before the broadcast or multicast query leaves the virtual machine and forwarding the intercepted message to the virtual switch; the virtual agent creating a unicast query addressed to a redirection device, wherein the unicast query requests the media-access control address of the target networked entity, and then sending the unicast query to the virtual switch; the virtual switch receiving and verifying the unicast query, wherein the receiving and verifying comprises confirming that each packet of the unicast query specifies a media-control address that identifies the querying networked entity as a sender of the unicast query; the virtual switch directly or indirectly forwarding the verified unicast query to the physical switch; the physical switch receiving the verified unicast query and directly or indirectly forwarding the verified unicast query to the redirection device, such that the target networked entity does not receive a request for the media-access control address of the target networked entity; the physical switch receiving a response from the redirection device, wherein the response identifies a media-access control address that enables communication with the target networked entity and wherein the response further identifies a redirection media-access control address associated with the redirection device; the physical switch forwarding the received response to the virtual switch by means of the computer network; the virtual switch further verifying the response by confirming that the redirection media-access control address identifies a valid redirection device; and the virtual switch forwarding the verified response to the querying networked entity.