Patent ID: 8356297

Claim:
A method of interacting with an external environment of a segmented virtual machine, comprising: receiving an indication that a communication with the external environment is desired; determining, based at least in part on a specified network connection identifier associated with a network connection, whether the communication is allowed to be initiated directly from a core virtual machine of the segmented virtual machine without initiating the communication from a shell virtual machine of the segmented virtual machine, wherein the shell virtual machine and the core virtual machine cooperate to function as a single virtual machine; wherein the core virtual machine supports internal execution functionality of the segmented virtual machine and a portion of external communication while the shell virtual machine supports another portion of the external communication; and attempting to initiate the communication based as at least in part on the determination including: in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is based at least in part on an inclusion list that specifies one or more identifiers of one or more network connections, that the communication is allowed to be initiated directly from the core virtual machine without initiating the network connection from the shell virtual machine, initiating the network connection to the external environment directly through the core virtual machine; and in the event that it is determined, based on the specified network connection identifier wherein the specified network connection identifier is not listed in the inclusion list, that the communication is not allowed to be initiated directly from the core virtual machine, initiating the network connection through the shell virtual machine.