Patent ID: 8180923

Claim:
In a computer hardware platform, a method comprising: selecting from a plurality of logical machines of the computer hardware platform a logical machine to serve as a host for the other logical machines of the plurality of logical machines, each of the plurality of logical machines corresponding to a different respective mapping of a plurality of mappings, wherein each of the plurality of mappings maps the corresponding logical machine to a different respective physical processor, wherein for each of the plurality of logical machines, a program executing on the logical machine is presented by the logical machine with a logical view of a processor and a memory, wherein a policy enforcement point (PEP) provides an entry point for the computer hardware platform to connect to a network, wherein the PEP enforces a network access control policy of a policy decision point (PDP) before allowing the computer hardware platform to connect to the network; prior to the PDP allowing any connection of the computer hardware platform to the network, the host sending a message via a network interface of the computer hardware platform to the PEP, the message requesting that the PDP establish a data channel interconnecting the computer hardware platform and the network; and establishing the requested data channel, including: the host authenticating itself to the PDP; the host generating a cryptographic key based on a hash of a combination of messages received by the host, the combination including messages from each of the other logical machines of the plurality of logical machines; and the host negotiating the cryptographic key with the PDP to provision the data channel: wherein the host operates as a relaying intermediary for the plurality of logical machines, including the host forwarding messages between the PDP and the other logical machines, and wherein the data channel includes a different respective logical data channel for each of the plurality of logical machines, each logical channel interconnecting the respective logical machine of the logical channel to the network.