Patent ID: 8516160

Claim:
A machine-implemented method, comprising: establishing, by an operating system, a plurality of non-global operating system partitions within a global operating system environment provided by the operating system, wherein each non-global operating system partition serves to isolate processes running within that non-global operating system partition from other non-global operating system partitions within the global operating system environment, wherein enforcement of boundaries between the non-global operating system partitions is carried out by the operating system, wherein the non-global operating system partitions do not each have a separate operating system kernel executing therein, and wherein the plurality of non-global operating system partitions comprises a particular non-global operating system partition; associating a set of one or more partition message processing rules with the particular non-global operating system partition, wherein the set of one or more partition message processing rules indicates what type or types of network messages are allowed to be received by processes executing within the particular non-global operating system partition; associating a set of one or more process group message processing rules with a group of one or more processes executing within the particular non-global operating system partition, wherein the set of one or more process group message processing rules indicates what network messages are allowed to be received by the one or more processes in the group; and routing network traffic in accordance with the set of one or more partition message processing rules and the set of one or more process group message processing rules such that a network message is routed to the one or more processes in the group only if the network message satisfies at least one of the set of one or more partition message processing rules and at least one of the set of one or more process group message processing rules.