Patent ID: 8707383

Claim:
A computer implemented method for managing computer workloads with security policy enforcement, the computer implemented method comprising: running a virtual machine on a host; responsive to determining that a virtual machine has failed to meet processing requirements defined in a service level agreement, identifying, by a processor in a computer, a candidate host where the virtual machine may be migrated based on performance considerations; comparing a first security policy for the virtual machine and stored in a memory of the computer to both a second security policy for the candidate host and a third security policy for a virtual machine monitor in the candidate host to determine if the first security policy is equivalent to or stronger than the second security policy and the third security policy, wherein the first security policy is equivalent to the second security policy and the third security policy if the first security policy has equivalent security restrictions and allows equivalent access restrictions as the second security policy and the third security policy, and wherein the first security policy is stronger than the second security policy and the third security policy if the first security policy has equivalent security restrictions and also additional security restrictions and additional access restrictions than restrictions contained in the second security policy and the third security policy; determining performance effects of migrating the virtual machine to the candidate host only if the first security policy is determined to be equivalent to or stronger than the second security policy and the third security policy; responsive to a determination that the first security policy is weaker than the second security policy and the third security policy, dropping the candidate host from consideration as a migration candidate, wherein the first security policy is weaker than the second security policy and the third security policy if the first security policy has fewer security restrictions than the second security policy and the third security policy; and responsive to a determination that the performance effects determined meet the processing requirements, migrating the virtual machine to the candidate host.