1. A method implemented by data processing apparatus, the method comprising: receiving a plurality of outgoing packets from one or more source virtual machines executing on the data processing apparatus, each source virtual machine being a hardware virtualization of the data processing apparatus and each packet being destined for a destination virtual machine; establishing a plurality of virtual network pairs, one for each unique pair of source and destination virtual machines, wherein establishing the plurality of virtual network pairs comprises receiving, from an external data processing apparatus and in exchange for a secret key that is not known by the one or more destination virtual machines, a distinct token and network address for each of the one or more destination virtual machines, wherein each token is a single piece of information that represents a distinct secret key and the network address of the destination virtual machine, and wherein the established virtual network pairs are unidirectional; encapsulating each outgoing packet in a message with the token for the destination virtual machine of the message; and sending each message to the respective destination virtual machine for the message by sending the message to the respective network address for the destination virtual machine.