Multi-tenant network service architecture

A method, comprising:

• determining by the first enterprise node, based on a data packet to be communicated from a first enterprise node to a second enterprise node in an enterprise network, an encryption key associated with the second enterprise node, a first identifier to identify an egress core node in a core network, and a second identifier to determine a path leading to the second enterprise node;
• encrypting, by the first enterprise node, the data packet using the determined encryption key and adding, by the first enterprise node, the determined first and second identifiers to the encrypted data packet;
• and
• forwarding, by the first enterprise node, the encrypted data packet with the added first and second identifiers to an ingress core node in the core network, wherein the ingress core node forwards the encrypted data packet to a subsequent core node until the encrypted data packet reaches the egress core node based at least on the first identifier, and wherein the egress core node sends the encrypted data packet to the second enterprise node based at least on the second identifier.

A customer premises equipment (CPE) in an enterprise network, the CPE comprising:

• one or more processors;
• and
• memory storing computer-executable instructions that when executed, cause the one or more processors to:
• determine, based on a data packet to be communicated to another CPE in the enterprise network, an encryption key associated with the another CPE, a first identifier to identify an egress core node in a core network, and a second identifier to determine a path leading to the another CPE;
• encrypt the data packet using the determined encryption key and add the determined first and second identifiers to the encrypted data packet;
• and
• forward the encrypted data packet with the added first and second identifiers to an ingress core node in the core network, wherein the ingress core node forwards the encrypted data packet to a subsequent core node until the encrypted data packet reaches the egress core node based at least on the first identifier, and wherein the egress core node sends the encrypted data packet to the another CPE based at least on the second identifier.