Control plane encryption in ip/mpls networks

A system for providing a secured domain, comprising:

• a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements;
• a subset of said plurality of network elements comprising said secured domain;
• a first network element which is a member of said subset of network elements, which encrypts all unencrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is enabled for encryption;
• said first network element further unencrypting all encrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is not enabled for encryption;
• and
• said first network element leaving encrypted all encrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is enabled for encryption.

A non-transitory machine readable storage medium encoded with instructions for execution by a processor at a first network element for a network having a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements;

• and a subset of said plurality of network elements comprising a secured domain;
• and said first network element a member of said subset, the medium comprising:
• instructions for encrypting all unencrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is enabled for encryption;
• instructions for unencrypting all encrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is not enabled for encryption;
• and
• instructions for leaving encrypted all encrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is enabled for encryption.