# US 2014/0208094 A1 · Control plane encryption in ip/mpls networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208094 A1 - Document ID: US20140208094A1 - Status: Published application - Kind: A1 - Application number: 13/748,244 - Filed: 2013-01-23 - Published: 2014-07-24 - Earliest claimed: 2013-01-23 - Assignees: Alcatel-Lucent Canada Inc. - Inventors: Carl Rajsic; Hansen Chan - Web page: https://patentgrep.com/patent/US20140208094A1 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for providing control plane encryption in layer 3 networks is disclosed. The method for providing control plane encryption in layer 3 networks includes for a network having a subset of network elements forming a secured domain; the steps of at a network element which is in the secured domain, encrypting all unencrypted Layer 3 packets as they egress an encryption enable egress interface; unencrypting all encrypted Layer 3 packets as they egress an egress interface is not enabled for encryption; and leaving encrypted all encrypted Layer 3 packets as they egress an encryption enable egress interface. A system and machine readable storage media are also disclosed. ## Claims ### Claim 1 A method of encrypting data for a network having a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements; and a subset of said plurality of network elements comprising a secured domain; the method comprising the steps of: at a first network element which is a member of said subset of network elements, encrypting all unencrypted Layer 3 packets as they egress an egress interface wherein said egress interface is enabled for encryption; at said first network element, unencrypting all encrypted Layer 3 packets as they egress an egress interface wherein said egress interface is not enabled for encryption; and at said first network element, leaving encrypted all encrypted Layer 3 packets as they egress an egress interface wherein said egress interface is enabled for encryption. ### Claim 2 (depends on 1) A method as claimed in claim 1 wherein said encrypting is associated with an encryption protocol that is one of the group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256. ### Claim 3 A system for providing a secured domain, comprising: a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements; a subset of said plurality of network elements comprising said secured domain; a first network element which is a member of said subset of network elements, which encrypts all unencrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is enabled for encryption; said first network element further unencrypting all encrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is not enabled for encryption; and said first network element leaving encrypted all encrypted Layer 3 packets as they egress a respective egress interface wherein said egress interface is enabled for encryption. ### Claim 4 (depends on 3) A system as claimed in claim 3 wherein said encrypting is associated with an encryption protocol that is one of the group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256. ### Claim 5 A non-transitory machine readable storage medium encoded with instructions for execution by a processor at a first network element for a network having a plurality of network elements, each of said plurality of network elements having a connection between a respective ingress interface to a respective egress interface of another network element of said plurality of network elements; and a subset of said plurality of network elements comprising a secured domain; and said first network element a member of said subset, the medium comprising: instructions for encrypting all unencrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is enabled for encryption; instructions for unencrypting all encrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is not enabled for encryption; and instructions for leaving encrypted all encrypted Layer 3 packets as they egress an egress interface of said first network element in the event said egress interface is enabled for encryption. ### Claim 6 (depends on 3) A non-transitory machine readable storage medium as claimed in claim 3 wherein said encrypting is associated with an encryption protocol that is one of the group of DES, 3DES, Blowfish, Twofish, Serpent, SNOW 3G, Kasumi-F8, AES-128, AES-192, and AES-256.