System and method for secure cloud service delivery with prioritized services in a network environment

A method, comprising:

• receiving, at an Internet Key Exchange (IKE) processing node in a cloud, a request for a cloud capability set comprising cloud capabilities associated with at least one of a plurality of cloud capability tiers, each cloud capability tier being associated with a different cloud capability set, the cloud capability set being selectable at a self-service portal of a cloud orchestration framework, the request being associated with a virtual private network (VPN) tunnel between a subscriber and the IKE processing node;
• offloading, by the IKE processing node, the VPN tunnel to particular cryptographic modules in the cloud that support the requested cloud capability set;
• and
• configuring, by an orchestration engine in the cloud, network resources to channel services according to at least one service tier through the particular cryptographic modules.

Non-transitory tangible media that includes instructions for execution, which when executed by a processor of a network element, is operable to perform operations comprising:

• receiving, at an IKE processing node in a cloud, a request for a cloud capability set comprising cloud capabilities associated with at least one of a plurality of cloud capability tiers, each cloud capability tier being associated with a different cloud capability set, the cloud capability set being selectable at a self-service portal of a cloud orchestration framework, the request being associated with a VPN tunnel between a subscriber and the IKE processing node;
• offloading, by the IKE processing node, the VPN tunnel to particular cryptographic modules in the cloud that support the requested cloud capability set;
• and
• configuring, by an orchestration engine in the cloud, network resources to channel services according to at least one service tier through the particular cryptographic modules.

An apparatus located in a cloud, comprising:

• a memory element for storing data;
• and
• a processor, wherein the processor executes instructions associated with the data, wherein the processor and the memory element cooperate, such that the apparatus is configured for:
• receiving a request for a cloud capability set comprising cloud capabilities associated with at least one of a plurality of cloud capability tiers, each cloud capability tier being associated with a different cloud capability set, the cloud capability set being selectable at a self-service portal of a cloud orchestration framework, the request being associated with a VPN tunnel between a subscriber and the IKE processing node;
• and
• offloading the VPN tunnel to particular cryptographic modules in the cloud that support the requested cloud capability set, wherein an orchestration engine in the cloud configures network resources to channel services according to at least one service tier through the particular cryptographic modules.