Selectively disclosing content of data center interconnect encrypted links

An apparatus comprising

• a packet receiver, in an intermediate router, configured to receive an encrypted data packet being transmitted from a source router to a destination router, the source and destination routers use a MAC security standard for encryption and decryption of the data packet;
• a partial decryption circuit configured to use one or more encryption keys received from the source router to decrypt one or more layers of the encrypted data packet while leaving one or more additional lower layers and a payload of the encrypted data packet encrypted, wherein the decrypted layers comprise information to process the encrypted data packet according to a service level agreement of the intermediate router;
• a routing circuit configured to determine a priority of the encrypted data packet based on the service level agreement and the information of the decrypted layers;
• and
• a packet re-transmitter configured to transmit a version of the encrypted data packet in accordance with the determined priority of the encrypted data packet and the service level agreement of the intermediate router, the version of the encrypted data packet matching the encrypted data packet received by the packet receiver.

A method comprising:

• using a plurality of encryption keys to encrypt each of two or more portions of a data packet, each portion encrypted with a different encryption key of the plurality of encryption keys, each portion comprises one or more layers of the data packet and a last portion comprises at least a payload of the data packet, a first portion of the two or more portions comprises a layer of the data packet comprising media access control (“MAC”) information;
• and
• transmitting, from a source router, an encrypted data packet to an intermediate router between the source router and a destination router, the encrypted data packet comprising an encrypted version of the data packet encrypted using the plurality of encryption keys,
• wherein the intermediate router has one or more of the plurality of encryption keys sufficient for a service level agreement of the intermediate router and lacks a portion of the plurality of encryption keys, and
• wherein the source and destination routers use a MAC security standard for encryption and decryption of the data packet using the plurality of encryption keys.