System and method for providing integrated services across cryptographic boundaries in a network

A system for enabling Quality of Service (QoS) characteristics for transmitting encrypted data packets across a shared transit network comprising:

• a plurality of secured network enclaves coupled by a network, the plurality of secured network enclaves having a first security level and the network having a second security level different from the first security level;
• a cryptographic boundary separating each secured network enclave and the network;
• a crypto device disposed along the cryptographic boundary of each secured network enclave the crypto device being configured to permit data communication between the network and the secured network enclave;
• means for mapping at least one integrated services request to at least one packet forwarding classification in a packet to be forwarded by a software application in a secured network enclave;
• each crypto device including an encryption/decryption means for encrypting and decrypting a data flow, a classification monitoring module and a service provider module;
• the classification monitoring module includes detecting means for identifying the at least one packet forwarding classification mapped to the at least one integrated services request in a data flow from a first software application within a first secured network enclave and notifying means for notifying the service provider module of the receipt of the at least one integrated services request by the monitoring module, and the service provider module being configured for communicating at least one path reservation request associated with the at least one integrated services request across the network;
• for generating at least one reserved path across the second-level network in response to the at least one integrated services request;
• and for transmitting at least one data flow to at least one peer software application in a second secured network enclave from the first software application in response to generating at least one reserved path across the network.