VPN processing via service insertion architecture

A method, comprising:

• sending registration information from a first key server in a network to a network device that is configured as a service broker to handle control traffic for managing secure groups in the network, wherein the first key server is configured to act as one of a plurality of service nodes in a service insertion architecture (SIA) that comprises the service broker, at least one service classifier, and the plurality of service nodes, the registration information including identification of a secure group for which the first key server is configured to act as a service node, the registration information further providing meta information based on which group members of the secure group select a key server from which to obtain policy and key information;
• announcing to the network, by the first key server, group membership and capabilities of the first key server associated with the secure group, the announcing including identifying the secure group for which the first key server is configured to act as a service node;
• in response to sending the registration information and announcing the group membership, receiving at the first key server a key server membership list from the service broker, wherein the key server membership list indicates one or more other key servers that are configured for servicing the secure group, the key server membership list received based on the key server being authenticated by the service broker;
• establishing, using the first key server, a cooperative relationship with a second key server indicated by the key server membership list;
• and
• exchanging, by the first key server with the second key server, information on the secure group based on the established cooperative relationship, the exchanging including synchronizing encryption states.

A system comprising:

• a first network device configured to act as a service classifier in a service insertion architecture (SIA), the SIA comprising a second network device configured as a service broker to handle control traffic for managing secure groups in a network that includes a first secure group with the first network device a group member of the first secure group, the SIA further including one or more key servers configured as service nodes to generate policy and encryption keys for the secure groups;
• and
• a processor operable to process instructions that are configured to cause the processor to perform operations comprising:
• sending a request from the network device to the service broker to join the first secure group that is identifiable by a group ID in the request;
• receiving, at the network device and from the service broker device, a list of key servers configured for servicing the first secure group, the list including an ordering of the key servers based on meta information associated with the key servers, wherein key servers are included in the list based on being authenticated by the service broker device;
• selecting, using the network device, a key server from the list based on the meta information;
• sending, using the network device, registration information to the selected key server to join the first secure group;
• receiving, at the network device and from the selected key server, policy and encryption keys for the first secure group responsive to the network device being authenticated by the selected key server and established as a group member of the first secure group based on the registration information;
• and
• establishing encrypted communication, by the network device and based on the policy and encryption keys received from the selected key server, with one or more group members of the first secure group.