Multi-domain dynamic group virtual private networks

A method that facilitates communication of data between disparate autonomous systems (AS), the method comprising:

• sending a request for keying material and crypto-policy information conforming to a second security policy from a first server in a first dynamic group virtual private network to a second server in a second dynamic group virtual private network, wherein the first dynamic group virtual private network is within a first range of IP addresses and conforms to a first security policy, and the second dynamic group virtual private network is within a second range of IP addresses and conforms to the second security policy, the first security policy being different than the second security policy;
• receiving from the second server in the second dynamic group virtual private network, at the first server within the first dynamic group virtual private network, the keying material and crypto-policy information conforming to the second security policy from the second dynamic group virtual private network, the keying material and the crypto-policy information are associated with the second dynamic group virtual private network, the crypto-policy information being associated with a plurality of prefixes, each prefix of the plurality of prefixes being part of a routing protocol between the first dynamic group virtual private network and the second dynamic group virtual private network;
• encrypting data packets, received from a first client, in accordance with the crypto-policy information and using the keying material, the data packets are encrypted on the first server in the first dynamic group virtual private network;
• and
• transmitting the encrypted data packets from the first server in the first dynamic group virtual private network to the second server in the second dynamic group virtual private network, wherein the second server forwards data decrypted from the encrypted data to a second client in the second dynamic group virtual private network.

A non-transitory computer-readable storage medium containing instructions, which when executed by a processor cause the processor to:

• send a request for keying material and crypto-policy information conforming to a second security policy from a first server in a first dynamic group virtual private network to a second server in a second dynamic group virtual private network, wherein the first dynamic group virtual private network is within a first service provider network and conforms to a first security policy, and the second dynamic group virtual private network is within a second service provider network and conforms to the second security policy, the first security policy being different than the second security policy;
• receive from the second server in the second dynamic group virtual private network, on the first server within the first dynamic group virtual private network, the keying material and crypto-policy information conforming to the second security policy from the second dynamic group virtual private network, the keying material and the crypto-policy information allowing secure access to the second dynamic group virtual private network, the crypto-policy information being associated with a plurality of prefixes, each prefix of the plurality of prefixes being part of a routing protocol between the first dynamic group virtual private network and the second dynamic group virtual private network;
• encrypt data packets, received from a first client, in accordance with the crypto-policy information on the first server within the first dynamic group virtual private network and using the keying material;
• and
• transmit the encrypted data packets from the first server in the first dynamic group virtual private network to the second server in the second dynamic group virtual private network, wherein the second server forwards data decrypted from the encrypted data to a second client in the second dynamic group virtual private network.

A method that facilitates secure communication between disparate service provider networks, the method comprising:

• receiving a request for keying material and crypto-policy information conforming to a first security policy from a second server located within a second dynamic group virtual private network operating within a second service provider network by a first server within a first dynamic group virtual private network operating within a first service provider network for secure communication between a first client within the first dynamic group virtual private, the first dynamic group virtual private associated with a first range of IP addresses and conforming to a first security policy, and a second client within the second dynamic group virtual private, the second dynamic group virtual private associated with a second range of IP addresses and conforming to a second security policy, the request originating from within the second dynamic group virtual private, the first security policy being different than the second security policy;
• sending to the second server, based on the received request, key material and crypto-policy information conforming to the first security policy over a secure communication channel;
• receiving, on the first server, encrypted data packets addressed to the first client from the second client within the first dynamic group virtual private, the data packets secured according to the crypto-policy information and using the key material shared with the second dynamic group virtual private by the first dynamic group virtual private;
• decrypting, on the first server, the encrypted data packets using the key material and the crypto-policy information, the crypto-policy information being associated with a plurality of prefixes, each prefix of the plurality of prefixes being part of the routing protocol between the first dynamic group virtual private and the second dynamic group virtual private;
• and
• delivering, from the first server, the decrypted data packets to the first client.