Service plane encryption in IP/MPLS networks

A non-transitory machine readable storage medium encoded with instructions for execution by a processor at a first network element for encrypting data between a first Service Distribution Point located at said first network element and a second Service Distribution Point located at a second network element, said first and second Service Distribution Points connected via a tunneling protocol, the non-transitory machine readable storage medium comprising:

• instructions for receiving a first Security Parameter Index with associated first encryption key and associated first authentication key at the first network element supporting said first Service Distribution Point;
• instructions for receiving an instruction at said first network element to encrypt data entering said first Service Distribution point with said first encryption key;
• instructions for receiving an instruction at said first network element to associate a data communication service provided at said first network element to said first Service Distribution Point;
• instructions for providing an encryption label in a packet having a hierarchy of labels, wherein the encryption label occurs inside both a tunnel label and a service label;
• and
• instructions for providing data associated with said first communication service to said first Service Distribution Point for transmission to said second Service Distribution Point, wherein the encryption label differentiates encrypted communications from unencrypted communications in an identical tunnel.