Patent ID: 8271775

Claim:
An apparatus, comprising: a receive logic to receive an unencrypted layer two (L2) switched frame on a network, where the unencrypted L2 switched frame includes a payload and an L2 header; an encryption logic: to analyze the L2 header of the unencrypted L2 switched frame to determine whether the L2 header specifies a destination of the L2 switched frame, that is outside of the network; to determine that unencrypted L2 switched frame is to be sent through an L2 virtual private network (L2VPN) requiring encryption, based on the L2 header specifying the destination that is outside of the network; and to selectively encrypt the unencrypted L2 switched frame into an encrypted frame by operation of one or more computer processors and upon determining that the unencrypted L2 switched frame is to be sent through the L2VPN requiring encryption, where the unencrypted L 2 switched frame is not encrypted upon determining that the L2 header specifies a destination within the network; and a delivery logic: to add a service tag and a tunnel header to the encrypted frame, where the service tag includes data to identify a decryption function to decrypt the encrypted frame, where the tunnel header includes routing information, where the tunnel header has a format that complies with a predefined network protocol, and where at least one of the service tag and the tunnel header are configured based, at least in part, on the encrypting performed by the encryption logic; and to provide the encrypted frame to the L2VPN, where the providing includes selectively sending the encrypted frame as one of, a point to point packet, and a multipoint packet.