Patent ID: 8036221

Claim:
A method comprising: obtaining a first packet that includes a first Internet Protocol (IP) header and a first payload, wherein the first IP header includes a first source address of a first source node of a first private network and a first destination address of a first destination node of the first private network, and the first payload includes a second packet that has a second IP header and a second payload, the second IP header having a second source address of a second source node of a second virtual private network partitioned from resources of, formed over, established within or via, the first private network and a second destination address of a second destination node of the second virtual private network; encrypting the first packet to form an encrypted-subnet packet; encapsulating the encrypted-subnet packet with a group-security association formed in accordance with a group-security policy to generate a group-encrypted packet using a tunneling protocol for tunneling the group-encrypted packet between the first source node of the first network and the first destination node of the first private network such that only the first source node of the first private network and the first destination node of the first private network are able to decipher the encrypted-subnet packet that is encapsulated in the group-encrypted packet with a message-authentication code identified for the encrypted-subnet packet, wherein the encrypted-subnet packet comprises a security-encapsulating header configured with identifiers of the first source node, the first destination node, the second source node, and the second destination node; replicating the group-encrypted packet at the first source node of the first private network such that the group-encrypted packet follows a multicast distribution tree in the first private network; and transmitting the group-encrypted packet into the second virtual private network from the second source node for delivery to the second destination node.