Patent ID: 8284943

Claim:
A method for operating on a data packet to provide an enterprise networking environment over a service provider network, comprising: a customer edge (CE) router function, located within the enterprise network, for: providing the data packet, wherein the data packet includes a header and payload; a Policy Enforcement Point (PEP) function for: applying an IPSec protocol to the data packet, including encrypting the header and payload of the data packet received from the CE router function and forming an encrypted header and encrypted payload of the data packet; applying a security association policy to the data packet; maintaining the header of the data packet in non-encrypted form; and forming an encrypted data packet including: i) the header of the data packet maintained in non-encrypted form, and ii) the encrypted header and encrypted payload of the data packet; a provider edge router function, located within the service provider network, for: applying an MPLS protocol to the encrypted data packet; and forwarding the encrypted data packet according to the enterprise network VirtualPrivate Network (VPN) routing and forwarding (VRF).