Patent ID: 7571463

Claim:
A method of securing packet data transferred between non-overlapping pairs of stations of a group of more than two stations on a backbone, the backbone comprising an ingress point and egress point, the method comprising the steps of: receiving a first packet at the ingress point of the backbone from a sending first station of the group of stations, the packet including an original header with a source IP address of the sending station and a destination IP address of a receiving second station of the group of stations; receiving a second packet at the ingress point of the backbone from a sending third station of the group of stations the packet including an original header with a source IP address of the sending station and a destination IP address of a receiving fourth station of the group of stations; wherein the first packet is associated with a first point-to-point communication, the second packet is associated with a second point-to-point communication, and the first communication is unrelated to the second communication except that the first, second, third and fourth stations belong to the group of stations; transforming, at the ingress point of the backbone, the first packet by adding a group header including a group identifier corresponding to the group of stations and a destination address for the first packet; transforming, at the ingress point of the backbone, the second packet by adding a group header including the group identifier corresponding to the group of stations and a destination address for the second packet; transforming, at the ingress point of the backbone, both the first packet and the second packet according to the group security association associated with the group identifier, wherein the ingress point is a provider edge device; forwarding the transformed first and second packets over the backbone to the egress point using the group identifier as a backbone address; receiving, at the egress point in the backbone, the transformed first and second packets; restoring, at the egress point in the backbone, both the first transformed packet and the second transformed packet according to the group security association associated with the group identifier; transforming, at the egress point in the backbone, the first and second restored packets by removing the respective group headers; forwarding the first restored transformed packet to the receiving second station, and forwarding the second restored transformed packet to the receiving fourth station, whereby the same security association is used for unrelated communications between non-overlapping pairs of stations of the group of stations.