Overlay management protocol for secure routing based on an overlay network

1. A method for creating a secure network, comprising:

establishing an overlay domain, which comprises at least one overlay controller and a plurality of overlay edge routers communicatively coupled to the at least one overlay controller, to control routing between the plurality of overlay edge routers based on an underlying transport network, wherein the establishing comprises running an overlay management protocol to exchange information within the overlay domain;

in accordance with the overlay management protocol, defining overlay routes that exist exclusively within the overlay domain, wherein each overlay route includes information on at least one of service availability, authentication information, encryption information, policy information, and access control information, within the overlay domain;

in accordance with the overlay management protocol, providing the overlay routes to the at least one overlay controller; and

selectively using the overlay routes, by the at least one overlay controller, to control the routing between the plurality of overlay edge routers, wherein the routing is through the underlying transport network in a manner in which the overlay routes are shared with the plurality of overlay edge routers but not with the underlying transport network via the overlay management protocol.

2. The method of claim 1 , wherein each overlay route comprises link attributes associated with an overlay edge router, of the plurality of overlay edge routers connected to a service.

3. The method of claim 2 , wherein each overlay route comprises information on available services associated with the overlay edge router of the plurality of overlay edge routers.

4. The method of claim 2 , wherein each overlay route comprises path attributes of a route to the overlay edge router of the plurality of overlay edge routers.

5. A non-transitory computer-readable medium having stored instructions which when executed by a system causes the system to perform a method for routing within a secure network, the method comprising:

establishing an overlay domain, which comprises at least one overlay controller and a plurality of overlay edge routers communicatively coupled to the at least one overlay controller, to control the routing between the plurality of overlay edge routers based on an underlying transport network, wherein the establishing comprises running an overlay management protocol to exchange information within the overlay domain;

in accordance with the overlay management protocol, defining overlay routes that exist exclusively within the overlay domain, wherein each overlay route includes information on at least one of service availability, authentication information, encryption information, policy information, and access control information, within the overlay domain;

in accordance with the overlay management protocol, providing the overlay routes to the at least one overlay controller; and

selectively using the overlay routes, by the at least one overlay controller, to control the routing between the plurality of overlay edge routers, wherein the routing is through the underlying transport network in a manner in which the overlay routes are shared with the plurality of overlay edge routers but not with the underlying transport network via the overlay management protocol.

6. The computer-readable medium of claim 5 , wherein each overlay route comprises link attributes associated with an overlay edge router, of the plurality of overlay edge routers, connected to a service.

7. The computer-readable medium of claim 6 , wherein each overlay route comprises information on available services associated with the overlay edge router of the plurality of overlay edge routers.

8. The computer-readable medium of claim 6 , wherein each overlay route comprises path attributes of a route to the overlay edge router of the plurality of overlay edge routers.

9. An overlay controller for a secure network, comprising:

a processor; and

a memory coupled to the processor, the memory storing instructions which when executed by the processor causes the overlay controller to perform a method for routing comprising:

establishing an overlay domain, which comprises the overlay controller and a plurality of overlay edge routers communicatively coupled to the overlay controller, to control the routing between the plurality of overlay edge routers based on an underlying transport network, wherein the establishing comprises running an overlay management protocol to exchange information within the overlay domain;

in accordance with the overlay management protocol, defining overlay routes that exist exclusively within the overlay domain, wherein each overlay route includes information on at least one of service availability, authentication information, encryption information, policy information, and access control information, within the overlay domain;

in accordance with the overlay management protocol, providing the overlay routes to the overlay controller; and

selectively using the overlay routes, by the overlay controller, to control the routing between the plurality of overlay edge routers, wherein the routing is through the underlying transport network in a manner in which the overlay routes are shared with the plurality of overlay edge routers but not with the underlying transport network via the overlay management protocol.

10. The overlay controller of claim 9 , wherein each overlay route comprises link attributes associated with an overlay edge router, of the plurality of overlay edge routers, connected to a service.

11. The overlay controller of claim 10 , wherein each overlay route comprises information on available services associated with the overlay edge router of the plurality of overlay edge routers.

12. The overlay controller of claim 11 , wherein each overlay route comprises path attributes of a route to the overlay edge router of the plurality of overlay edge routers.