On-demand security association management

1. A method comprising:

at a first network element among a plurality of network elements, obtaining data from a first endpoint associated with the first network element, the data identifying a destination of a second endpoint remote from the first network element;

providing a map request to a mapping server, the map request identifying the second endpoint;

obtaining a map reply from the mapping server, the map reply including a network address of a second network element associated with the second endpoint and a security association;

generating encrypted data by encrypting the data for the second endpoint with the security association according to a cryptographic policy based on the first endpoint, the second endpoint, and an availability of cryptographic resources on the plurality of network elements; and

providing the encrypted data to the second network element.

2. The method of claim 1 , further comprising:

obtaining an updated security association from the mapping server, the updated security association based on an updated cryptographic policy;

generating updated encrypted data by encrypting subsequent data for the second endpoint with the updated security association; and

providing the updated encrypted data to the second network element.

3. The method of claim 2 , wherein the updated cryptographic policy is based on an update to the availability of cryptographic resources on the plurality of network elements.

4. The method of claim 1 , further comprising:

obtaining a network address of a third network element that is a re-encapsulation router interposed between the first network element and the second network element on a route from the first endpoint to the second endpoint;

obtaining a new security association for communicating with the third network element;

generating new encrypted data by encrypting the data for the second network element with the new security association; and

providing the new encrypted data to the third network element.

5. The method of claim 1 , wherein the second network element is a re-encapsulation router interposed between the first network element and a third network element on a route from the first endpoint to the second endpoint.

6. The method of claim 1 , wherein the cryptographic policy is based on a group identity of the first endpoint and the second endpoint.

7. The method of claim 6 , wherein the group identity of the first endpoint and the second endpoint is a Virtual Network Identifier (VNI) or a security group identifier.

8. An apparatus comprising:

a network interface configured to communicate with a plurality of network elements; and

a processor coupled to the network interface and configured to:

receive data via the network interface from a first endpoint associated with the apparatus, the data identifying a destination of a second endpoint remote from the apparatus;

cause the network interface to send a map request to a mapping server, the map request identifying the second endpoint;

receive a map reply from the mapping server via the network interface, the map reply including a network address of a remote network element associated with the second endpoint and a security association;

generate encrypted data by encrypting the data for the second endpoint with the security association according to a cryptographic policy based on the first endpoint, the second endpoint, and an availability of cryptographic resources on the plurality of network elements; and

cause the network interface to send the encrypted data to the remote network element.

9. The apparatus of claim 8 , wherein the processor is further configured to:

receive an updated security association from the mapping server via the network interface, the updated security association based on an updated cryptographic policy;

generate updated encrypted data by encrypting subsequent data for the second endpoint with the updated security association; and

cause the network interface to send the updated encrypted data to the remote network element.

10. The apparatus of claim 9 , wherein the updated cryptographic policy is based on an update to the availability of cryptographic resources on the plurality of network elements.

11. The apparatus of claim 8 , wherein the processor is further configured to:

receive via the network interface, a network address of a re-encapsulation router interposed between the apparatus and the remote network element on a route from the first endpoint to the second endpoint;

receive via the network interface, a new security association for communicating with the re-encapsulation router;

generate new encrypted data by encrypting the data for the remote network element with the new security association; and

cause the network interface to send the new encrypted data to the re-encapsulation router.

12. The apparatus of claim 8 , wherein the remote network element is a re-encapsulation router interposed between the apparatus and an egress network element on a route from the first endpoint to the second endpoint.

13. The apparatus of claim 8 , wherein the cryptographic policy is based on a group identity of the first endpoint and the second endpoint.

14. The apparatus of claim 13 , wherein the group identity of the first endpoint and the second endpoint is a Virtual Network Identifier (VNI) or a security group identifier.

15. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and, when the software is executed by a processor on a first network element, operable to cause the processor to:

obtain data from a first endpoint associated with the first network element, the data identifying a destination of a second endpoint remote from the first network element;

provide a map request to a mapping server, the map request identifying the second endpoint;

obtain a map reply from the mapping server, the map reply including a network address of a second network element associated with the second endpoint and a security association;

generate encrypted data by encrypting the data for the second endpoint with the security association according to a cryptographic policy based on the first endpoint, the second endpoint, and an availability of cryptographic resources on a plurality of network elements including the first network element and the second network element; and

provide the encrypted data to the second network element.

16. The non-transitory computer readable storage media of claim 15 , further comprising instructions operable to cause the processor to:

obtain an updated security association from the mapping server, the updated security association based on an updated cryptographic policy;

generate updated encrypted data by encrypting subsequent data for the second endpoint with the updated security association; and

provide the updated encrypted data to the second network element.

17. The non-transitory computer readable storage media of claim 16 , wherein the updated cryptographic policy is based on an update to the availability of cryptographic resources on the plurality of network elements.

18. The non-transitory computer readable storage media of claim 15 , further comprising instructions operable to cause the processor to:

obtain a network address of a third network element that is a re-encapsulation router interposed between the first network element and the second network element on a route from the first endpoint to the second endpoint;

obtain a new security association for communicating with the third network element;

generate new encrypted data by encrypting the data for the second network element with the new security association; and

provide the new encrypted data to the third network element.

19. The non-transitory computer readable storage media of claim 15 , wherein the second network element is a re-encapsulation router interposed between the first network element and a third network element on a route from the first endpoint to the second endpoint.

20. The non-transitory computer readable storage media of claim 15 , wherein the cryptographic policy is based on a group identity of the first endpoint and the second endpoint.