Secure communication network

1. A core node in a core network for secure network communication, the core node comprising:

a processor; and

a memory storing computer-executable instructions that when executed, cause the processor to:

receive a double encapsulated data packet associated with a first layer of encapsulation and a second layer of encapsulation;

decapsulate the second layer of encapsulation to access a portion of the data packet;

re-encapsulate at least the accessed portion of the data packet with another second layer of encapsulation; and

transmit the re-encapsulated data packet to a subsequent node based on the accessed portion.

2. The core node of claim 1 , wherein the first layer of encapsulation corresponds to an end-to-end encapsulation and the second layer of encapsulation corresponds to a hop-by-hop encapsulation.

3. The core node of claim 1 , wherein the second layer of encapsulation is based on a first security association between the core node and another node, from which the core node receives the double encapsulated data packet.

4. The core node of claim 3 , wherein the another second layer of encapsulation is based on a second security association between the core node and the subsequent node.

5. The core node of claim 1 , wherein the received data packet is associated with a first layer of encryption and a second layer of encryption.

6. The core node of claim 5 , wherein the computer-executable instructions further cause the processor to:

decrypt the second layer of encryption of the received data packet; and

re-encrypt the re-encapsulated data packet with another second layer of encryption.

7. The core node of claim 1 , wherein the first layer of encapsulation encapsulates a payload portion of the received data packet and further wherein, the second layer of encapsulation encapsulates the encapsulated payload portion, a metadata portion, and one or more headers of the received data packet.

8. The core node of claim 1 , wherein the accessed portion of the data packet comprises one or more headers of the data packet.

9. The core node of claim 8 , wherein the one or more headers of the data packet comprise one or more of an IPv4 header and/or an IPv6 header.

10. The core node of claim 1 , wherein the computer-executable instructions further cause the processor to:

perform one or more of an integrity check and an anti-replay check on the accessed portion of the data packet to verify one or more contents of the accessed portion;

re-encapsulate at least the accessed portion based on a positive verification of the one or more of the integrity check and the anti-replay check; and

discarding the data packet based on a negative verification of the one or more of the integrity check and the anti-replay check.

11. The core node of claim 1 , wherein the computer-executable instructions further cause the processor to transmit the re-encapsulated data packet to the subsequent node via a secure Internet Protocol Security (IPsec) tunnel.

12. A method in a core node for routing data packets for secure network communication, the method comprising:

receiving a double encapsulated data packet associated with a first layer of encapsulation and a second layer of encapsulation;

decapsulating the second layer of encapsulation to access a portion of the data packet;

re-encapsulating at least the accessed portion with another second layer of encapsulation; and

transmitting the re-encapsulated data packet to a subsequent node based on the accessed portion.

13. A customer premises equipment (CPE) in an enterprise network for secure network communication, the CPE comprising:

a processor; and

a memory storing computer-executable instructions that when executed, cause the processor to:

transmit a double encapsulated data packet to another CPE, via one or more core nodes, wherein the data packet is associated with a first layer of encapsulation and a second layer of encapsulation, and further wherein,

the transmitted double encapsulated data packet is processed by one or more core nodes to decapsulate the second layer of encapsulation to access a portion of the data packet and re-encapsulate the accessed portion with another second layer of encapsulation prior to transmitting the re-encapsulated data packet.

14. The CPE of claim 13 , wherein computer-executable instructions further cause the processor to:

receive a data packet from a source node in the enterprise network;

impose double encapsulation on the received data packet to create the double encapsulated data packet; and

transmit the double encapsulated data packet to one of the one or more core nodes.

15. The CPE of claim 14 , wherein computer-executable instructions further cause the processor to:

impose a first layer of encapsulation on the received data packet to create a single encapsulated data packet; and

impose the second layer of encapsulation on the single encapsulated data packet to create the double encapsulated data packet.

16. The CPE of claim 13 , wherein computer-executable instructions further cause the processor to impose a first layer of encryption on the single encapsulated data packet based on end-to-end security association between the CPEs, and a second layer of encryption on the double encapsulated data packet based on security association between the hop-by-hop nodes, wherein the first layer of encryption is decryptable by another CPE based on a security association between the CPE and the another CPE.

17. The CPE of claim 15 , wherein the first layer of encapsulation encapsulates a payload portion of a received data packet to create a single encapsulated data packet and further wherein, the second layer of encapsulation encapsulates the encapsulated payload portion, a metadata portion, and one or more headers of the single encapsulated data packet to create the double encapsulated data packet.

18. The CPE of claim 13 , wherein the second layer of encapsulation is based on a first security association between the CPE and one of the one or more core nodes.

19. The CPE of claim 18 , wherein the another second layer of encapsulation is based on a second security association between the one of the one or more core nodes and a subsequent node.

20. The CPE of claim 13 , wherein the computer-executable instructions further cause the processor to transmit the double encapsulated data packet to the another CPE via a secure Internet Protocol Security (IPsec) tunnel.