I'm trying to understand MPLS. It states that the routing doesn't happen at each router, and it starts with a "Label Edge Router".
For example, if company X uses ATT as the provider for MPLS, then who owns these edge routers ? Are those owned by company-X & housed in ATT data centers ?
Also, if MPLS traffic goes over the internet then what stops a malicious router from opening the data inside. Is MPLS data encrypted ?
For example, if company X uses ATT as the provider for MPLS, then who owns these edge routers ?
If you rent an MPLS line/link, the routers belong to your provider. Most often, you get an Ethernet port as handover.
if MPLS traffic goes over the internet then ...
MPLS traffic is only forwarded within a private or ISP network. There's no way to run it across the Internet unless you tunnel the traffic. The point of MPLS is that you can trust the infrastructure, so there's actually no need to encrypt. You can't trust the Internet, so that's out of the question.
When you run an encrypted tunnel across the Internet it's usually called VPN.
MPLS does not go into the "Internet" MPLS has several components, but it's mainly a switching mechanism used by the routers in the ISP networks. A router running MPLS switch the packet (the IP datagram) based on a label, instead of using the L3 address. This is supposed to be more efficient since the label is shorter and the FIB can be populated more efficiently.
For the routers to know what label to use and what to do with them they use label distribution protocols or manually configured labels.
If a router does not participate in the MPLS distribution will not know what a label means, and it will discard the packet with the label, or it will not understand this is an IP packet at all. As the organization running the network controls which routers participate in the MPLS, it is considered that the traffic is safe inside the network. For building VPNs in the MPLS network what they do is stack labels, which requires an additional label distribution, normally made using BGP extensions. So, as long as the MPLS runs only in the provider network it is considered safe.
