A company has a regulatory requirement that all connections between their sites must be encrypted in a manner that does not require maintenance of permanent tunnels. The remote offices are connected by a private MPLS-based service that requires a dynamically changing key, spoke-to-spoke communication, and reuse of the existing IP header. Which type of transport encryption must be used?