A TLOC route represents a WAN link that serves as a tunnel endpoint and is uniquely identified by {System-IP, Color, Encapsulation}. Note that the System IP address is used instead of the interface IP address as an identifier for a TLOC route. That's because the interface IP can change at any given moment. Using the fixed System-IP ensures that the TLOC can be uniquely identified at all times irrespective of any interface IP changes. This is very important because an OMP route (vRoute) has a next-hop pointing to a TLOC. This separation of information allows TLOC routes to be updated with new parameters without having to invalidate the dependent vRoutes. If a vEdge router has multiple transport interfaces connected to different WAN providers, as shown in figure 7, a TLOC route is created and advertised for each WAN interface.
DTLS or TLS provides communication privacy between Cisco SD-WAN devices in the network, using the Advanced Encryption Standard (AES-256) encryption algorithm to encrypt all control traffic sent over the connections.
https://www.networkacademy.io/ccie-enterprise/sdwan/omp-overview