Design and Implementation of Application-based Secure VLAN

Abstract—Normally, security and access control policies rely on features from the host operating system. But what if the owner of the host is untrustworthy, or the host is simply too “dumb ” to support such policies? In this paper, we investigate the feasibility of using the network to enforce these policies. First, we describe an application-based secure VLAN architecture that can be used to completely secure a particular network service from unauthorized access, without making any changes to the hosts and requiring only minimal changes to existing standardized LAN components. Second, we present a case study to show how our approach can be applied to IP Telephony. Finally, we describe our experiences from a prototype implementation of the S-VLAN concept. Keywords: Service-based VLAN overlay; tagge