Protecting customer virtual local area network (VLAN) tag in carrier ethernet services

A method, comprising:

• receiving a frame from an Ethernet Virtual Connection (EVC) at a universal network interface (UNI) of a first network device,
• wherein the received frame is associated with
• a first virtual local area network identifier (VLAN ID) and
• a first priority value, and
• the received frame includes a first integrity check value;
• identifying a second network device based at least on a secure channel identifier (SCI) contained in the received frame;
• determining a second VLAN ID associated with the identified second network device based at least on the identified second network device and the first VLAN ID;
• determining a second priority value associated with the identified second network device based at least on the identified second network device, the determined second VLAN ID, and the first priority value;
• computing a second integrity check value from at least a portion of the received frame, the second VLAN ID, and the second priority value;
• and
• performing an integrity check based at least on a comparison between the first integrity check value and the second integrity check value, the second VLAN ID not being included in the received frame.

A computer program product comprising instructions stored in a non-transitory computer-readable storage medium, the instructions being executable by a processor to perform operations and the instructions comprising:

• instructions to receive a frame at a first network device,
• wherein the frame is associated with a first virtual local area network identifier (VLAN ID);
• instructions to identify a second network device based at least on the frame,
• the second network device having inserted a first integrity check value into the frame;
• instructions to determine a second VLAN ID associated with the identified second network device based at least on the identified second network device and the first VLAN ID;
• instructions to generate, by the first network device, a second integrity check value based on at least a portion of the frame and the second VLAN ID;
• and
• instructions to perform an integrity check for the frame to confirm that the first integrity check value inserted into the frame by the second network device is the same as the second integrity check value generated by the first network device, wherein the second VLAN ID is not included in the frame when the integrity check is performed.