Isolating services across a single physical network interface

One or more computer storage media storing computer executable instructions which, when executed by a gateway that connects one or more user devices to a network, implement a method for modifying frames to include a service-specific identifier, the method comprising:

• receiving, via a port of the gateway, a first frame;
• evaluating contents of the first frame;
• comparing the contents of the first frame against entries of an ID table;
• determining that the contents of the first frame match a first set of criteria defined in a first entry of the ID table;
• modifying the first frame to include a first ID defined in the first entry;
• and
• forwarding the modified first frame over the network.

A software-defined network architecture comprising:

• a gateway that includes an inbound port to which one or more user devices are connected and an outbound port by which the gateway connects to one or more switches of a network;
• and
• an edge switch that connects multiple service provider networks to the one or more switches of the network;
• wherein the gateway includes an ID table that defines entries each of which associates a unique ID with matching criteria, and wherein the gateway is configured to evaluate frames that are received from the one or more user devices via the inbound port against the entries in the ID table such that, when contents of a particular frame matches the matching criteria of a particular entry, the gateway modifies the particular frame to include the associated unique ID before forwarding the frame over the outbound port.