the non-routability of aoe is the only security mechanism (i.e., an intruder can't connect through a router—they must physically plug into the local ethernet switch where ethernet frame tunneling over routed networks is not in use). however, there are no aoe-specific mechanisms for password verification or encryption. the protocol provides for aoe targets such as coraid storage appliances, vblade and ggaoed to establish access lists ("masks") allowing connections only from specific mac addresses (although these can be spoofed). most secure aoe by using ethernet vlans.