A method for providing network security in a database server in a multi-tenant environment having a connection-based switched fabric directly connecting a plurality of database servers which provide a plurality of database services with a plurality of application servers hosting a plurality of database service consumers each of the plurality of database service consumers being associated with a different database service consumer identity, the method comprising: receiving an access control list at a database server of the plurality of database servers, wherein the access control list identifies said plurality of database services and identifies for each of said plurality of database services one or more database service consumer identities associated with one or more database service consumers allowed to access said each of said plurality of database services; receiving at the database server, a plurality of communication packets transmitted over the connection-based switched fabric directly connecting the plurality of database servers with the plurality of application servers; and performing in the database server the following steps for each communication packet of said plurality of communication packets: discarding the communication packet if it does not include any database service consumer identity, if the communication packet does include a database service consumer identity, using a database consumer identity included in the communication packet to identify the service consumer which sent the communication packet, and using said access control list in combination with said database consumer identity included in the communication packet to prevent access by the database consumer to a database service of said plurality of database services unless said access control list identifies said database service consumer as allowed to access said database service. receiving an access control list at a database server of the plurality of database servers, wherein the access control list identifies said plurality of database services and identifies for each of said plurality of database services one or more database service consumer identities associated with one or more database service consumers allowed to access said each of said plurality of database services; receiving at the database server, a plurality of communication packets transmitted over the connection-based switched fabric directly connecting the plurality of database servers with the plurality of application servers; and performing in the database server the following steps for each communication packet of said plurality of communication packets: discarding the communication packet if it does not include any database service consumer identity, if the communication packet does include a database service consumer identity, using a database consumer identity included in the communication packet to identify the service consumer which sent the communication packet, and using said access control list in combination with said database consumer identity included in the communication packet to prevent access by the database consumer to a database service of said plurality of database services unless said access control list identifies said database service consumer as allowed to access said database service. discarding the communication packet if it does not include any database service consumer identity, if the communication packet does include a database service consumer identity, using a database consumer identity included in the communication packet to identify the service consumer which sent the communication packet, and using said access control list in combination with said database consumer identity included in the communication packet to prevent access by the database consumer to a database service of said plurality of database services unless said access control list identifies said database service consumer as allowed to access said database service.