Abstract: In order to address the network security issues such as data storms and DoS etc, a frame-differentiation-control-based access control module is presented in this paper. Firstly, data frames from the receiving port are analyzed as the basic granularity. And then analytical keywords are generated corresponding to those data frames. Finally, the differentiated management is implemented based on the analysis for analytical keywords of data frames. Simultaneously, frame filtering, TOS/DSCP modification and forwarding vector updates are also implemented by traffic controls of data frame which base on the token bucket and counter.The function of access control module has been verified and analysis, which shows that the expected function are achieved and project applicaton requirements are satisfied.