The ATM forum international consortium recently approved the first version of its security specifications aiming to protect communications over Asynchronous Transfer Mode (ATM) networks by offering data confidentiality, partner’s authentication, etc. This paper describes the architecture of one of the first ATM forum compliant security prototypes being currently developed in the European project SCAN (Secure Communications in ATM Networks). Additionally to the security management functions specified by the ATM forum to exchange encryption keys and negotiate security services, SCAN implements the possibility for end-users to modify the data flow encryption algorithm during a connection in progress, and the possibility to keep the encryption algorithm choice confidential.