Cisco Technology, Inc.

Hien Thi Thai

Jayaraman R Iyer

Jianxin Wang

Laurent Andriantsiferana

Anupama Anand

Andrew G Gasson

Kevin Shatzkamer

Eric Philippe Hamel

Hidde Beumer

Kevin D Shatzkarner

Andrew Fu-Chung Teng

Nishant S Jadhav

Pramod Nair

In one example, a firewall obtains a first network packet that indicates a first mobile country code of a mobile subscriber at a first time and a first mobile network code of the mobile subscriber at the first time. The firewall obtains a second network packet that indicates a second mobile country code of the mobile subscriber at a second time and a second mobile network code of the mobile subscriber at the second time. The firewall determines whether the first mobile country code is different from the second mobile country code or the first mobile network code is different from the second mobile network code. If so, the firewall determines whether a difference between the second time and the first time is less than a threshold difference. If so, the firewall associates the second network packet with a potential security threat.

Location-based identification of potential security threat

In one embodiment, two way communication between an IP phone behind a firewall and an IP phone behind a translation device is established. A network security device receives a remote packet from the translation device. The header of the remote packet includes the address of the translation device, and a payload of the remote packet includes an embedded remote address and the media port of the IP phone behind the translation device. A memory stores the media port matched with the address of the translation device. When the network security device receives a local packet from the IP phone behind the firewall destined for the IP phone behind the translation device, a controller rewrites the destination port of the local packet with the media port.

Differentiation of multiple media endpoints behind an address translation device

Apparatus, methods, and other embodiments associated with securing and authenticating multiple devices behind a network address translation (NAT) device are described. One example method includes controlling a phone proxy to provide security credential information to an Internet Protocol (IP) phone located behind the NAT device. The credentials may be selectively provided in response to receiving a certificate request from the IP phone. The certificate request includes IP phone identifying addresses. The method may also include controlling the phone proxy to update an entry in a secure IP phone data store to relate together the IP phone identifying addresses, a source port associated with the IP phone, and the fact that credential information was provided to the IP phone. This entry can mark the IP phone as an authorized phone. The entry may be addressable as a function of a least a portion of the IP phone identifying addresses.

Securing and authenticating multiple devices behind a NAT device

Facilitating packet flow in a communication network includes receiving at a defender a request packet sent from a node. The request packet is communicated to a load balancer operable to communicate the request packet to a network element server selected from a plurality of network element servers. The request packet has a destination address associated with the load balancer. A response packet is received from the network element server. The response packet has a tunnel endpoint address. Whether the tunnel endpoint address corresponds to an approved network element server is determined. The response packet is communicated to the node if the tunnel endpoint address corresponds to an approved network element server.

Facilitating packet flow in a communication network implementing load balancing and security operations

According to one embodiment of the present invention, there is provided a method for providing security in a network environment that includes receiving a flow that propagates through an access gateway. The flow is initiated by an end user associated with the flow and propagates through a network. The method also includes receiving accounting information indicative of the termination of the flow. In response, tearing down of the communication associated with the flow is initiated.

Growing community of inventors

Elk Grove, CA, United States of America

Hien Thi Thai