Network security devices and methods
AssigneeEMC Corporation
InventorsSima Noghanian, Patrick Mullen, Himanshu Dwivedi, Geoff Hayward, Bob Beck
Life of this patent
Estimating the term…
Abstract
An OSI layer 2 network device on the edge of a network such as a SAN is configured to replace the original source address of traffic entering the network with a known identifier or address, which is used to signify that entry point as the traffic source to the other nodes of the network. Nodes of the network recognize the new source address as a valid source address. The network device also maintains state (e.g., association of original source address with new source address/identifier) so as to translate addresses to enable reply traffic to be sent back to the original sender.
Claims21
A method of providing enhanced security to a network using a network entry device, comprising:
- receiving a first data packet from a host device at a first port of the network entry device, said first data packet having a source address field including a first network layer source address identifying the host device, a destination address field including a destination address identifying a destination device on the network, and a payload field including data;
- replacing the first network layer source address with a private address associated with the first port on the network device so as to produce a first modified data packet;
- and
- sending the first modified data packet to the destination device over the network, wherein nodes on the network recognize the private address as a valid address.
A network device that provides enhanced security to a network, the device comprising:
- a first network entry port for receiving data packets from a host device external to the network, wherein a first data packet is received from the host device, said first data packet having a source address field including a first network layer source address identifying the host device, a destination address field including a destination address identifying a destination device on the network, and a payload field including data;
- an address replacement module configured to replace network layer source addresses with private addresses, wherein the first network layer source address of the first data packet is replaced with a first private address associated with the first network entry port on the network device so as to produce a first modified data packet;
- and
- a network port coupled to the network,
- wherein the first modified data packet is sent from the network port to the destination device over the network, and wherein nodes on the network recognize the first private address as a valid address.
Dependencies are inferred from the claim text.