Securing and authenticating multiple devices behind a NAT device

A non-transitory computer-readable medium storing computer executable instructions that when executed by a computer control the computer to perform a method, the method comprising:

• controlling a phone proxy to provide security credential information to an Internet Protocol (IP) phone located behind a network address translation (NAT) device in response to receiving a certificate request from the IP phone, where the certificate request includes IP phone identifying addresses, the IP phone being one of a set of IP phones located behind the NAT device;
• controlling the phone proxy to update an entry in a secure IP phone data store to relate together the IP phone identifying addresses, a source port associated with the IP phone, and a binary value indicating the fact that the credential information was provided to the IP phone, which marks the IP phone as an authorized phone, the entry being addressable as a function of a least a portion of the IP phone identifying addresses;
• and controlling a security proxy to selectively authenticate the IP phone in response to receiving a connection request from the IP phone, where the connection request includes the IP phone identifying addresses, and where the authentication is based, at least in part, on data stored in the secure IP phone data store that is addressable by the IP phone identifying addresses.