1. A method for detecting unauthorized hardware devices in a local area network, comprising steps of:
scanning ports of a plurality of hardware devices to retrieve MAC addresses thereof;
filtering an uplink port on each of the hardware devices to acquire a first MAC address list;
calculating the number of MAC addresses of the filtered ports to acquire a second MAC address list; and
subtracting the number of ports with more than two MAC addresses on the first MAC address list from the number of ports with more than two MAC addresses on the second MAC address list, thereby obtaining at least one unauthorized MAC address.
2. The method as claimed in claim 1, further comprising steps of:
comparing the MAC addresses of the unauthorized hardware devices with MAC addresses in a routing entry table to obtain Internet Protocol (IP) addresses of the unauthorized hardware devices; and
acquiring user information for the unauthorized hardware devices by SNMP or WINS services in accordance with the IP address of the unauthorized hardware devices.
3. The method as claimed in claim 1, wherein in the scanning step, the ports of the authorized hardware devices are recursively scanned by one of the authorized network devices.
4. The method as claimed in claim 1, wherein in the scanning step, the MAC addresses of authorized hardware devices are stored in a database.
5. The method as claimed in claim 1, wherein in the scanning step, the ports of authorized network devices are scanned by simple network management protocol.
6. The method as claimed in claim 1, wherein a simple network management protocol is used in the calculating step.
7. A system for detecting unauthorized hardware devices in a local area network, comprising:
a device detection unit for scanning a plurality of ports of a plurality of hardware devices to retrieve MAC addresses thereof, filtering an uplink port of each hardware device to acquire a first MAC address list, and calculating the number of MAC addresses of the ports of the network devices to acquire a second MAC address list; and
a device processing unit, coupled with the device detection unit, for subtracting the number of ports with more than two MAC addresses on the first MAC address list from the number of ports with more than two MAC addresses on the second MAC address list, thereby obtaining at least one unauthorized MAC address.
8. The system as claimed in claim 7, wherein the device processing unit compares the MAC addresses of the unauthorized hardware devices with MAC addresses in a routing entry table to obtain Internet Protocol (IP) addresses of unauthorized hardware devices, and acquire user information of the unauthorized hardware devices by SNMP or WINS services.
9. The system as claimed in claim 7, wherein the device detection unit recursively scans the ports of the hardware devices.
10. The system as claimed in claim 7, wherein the device detection unit stores the MAC addresses of the hardware devices in a database.
11. The system as claimed in claim 7, wherein the device detection unit scans the ports of the network devices by simple network management protocol.
12. A storage medium containing a stored computer program providing a method for detecting unauthorized hardware devices, comprising using a computer to perform the steps of:
scanning a plurality of ports of a plurality of hardware devices to retrieve MAC addresses thereof;
filtering an uplink port of each hardware device to acquire a first MAC address list;
calculating the number of MAC addresses of the ports of the network devices to acquire a second MAC address list; and
subtracting the number of ports with more than two MAC addresses on the first MAC address list from the number of ports with more than two MAC addresses on the second MAC address list, thereby obtaining at least one unauthorized MAC address.
13. The storage medium as claimed in claim 12, further comprising steps of:
comparing the MAC addresses of the unauthorized hardware devices with MAC addresses in a routing entry table to obtain Internet Protocol (IP) addresses of unauthorized hardware devices; and
acquiring user information of the unauthorized hardware devices by SNMP or WINS services in accordance with the IP address of the unauthorized hardware devices.
14. The storage medium as claimed in claim 12, wherein the ports of the hardware devices are recursively scanned by one of the authorized network devices.
15. The storage medium as claimed in claim 12, wherein the MAC addresses of the hardware devices are stored in a database.
16. The storage medium as claimed in claim 12, wherein the ports of the network devices are scanned by simple network management protocol.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A computer readable medium containing executable instructions for protecting the secrecy and integrity of data stored on a non-volatile storage medium, the executable instructions including instructions for:
receiving a block of data for storage on the non-volatile storage medium;
generating at least one piece of meta-data relating to the block of data;
calculating a first cryptographic hash of at least a portion of the block of data;
calculating a second cryptographic hash of the meta-data;
encrypting the block of data and encrypting the meta-data to form one or more uniform blocks of encrypted data;
storing a cryptographic key in a substantially secret storage medium, the key being operable to decrypt the one or more uniform blocks of encrypted data; and
storing the one or more uniform blocks of encrypted data on the non-volatile storage medium.
2. The computer readable medium of claim 1, wherein the executable instructions further include instructions for:
receiving a request for the block of data;
retrieving the cryptographic key from the secret storage medium;
retrieving the one or more uniform blocks of encrypted data from the non-volatile storage medium;
decrypting the one or more uniform blocks of encrypted data to yield a decrypted version of the block of data and a decrypted version of the meta-data;
calculating a third cryptographic hash by hashing the decrypted version of the block of data;
calculating a fourth cryptographic hash by hashing the decrypted version of the meta-data;
comparing the third cryptographic hash with the first cryptographic hash; and
granting the request for the block of data if the third cryptographic hash is equal to the first cryptographic hash.
3. The computer readable medium of claim 1, wherein the one or more uniform blocks of data are stored on the non-volatile storage medium in a log-structured file.
4. The computer readable medium of claim 1, wherein the executable instructions further include instructions for:
generating a hierarchical location map for use in locating the one or more uniform blocks of encrypted data on the non-volatile storage medium, the location map comprising one or more nodes, a first node of which contains the first cryptographic hash and an indicator specifying the location on the non-volatile storage medium of the portion of the block of data to which the first cryptographic hash corresponds.
5. The computer readable medium of claim 4, wherein the executable instructions further include instructions for:
computing a third cryptographic hash by hashing data contained in said first node;
encrypting the data contained in said first node; and
storing the data contained in said first node on the non-volatile storage medium.
6. The computer readable medium of claim 5, wherein the executable instructions further include instructions for:
storing the third cryptographic hash in a second node of said hierarchical location map; and
storing in said second node of said hierarchical location map an indicator specifying the location on the non-volatile storage medium of the first node.
7. A computer readable medium containing executable instructions for managing the storage of a plurality of data blocks on a storage medium, the executable instructions including instructions for:
storing the plurality of data blocks on the storage medium;
generating a hierarchical location map for locating individual ones of said plurality of blocks, the hierarchical location map including a plurality of nodes, wherein a first node type includes:
one or more hash values of subordinate nodes or data blocks; and
one or more location indicators specifying the location at which subordinate nodes or data blocks are stored on said storage medium; and
wherein a second node type includes:
a hash value of a subordinate node;
a location indicator specifying the location at which the subordinate node is stored on said storage medium; and
a cryptographic key for decrypting data contained in one or more subordinate nodes.
8. The computer readable medium of claim 7, in which the plurality of data blocks are stored on the storage medium in a log-structured file.
9. The computer readable medium of claim 7, wherein the second node type further includes an indicator of the type of cryptographic algorithm used to encrypt the data contained in one or more subordinate nodes.
10. The computer readable medium of claim 9, wherein the location map contains at least a first and second node of the second node type, and wherein the first and second nodes of the second node type contain different cryptographic keys, and indicators specifying different cryptographic algorithms.