Decentralized virus scanning for stored data

• US 20020103783A1
• Filed: 11/30/2001
• Published: 08/01/2002
• Est. Priority Date: 12/01/2000
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Muhlestein, Mark
• Granted Patent: US 7,523,487 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

The invention provides a method and system for performing specialized services for files at a server, such as scanning files for viruses. A filer or other server is connected to one or more supplementary computing devices that scan requested files to ensure they are virus free prior to delivery to end users. When an end user requests a file the following steps occur: The server determines whether the file requested must be scanned before delivery to the end user. The server opens a channel to one of the external computing devices and sends the filename. The external computing device opens the file and scans it. The external computing device notifies the filer the results of the file scan operation. The server sends the file to the end user provided the status indicates it may do so.

Claims

1. A method including receiving a user request for an object at a server;

performing an operation on data associated with said object at a cluster device, said operation including accessing said object at said server; and

conditionally allowing access to said object in response to said user request and a result of said operation.

2. A method as in claim 1, including conditioning said operation on a feature of said object, said feature including at least one of:

a file name, a file type, a file-system share.

3. A method as in claim 1, including conditioning said operation on an intersection of a feature of said object, said feature including at least one of:

a file name, a file type, a filesystem share; and

a type of access associated with said user request;

wherein said operation is performed for an intersection of at least one said feature and at least one type of access.

4. A method as in claim 1, including persistently recording a result of said operation in association with said object.

5. A method as in claim 1, including selecting said cluster device to perform said operation in response to a priority class associated with said cluster device.

6. A method as in claim 1, wherein said operation includes a plurality of processes, each one process being performed at a separate cluster device.

7. A method as in claim 1, wherein said operation includes at least one of:

virus scanning, encryption or decryption, compression or decompression.

8. A method as in claim 1, wherein said operation includes

setting a timeout at said server;

resetting said timeout in response to receiving a response from said cluster device to a protocol message asking if said cluster device is still working on said operation; and

determining that said operation is successful in response to receiving a response from said cluster device before said timeout expires.

9. A method as in claim 1, including assigning an access type to said cluster device, said access type allowing said cluster device to perform said operation notwithstanding user locks associated with said object.

10. A method as in claim 9, including restricting said access type in response to at least one of:

a selected set of network addresses for said cluster device, a selected set of domain names for said cluster device, a selected set of user names at said cluster device, a selected set of interfaces between said server and said cluster device.

11. A method as in claim 1, including

at a first time, recording a result of said operation for said object;

and

at a second time, conditioning said operation on said result.

12. A method as in claim 11, wherein said result includes at least one of:

a time when said operation was performed, remedial measures taken in response to said operation, whether access was allowed in response to said operation.

13. A method as in claim 1, including conditioning said operation on a type of access associated with said user request.

14. A method as in claim 13, wherein said operation is performed before allowing access to said object for requests including read access.

15. A method as in claim 13, wherein said operation is performed after allowing access to said object for requests including write access.

17. Apparatus as in claim 16, wherein said first message is responsive to a feature of said object, said feature including at least one of:

a file name, a file type, a filesystem share.

18. A method as in claim 16, wherein said first message is responsive to an intersection of

a feature of said object, said feature including at least one of:

a file name, a file type, a filesystem share; and

a type of access associated with said user request.

19. Apparatus as in claim 16, wherein said first message is directed at a selected said cluster device in response to a priority class associated with said cluster device.

20. Apparatus as in claim 16, including a plurality of said first messages directed at separate said cluster devices in response to a single said user request.

21. Apparatus as in claim 16, wherein said second message includes a result of at least one of:

virus scanning, encryption or decryption, compression or decompression.

22. Apparatus as in claim 16, including a persistent record of at least some information responsive to said second message, said persistent record being associated with said object.

23. Apparatus as in claim 22, wherein said persistent record includes at least one of:

a time when said second message was received, remedial measures taken by said cluster device in response to said first message, whether access was allowed in response to said user request.

24. Apparatus as in claim 16, wherein said conditional access is responsive to a type of access associated with said user request.

25. Apparatus as in claim 24, wherein said second message is received before allowing access to said object for user requests including read access.

26. Apparatus as in claim 24, wherein said first message is sent after allowing access to said object for user requests including write access.

28. Memory or mass storage as in claim 27, including instructions directing said computing device to condition said operation on a feature of said object, said feature including at least one of:

a file name, a file type, a filesystem share.

29. Memory or mass storage as in claim 27, including instructions directing said computing device to condition said operation on an intersection of

a feature of said object, said feature including at least one of:

a file name, a file type, a filesystem share; and

a type of access associated with said user request;

wherein said operation is performed for an intersection of at least one said feature and at least one type of access.

30. Memory or mass storage as in claim 27, including instructions directing said computing device to persistently record a result of said operation in association with said object.

31. Memory or mass storage as in claim 27, including instructions directing said computing device to select said cluster device to perform said operation in response to a priority class associated with said cluster device.

32. Memory or mass storage as in claim 27, wherein said operation includes a plurality of processes, each one process being performed at a separate cluster device.

33. Memory or mass storage as in claim 27, wherein said operation includes at least one of:

virus scanning, encryption or decryption, compression or decompression.

34. Memory or mass storage as in claim 27, wherein said operation includes setting a timeout at said server;

resetting said timeout in response to receiving a response from said cluster device to a protocol message asking if said cluster device is still working on said operation; and

determining that said operation is successful in response to receiving a response from said cluster device before said timeout expires.

35. Memory or mass storage as in claim 27, including instructions directing said computing device to assigning an access type to said cluster device, said access type allowing said cluster device to perform said operation notwithstanding user locks associated with said object.

36. Memory or mass storage as in claim 35, including instructions directing said computing device to restrict said access type in response to at least one of:

a selected set of network addresses for said cluster device, a selected set of domain names for said cluster device, a selected set of user names at said cluster device, a selected set of interfaces between said server and said cluster device.

37. Memory or mass storage as in claim 27, including instructions directing said computing device to

at a first time, record a result of said operation for said object;

and

at a second time, condition said operation on said result.

38. Memory or mass storage as in claim 37, wherein said result includes at least one of:

a time when said operation was performed, remedial measures taken in response to said operation, whether access was allowed in response to said operation.

39. Memory or mass storage as in claim 27, including instructions directing said computing device to condition said operation on a type of access associated with said user request.

40. Memory or mass storage as in claim 39, wherein said operation is performed before allowing access to said object for requests including read access.

41. Memory or mass storage as in claim 39, wherein said operation is performed after allowing access to said object for requests including write access.

16. Apparatus including

a server having a set of objects and a network interface;

a user request for at least one requested one of said objects;

a cluster device;

a first message from said server to said cluster device, said first message indicating said requested one object;

a second message from said cluster device to said server, said second message indicating a result of an operation performed on said requested one object; and

a response to said user request, said response including conditional access to said object in response to said second message.

27. Memory or mass storage including instructions interpretable by a computing device, said instructions directing said computing device to receive a user request for an object at a server;

perform an operation on data associated with said object at a cluster device, said operation including accessing said object at said server; and

conditionally allow access to said object in response to said user request and a result of said operation.