Optimized network cache for virus scanning by examining the magic bytes of a file

• US 20070038637A1
• Filed: 10/19/2005
• Published: 02/15/2007
• Est. Priority Date: 08/12/2005
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Martin, John, Taneja, Manik
• Granted Patent: US 7,620,991 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

A system and method is provided for reliably detecting the file type of a client-requested file and by-passing conventional ICAP processing if the detected file type corresponds to a non-viral file. The client-requested file is examined to determine whether it contains a predefined byte pattern (or “file signature”) corresponding to a non-viral file type. The file signature may be embodied as one or more predetermined “magic bytes” located at known file offsets. For instance, the client-requested file may be identified as a particular type of image file if it contains the set of magic bytes associated with that image file format. Unlike prior implementations, when the client-requested file is determined to contain magic bytes corresponding to a non-viral file type, such as an image file, the file is returned to the requesting client without performing conventional ICAP virus-scanning operations.

Claims

1. A method for processing file-access requests at a network device, the method comprising:

receiving a file-access request at the network device, the file-access request specifying a client-requested file to return to a requesting client;

retrieving the client-requested file;

determining whether the client-requested file includes a predefined byte pattern corresponding to a non-viral file type;

forwarding a file-access response containing the client-requested file to the requesting client if the client-requested file is determined to include the predefined byte pattern; and

forwarding the file-access response to a remote server if the client-requested file is determined not to include the predefined byte pattern, the remote server being configured to scan the client-requested file for viruses.

2. The method of claim 1, wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.

3. The method of claim 1, wherein the network device is a network caching device.

4. The method of claim 3, wherein the network device is configured as a reverse-proxy cache.

5. The method of claim 3, wherein the network device is configured as a forward-proxy cache.

6. The method of claim 1, wherein the predefined byte pattern contains a single sequence of bytes.

7. The method of claim 1, wherein the predefined byte pattern contains multiple byte sequences.

8. The method of claims 6 or 7, wherein the non-viral file type corresponds to a type of image file.

9. The method of claim 8, wherein the image file is a Joint Picture Expert'"'"'s Group (JPEG) file type.

10. The method of claim 8, wherein the image file is a Graphics Interchange Format (GIF) file type.

11. A network device, comprising:

means for receiving a file-access request at the network device, the file-access request specifying a client-requested file to return to a requesting client;

means for retrieving the client-requested file;

means for determining whether the client-requested file includes a predefined byte pattern corresponding to a non-viral file type;

means for forwarding a file-access response containing the client-requested file to the requesting client if the client-requested file is determined to include the predefined byte pattern; and

means for forwarding the file-access response to a remote server if the client-requested file is determined not to include the predefined byte pattern, the remote server being configured to scan the client-requested file for viruses.

12. The network device of claim 11, wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.

13. The network device of claim 11, wherein the network device is a network caching device.

14. The network device of claim 11, wherein the predefined byte pattern contains a single sequence of bytes.

15. The network device of claim 11, wherein the predefined byte pattern contains multiple byte sequences.

16. A network device, comprising:

a processor;

a first network interface adapted to receive a file-access request, the file-access request specifying a client-requested file to return to a requesting client;

a second network interface adapted to communicate with a remote server, the remote server being configured to scan the client-requested file for viruses; and

a memory adapted to store instructions which are executable by the processor for performing the steps of;

retrieving the client-requested file;

determining whether the client-requested file includes a predefined byte pattern corresponding to a non-viral file type;

forwarding a file-access response containing the client-requested file over the first network interface to the requesting client if the client-requested file is determined to include the predefined byte pattern; and

forwarding the file-access response over the second network interface to the remote server if the client-requested file is determined not to include the predefined byte pattern.

17. The network device of claim 16, further comprising:

at least one storage device adapted to store the client-requested file; and

a storage adapter configured to retrieve the client-requested file from the at least one storage device in response to the instructions for retrieving the client-requested file.

18. The network device of claim 16, wherein the remote server is an Internet Content Adaptation Protocol (ICAP) server.

19. The network device of claim 16, wherein the network device is a network caching device.

20. The network device of claim 16, wherein the predefined byte pattern contains a single sequence of bytes.

21. The network device of claim 16, wherein the predefined byte pattern contains multiple byte sequences.

22. A network, comprising:

a client device configured to transmit a file-access request specifying a client-requested file;

a server device configured to scan the client-requested file for viruses; and

a network device adapted to receive the client-requested file and further configured to;

retrieve the client-requested file;

determine whether the client-requested file includes a predefined byte pattern corresponding to a non-viral file type;

forward a file-access response containing the client-requested file to the client device if the client-requested file is determined to include the predefined byte pattern; and

forward the file-access response to the server device if the client-requested file is determined not to include the predefined byte pattern.

23. The network of claim 22, wherein the server device is an Internet Content Adaptation Protocol (ICAP) server.

24. The network of claim 22, wherein the network device is a network caching device.

25. The network of claim 22, wherein the predefined byte pattern contains a single sequence of bytes.

26. The network of claim 22, wherein the predefined byte pattern contains multiple byte sequences.