COMBINING VIRUS CHECKING AND REPLICATION FILTRATION

• US 20070283438A1
• Filed: 06/02/2006
• Published: 12/06/2007
• Est. Priority Date: 06/02/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Fries, Robert M., Somji, Shiraz M.
• Granted Patent: US 7,730,538 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 21/562 Static detection

Abstract

Data in backup systems can be effectively protected against viruses, even if definitions for certain viruses are found after infected data have been backed up to a backup server. In one implementation, a combined filter that includes antivirus and replica filtering components can identify and process I/O system calls (e.g., including writes to files). If a virus is present, the antivirus component of the combined filter can mark the file and/or file write (and cleanse the file/file write), and pass that information to the replica component. If the file write is associated with a file to be backed up, the replica component can then pass along the antivirus filter'"'"'s indications with a copy of the file write. The backup server can also identify that previous versions of the file stored at the backup server may have been infected, and can thus perform any appropriate actions.

Claims

1. At a production server in a computerized environment in which the production server is backed up by one or more backup servers, a method of managing virus and backup filtration processes through a common filter, comprising the acts of:

identifying one or more writes to files through a common filter;

scanning the identified one or more file writes at the common filter in accordance with one or more virus definitions;

comparing the identified one or more scanned file writes at the common filter with one or more replica policies; and

sending a copy of at least one of the one or more scanned file writes to a log file, such that the at least one file write is replicated to a backup server.

2. The method as recited in claim 1, further comprising an act of identifying at least one of the one or more file writes as infected with any of the one or more viruses.

3. The method as recited in claim 2, further comprising an act of marking the at least one file write with one or more virus indicators before the one or more file writes are compared with the one or more replica configurations.

4. The method as recited in claim 3, wherein the one or more virus indicators identify that the virus was identified but not removed.

5. The method as recited in claim 3, further comprising an act of removing any of the one or more viruses infecting the at least one file, wherein the one or more virus indicators identify that the at least one file write was present but now removed.

6. The method as recited in claim 3, further comprising an act of storing a copy of the at least one file write in the log file with the one or more virus indicators.

7. The method as recited in claim 3, further comprising an act of sending the at least one file write and the corresponding one or more virus indicators to the backup server, such that the backup server can identify an association between the at least one file write and the one or more virus indicators.

8. The method as recited in claim 7, further comprising an act of sending one or more indicators to the backup server that prior data associated with the infected at least one file write is also infected.

9. The method as recited in claim 3, further comprising an act of determining not to replicate the infected at least one file write.

10. The method as recited in claim 1, further comprising the acts of:

receiving one or more requests to recover data stored at the backup server;

identifying that at least one of the one or more requests references data that is associated with one or more virus indicators.

11. The method as recited in claim 10, further comprising an act of sending one or more responses to the one or more requests based on the identified virus indicators.

12. The method as recited in claim 11, wherein at least one of the one or more responses indicates that the requested data:

(i) is associated with one or more viruses;

(ii) cannot be recovered due to one or more viruses;

or

(iii) can only be recovered if the one or more viruses are first removed.

13. At a backup server in a computerized environment in which the backup server backs up data at one or more production servers, a method of managing replicated data in accordance with one or more virus indicators provided by a common filter at one or more production servers, comprising the acts of:

receiving one or more data backups from one or more production servers;

identifying one or more virus indicators in the received one or more data backups, wherein the one or more virus indicators identify that at least one of the one or more data backups is associated with infected data;

identifying one or more policies for the backup server, wherein the one or more policies identify one or more response actions corresponding to the one or more virus indicators; and

executing any of the one or more response actions in accordance with the one or more policies.

14. The method as recited in claim 13, wherein the any of the one or more response actions include an act of removing one or more viruses from any of the received one or more data backups associated with the one or more virus indicators.

15. The method as recited in claim 13, wherein the any of the one or more response actions include the acts of:

cleansing at least a portion of the one or more data backups associated with the one or more virus indicators; and

cleansing a prior copy of the portion stored at the backup server.

16. The method as recited in claim 13, wherein the any of the one or more response actions include an act of identifying that a baseline copy of data is associated with one or more viruses based at least in part by identifying the one or more virus indicators of any of the one or more data backups.

17. The method as recited in claim 16, further comprising the acts of:

receiving one or more requests for data associated with the baseline copy of data at the backup server; and

sending a response that at least a portion of the requested data has been associated with one or more virus indicators.

18. At a production server in a computerized environment in which the production server is backed up by one or more backup servers, a computer-readable medium having computer-executable instructions stored thereon that, when executed, cause one or more processors to perform a method comprising the acts of:

identifying one or more writes to files through a common filter;

scanning the identified one or more file writes at the common filter in accordance with one or more virus definitions;

comparing the identified one or more scanned file writes at the common filter with one or more replica policies; and

sending a copy of at least one of the one or more scanned file writes to a log file, such that the at least one file write is replicated to a backup server.