Decentralized appliance virus scanning

• US 7,346,928 B1
• Filed: 12/01/2000
• Issued: 03/18/2008
• Est. Priority Date: 12/01/2000
• Status: Expired due to Term

• Current Assignee: NetApp, Inc.
• Original Assignee: Network Appliance Incorporated (NetApp, Inc.)
• Inventors: Muhlestein, Mark
• Primary Examiner(s): Revak; Christopher
• Assistant Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US09/728,701
• Time in Patent Office: 2,664 Days
• Field of Search: 713/200, 713/201, 707/1, 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 2221/2115 Third party

Abstract

The invention provides a method and system for scanning specialized computing devices for viruses. In a preferred embodiment, a filer is connected to one or more supplementary computing devices that scan requested files to ensure they are virus free prior to delivery to end users. When an end user requests a file the following steps occur: First, the filer determines whether the file requested must be scanned before delivery to the end user. Second, the filer opens a channel to one of the external computing devices and sends the filename. Third, the external computing device opens the file and scans it. Fourth, the external computing device notifies the filer the results of the file scan operation. Fifth, the filer sends the file to the end user provided the status indicates it may do so.

Claims

1. A method implemented in a storage server, the method comprising:

receiving, at the storage server, requests for a plurality of files maintained by the storage server, from at least one of a plurality of clients of the storage server;

in response to the requests for the plurality of files, causing, by the storage server, each of a plurality of cluster devices that are external to the storage server and to the plurality of clients to execute an operation on the plurality of files;

at the storage server, receiving results of the plurality of cluster devices'"'"' operations on the plurality of files from the plurality of cluster devices;

responding to said at least one of the plurality of clients regarding the requests according to said results;

wherein said operation comprises a virus scan operation; and

wherein causing, by the storage server, each of a plurality of cluster devices that are external to the storage server to execute an operation on the plurality of files includes sending an identifier and path of each of the plurality of files from the storage server to the plurality of cluster devices.

2. The method of claim 1, wherein said sending is accomplished by using non-uniform access.

3. The method of claim 1, wherein said sending is accomplished by using a communication network.

4. The method of claim 1, wherein said sending is accomplished by using a direct connection.

5. The method of claim 1, wherein responding to said at least one of the plurality of clients regarding the requests according to said results comprises:

for each of the plurality of files, sending the corresponding file to a client requesting the corresponding file if said results indicate that the corresponding file is safe to send.

6. The method of claim 5, wherein a file is considered to be safe if the file is not infected with any viruses.

7. The method of claim 1, wherein the plurality of cluster devices is a cluster of interconnected personal computers.

8. An apparatus comprising:

a processor;

a mass storage facility, the mass storage facility storing a plurality of files;

a network interface through which to communicate with a plurality of clients;

a memory coupled to the processor, the memory storing instructions which when executed by the processor, cause the processing system to perform a process, the process comprising;

receiving requests for the plurality of files from at least one of the plurality of clients;

in response to the requests for the plurality of files, requesting a plurality of cluster devices external to the apparatus and to the plurality of clients to scan the plurality of files for viruses, said requesting including sending an identifier and path of each of the plurality of files to the plurality of cluster devices; and

receiving results from the plurality of cluster devices regarding the scanning of the plurality of files; and

responding to said at least one of the plurality of clients regarding the requests according to the results.

9. The apparatus of claim 8, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using non-uniform memory access.

10. The apparatus of claim 8, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using a communications network.

11. The apparatus of claim 8, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using a direct connection.

12. The apparatus of claim 8, wherein responding to said at least one of the plurality of clients regarding the requests according to the results comprises:

for each of the plurality of files, sending the corresponding file to a client requesting the corresponding file if the results indicate that the corresponding file is safe to send.

13. The apparatus of claim 12, wherein a file is considered to be safe if the file is not infected with any virus.

14. A machine-readable medium having sequences of instructions stored therein which, when executed by a processor of a storage server, cause the processor to perform a process comprising:

receiving requests for a plurality of files maintained by the storage server from at least one of a plurality of clients of the storage server;

in response to the requests for the plurality of files, requesting a plurality of cluster devices that are external to the storage server and to the plurality of clients to scan the plurality of files for viruses, said requesting including sending an identifier and path of each of the plurality of files to the plurality of cluster devices; and

receiving results from the plurality of cluster devices regarding the scanning of the plurality of files; and

responding to said at least one of the plurality of clients regarding the requests according to the results.

15. The machine-readable medium of claim 14, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using non-uniform memory access.

16. The machine-readable medium of claim 14, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using a communications network.

17. The machine-readable medium of claim 14, wherein sending an identifier and path of each of the plurality of files to the plurality of cluster devices is accomplished by using a direct connection.

18. The machine-readable medium of claim 14, wherein responding to said at least one of the plurality of clients regarding the requests according to the results comprises:

for each of the plurality of files, sending the corresponding file to a client requesting the corresponding file if the results indicate that the corresponding file is safe to send.

19. The machine-readable medium of claim 14, wherein a file is considered to be safe if the file is not infected with any virus.

20. An apparatus comprising:

a processor;

a mass storage facility, the mass storage facility storing a plurality of files;

a network interface through which to communicate with a plurality of clients;

a memory coupled to the processor, the memory storing instructions which when executed by the processor, cause the processing system to perform a process, the process comprising;

receiving a first request for a file of the plurality of files from a first client of the plurality of clients;

in response to the first request, requesting a cluster device of a plurality of cluster devices external to the apparatus and to the plurality of clients to scan the file for viruses, said requesting including sending an identifier and path of each of the plurality of files to the cluster device of the plurality of cluster devices; and

receiving a result from the cluster device regarding the scanning of the file; and

responding to the first request by sending the file to the first client if the result indicates that the file is not infected with any virus.

21. The apparatus of claim 20, wherein the process further comprises:

storing the result;

receiving a second request for the file from a second client of the plurality of clients; and

determining whether it is safe to send the file to the second client based on the result.