System and method for backing up data

• US 7,954,157 B2
• Filed: 05/25/2006
• Issued: 05/31/2011
• Est. Priority Date: 01/22/2003
• Status: Active Grant

• Current Assignee: FalconStor, Inc (Hale Capital Management LP)
• Original Assignee: FalconStor, Inc (Hale Capital Management LP)
• Inventors: Niles, Ronald S., Lam, Wai
• Primary Examiner(s): Song; Jasmine
• Application Number:
  US11/440,910
• Publication Number:
  US 20060218638A1
• Time in Patent Office: 1,832 Days
• Field of Search: 711/161, 711/162, 705/59, 705/22, 705/28, 705/72, 713/181, 713/188, 726/23, 726/26
• US Class Current: 726/23
• CPC Class Codes: G02B 15/04 by changing a part
• CPC Class Codes: G02B 26/004 based on a displacement or a deformation of a fluid
• CPC Class Codes: G02B 27/646 compensating for small deviations, e.g. due to vibration or shake movement of one or more optical elements for control of motion blur in cameras, projectors or printers G03B2205/0007; image stabilisation in cameras peculiar to the presence or use of an electronic image sensor H04N23/68
• CPC Class Codes: G02B 7/102 controlled by a microcomputer cameras with interchangeable lenses G03B17/14
• CPC Class Codes: G03B 17/17 with reflectors arranged in beam forming the photographic image, e.g. for reducing dimensions of camera
• CPC Class Codes: G03B 2205/0046 Movement of one or more optical elements for zooming for optical zoom lenses in general G02B7/10
• CPC Class Codes: G03B 2205/0069 using electromagnetic actuators, e.g. voice coils
• CPC Class Codes: G03B 3/10 Power-operated focusing
• CPC Class Codes: G03B 5/00 Adjustment of optical system relative to image or object surface other than for focusing
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1453 using de-duplication of the data
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 16/11 File system administration, e.g. details of archiving or snapshots file system backup G06F11/14
• CPC Class Codes: G06F 16/137 Hash-based content-based indexing of textual data G06F16/31
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 : the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 9/0643 : Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: Y10S 707/99953 : Recoverability
• CPC Class Codes: Y10S 707/99955 : Archiving or backup

Abstract

A method is provided to facilitate the detection of file tampering, such as a computer virus, on a computer. In one example, a digital fingerprint is generated for each file on the computer using a substantially collision-free algorithm. The digital fingerprints of the computer files are compared with digital fingerprints of the computer files generated when the files were previously saved. If the digital fingerprint of that file differs from the digital fingerprint generated when that file was previously saved, a computer virus or other tampering may exist on the file.

Claims

1. A method for detecting file tampering on a computer, comprising:

generating a first digital fingerprint for a file on a computer at a first time using a substantially collision-free algorithm;

saving the generated first digital fingerprint;

generating a second digital fingerprint for the file on the computer at a second time after the first time using a substantially collision-free algorithm;

comparing the second digital fingerprint with the first digital fingerprint; and

determining by a processor that the file has been tampered with if the first digital fingerprint differs from the second digital fingerprint.

2. The method of claim 1, further comprising:

dividing the file into data blocks, before the first time;

generating a first digital fingerprint of at least one of the data blocks, at the first time;

dividing the file into data blocks, before the second time; and

generating a second digital fingerprint of the at least one of the data blocks at the second time.

3. The method of claim 1, wherein the file tampering comprises infection by a computer virus.

4. The method of claim 1, wherein the file tampering comprises tampering by malicious software.

5. A method for detecting a computer virus on a computer, comprising:

generating a digital fingerprint of a computer virus using a substantially collision-free algorithm;

generating digital fingerprints for files on a computer using the substantially collision-free algorithm;

comparing the digital fingerprints of the files with the digital fingerprint of the computer virus; and

determining by a processor that the computer virus exists on the computer if any digital fingerprint of the files matches the digital fingerprint of the computer virus.

6. The method of claim 5, further comprising:

dividing the files into data blocks; and

generating a digital fingerprint for the data blocks.

7. A system for detecting file tampering on a computer, the computer comprising:

at least one memory device configured to store data; and

a processor configured to;

generate a first digital fingerprint for a file stored on the at least one memory device using a substantially collision-free algorithm, at a first time;

store the generated first digital fingerprint;

generate a second digital fingerprint for the file using a substantially collision-free algorithm, at a second time after the first time;

compare the second digital fingerprint with the first digital fingerprint; and

determine that the file has been tampered with if the first digital fingerprint differs from the second digital fingerprint.

8. The system of claim 7, wherein the processor is further configured to:

dividing the file into data blocks, before the first time;

generating a first digital fingerprint of at least one of the data blocks, at the first time;

dividing the file into data blocks, before the second time; and

generating a second digital fingerprint of the at least one of the data blocks, at the second time.

9. The system of claim 7, wherein the file tampering comprises infection by a computer virus.

10. The system of claim 7, wherein the file tampering comprises tampering by malicious software.

11. A system for detecting a computer virus on a computer, the computer comprising:

at least one memory device configured to store data; and

a processor configured to;

generate a digital fingerprint of the computer virus using a substantially collision-free algorithm;

generate digital fingerprints for files stored in the at least one memory device using a substantially collision-free algorithm;

compare the digital fingerprints of the files with the digital fingerprint of the computer virus; and

determine that the computer virus exists on the computer if the digital fingerprint of the computer file matches the digital fingerprint of the computer virus.

12. The system of claim 11, wherein the processor is configured to:

divide the file into data blocks before the first time; and

generate a digital fingerprint of at least one data block, at the first time.