Integrating anti-virus in a clustered storage system

• US 8,302,192 B1
• Filed: 04/30/2008
• Issued: 10/30/2012
• Est. Priority Date: 04/30/2008
• Status: Expired due to Fees

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Cnudde, Isabelle, Dongre, Rommel
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US12/113,074
• Time in Patent Office: 1,644 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/24
• CPC Class Codes: G06F 11/30 Monitoring
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/301 where the computing system is a virtual computing platform, e.g. logically partitioned systems virtual machines G06F9/45533; logical partitioning of resources G06F9/5077
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0664 at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method and system for integrating anti-virus in a clustered storage system. A clustered storage system provides anti-virus scanning with third-party software components. Specifically, the clustered storage system receives a request to access data from a client, retrieves the data from storage, and scans the data for viruses with third party software components that have been previously provided any one of a number of third party software vendors. If the data is free of viruses, the clustered storage system communicates the data to the client. Otherwise, the clustered storage system attempts to apply remedial actions to the infected file. For example, the clustered storage system may attempt to repair the file by removing the virus. If remedial action successfully removes the virus, the clustered storage system communicates the requested data to the client. Otherwise, the clustered storage system communicates an access denied message to the client.

Claims

1. A method for scanning data for viruses, the method comprising:

receiving a request for the data at a network N-module included in a clustered storage system, the clustered storage system including nodes that are interconnected as a cluster to communicate over a communication fabric to facilitate storage of the data on the clustered storage system;

identifying at the network N-module the data requires scanning for viruses based on a predetermined criterion;

communicating the data requires the scanning for viruses based on the predetermined criterion as first result information to a disk D-module included in the clustered storage system;

identifying at the disk D-module the data requires scanning for viruses based on a first plurality of anti-virus attributes stored with the data;

communicating the data requires scanning for viruses based on the first plurality of anti-virus attributes stored with the data as second result information to a management M-module included in the clustered storage system; and

scanning at the management M-module the data for viruses, the scanning performed with third party software components that are provided by a third party vendor.

2. The method of claim 1, wherein the receiving the request for the data includes receiving a request, over a network, to access a file that includes the data.

3. The method of claim 2, wherein the identifying whether the data requires the scanning for viruses includes identifying whether the file requires scanning for viruses based on a business rule that includes the predetermined criterion.

4. The method of claim 2, wherein the receiving the request to access the file includes receiving a request in any one of a group of network protocols including a common internet file system (CIFS) protocol and a network file system protocol (NFS).

5. The method of claim 4, wherein the nodes includes a first node and a second node and further including the first node receiving the request in any one of the network protocols and communicating the request in a second protocol to the second node.

6. The method of claim 5, wherein the scanning the data for the viruses is performed on the second node.

7. The method of claim 1, further including generating a second plurality of antivirus attributes based on the scanning the data for viruses, wherein the second plurality of antivirus attributes include a scan status and a version identifier that identifies a version of the third party software components.

8. The method of claim 1, further including receiving an updated version of third party software components from a third party vendor, the third party software components are used for the scanning the data for viruses.

9. The method of claim 8, wherein the updated version of third party software components include an anti-virus scan engine and antivirus definitions that are associated with a version identifier.

10. A clustered storage system for scanning data for viruses, the clustered storage system comprising:

at least one processor, the clustered storage system including nodes that are interconnected as a cluster to communicate over a communication fabric to facilitate storage of the data in the clustered storage system; and

a memory in communication with the at least one processor, the memory comprising a plurality of instructions executable by the at least one processor, wherein the plurality of instructions are executed by the at least one processor, the clustered storage system is configured to;

receive a request for the data at a network N-module included in the clustered storage

system,

identify at the network N-module the data requires a scan for viruses based on a

predetermined criteria,

communicate the data requires the scan for viruses based on the predetermined criteria as first result information to a disk D-module included in the clustered storage system, identify at the disk D-module the data requires a scan for viruses based on a first plurality of anti-virus attributes stored with the file,

communicate the data requires the scan for viruses based on the first plurality of anti-virus attributes stored with the file as second result information to a management M-module included in the clustered storage system, and

scan at the management M-module the data for the viruses, the scan performed with third party software components that are provided by a third party vendor.

11. The clustered storage system of claim 10, wherein the at least one processor is being configured to receive a request that includes a demand to scan a file for viruses, the file to include the data.

12. The clustered storage system of claim 11, wherein the predetermined criteria includes a business rule that includes a file extension criterion that matches a file extension appended to the file.

13. The clustered storage system of claim 11, wherein the request for data includes a request to access a file and wherein the request is received in a network file system protocol (NFS) and wherein the at least one processor is further being configured to identify whether the data requires scanning for viruses based on a permission level associated with the file.

14. The clustered storage system of claim 13, wherein the nodes includes a first node and a second node and wherein the first node is to receive the request in any one of the network protocols and to communicate the request to the second node in a second protocol.

15. The clustered storage system of claim 14, wherein the first node includes a first anti-virus scan engine that is received at the clustered storage system from a first vendor repository and the second node includes a second anti-virus scan engine that is received at the clustered storage system from the first vendor repository.

16. The clustered storage system of claim 11, wherein the at least one processor is further being configured to identify whether the file requires the scan for viruses based on a business rule that identifies whether the data is persistently stored in a predetermined location on a storage device.

17. The clustered storage system of claim 10, wherein the at least one processor is further being configured to:

generate a scan status based on the scanning the data; and

persistently store the scan status and an anti-virus version identifier, wherein the anti-virus version identifier identifies the third party software components that are used by the at least one processor to generate the scan status.

18. The clustered storage system of claim 10, wherein the nodes include a first and second node and the at least one processor is further being configured to:

update an anti-virus scan engine and virus definitions on the first and second nodes to enable the first and second nodes to scan the data for viruses, wherein the anti-virus scan engine and the virus definitions are retrieved from a first vendor repository operated by a first vendor.

19. A clustered storage system for scanning data for viruses, the system comprising:

at least one processor, the clustered storage system including nodes that are interconnected as a cluster to communicate over a communication fabric to facilitate storage of the data in the clustered storage system; and

a machine readable medium in communication with the at least one processor, the machine readable medium being configured to store a plurality of instructions executable by the at least one processor to cause the clustered storage system to;

receive a request for the data at a network N-module included in the clustered storage

system,

identify at the network N-module the data requires a scan for viruses based on a predetermined criteria,

communicate the data requires the scan for viruses based on the predetermined criteria as first result information to a disk D-module included in the clustered storage system,

identify at the disk D-module the data requires a scan for viruses based on a first plurality of anti-virus attributes stored with the file,

communicate the data requires the scan for viruses based on the first plurality of anti-virus attributes stored with the file as second result information to a management M-module included in the clustered storage system, and

scan at the management M-module the data for the viruses, the scan performed with third party software components that are provided by a third party vendor.

20. The clustered storage system of claim 19, wherein the nodes include a first node and a second node and wherein the at least one processor is further being configured to retrieve a file that contains the data from a storage device that is coupled to the first node and quarantine the file to a storage device that is coupled to the second node.