Systems and methods for grid-based data scanning

• US 8,356,018 B2
• Filed: 11/11/2010
• Issued: 01/15/2013
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Lunde, Norman R.
• Primary Examiner(s): PANNALA, SATHYANARAYA R
• Application Number:
  US12/944,533
• Publication Number:
  US 20110060725A1
• Time in Patent Office: 796 Days
• Field of Search: 707/640, 707/692, 455/566
• US Class Current: 707/692
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computing grid for performing scanning operations on electronic data in a networked computing environment. The data scanning operations may include scanning data for viruses or other malicious software code. The computing grid for performing data scanning operations may include one or more event detectors to detect data scanning events and one or more grid scanning elements to perform the data scanning operations. The computing grid may also include a grid coordinator to monitor the grid configuration, perform necessary updates to the grid, and to take pre-determined actions based on the results of the data scans.

Claims

1. A computer system for scanning electronic data, the system comprising:

a computing grid of processors that are separate from a file system comprising a plurality of files,

wherein the computing grid of processors receive information about the plurality of files,

the computing grid of processors comprising one or more distributed scanning elements configured to perform data scanning operations on the plurality of files,

wherein the one or more distributed scanning elements are configured to;

determine, based on pathnames of the plurality of files, which scanning element is to process data in the plurality of files; and

based on the determination as to which scanning element is to process the data in the plurality of files,

distribute the data scanning operations amongst the one or more distributed scanning elements; and

distribute a computing load amongst the processors in the computing grid of processors.

2. The computer system of claim 1, further comprising one or more data storage devices that are accessible to the computing system via a Storage Area Network, a Network Attached Storage unit, or a combination of the two.

3. The computer system of claim 1, further comprising a data scanning event message that comprises a multi-cast message from an event detector to the one or more scanning elements.

4. The computer system of claim 3, wherein a data scanning event comprises the creation of new data.

5. The computer system of claim 3, wherein a data scanning event comprises an attempted modification to existing data.

6. The computer system of claim 1, wherein the one or more scanning elements are configured to generate a scan report after having completed a data scan and further comprising a grid coordinator to receive the scan report and to take a user-defined action based on the report.

7. The computer system of claim 6, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

8. The computer system of claim 1, further comprising one or more event detectors configured for integration with a data storage system, the data storage system configured to perform storage-related operations for one or more networked client computers.

9. The computer system of claim 8, wherein the storage-related operations comprise data backup, migration, or recovery.

10. The computer system of claim 8, wherein the storage system comprises modular storage cells which can be added to or subtracted to provide more or less storage capacity and storage operation functionality.

11. The computer system of claim 1, wherein each of the one or more scanning elements independently performs an operation to determine whether to handle a particular file.

12. The computer system of claim 1, wherein the one or more scanning elements scan event-causing data for viruses or other malicious software code.

13. The computer system of claim 1, wherein the one or more scanning elements scan event-causing data for content violations of a local administrator policy.

14. The computer system of claim 1, wherein the one or more event detectors comprise a local area network (LAN) sniffer or a Storage Area Network (SAN) sniffer.

15. A method comprising:

scanning a plurality of files in a file system with a computing grid of processors,

wherein the computing grid of processors are separate from the file system,

wherein the computing grid of processors comprise one or more distributed scanning elements configured to perform data scanning operations on the plurality of files, and

wherein the one or more distributed scanning elements are configured to;

determine, based on pathnames of the plurality of files, which scanning element is to scan the data associated with the plurality of files; and

based on the determination as to which scanning element is to scan the data associated with the plurality of files,

distribute the data scanning operations amongst the one or more distributed scanning elements; and

distribute a computing load amongst the processors in the computing grid of processors.

16. The method of claim 15 further comprising sending a multi-cast message to the one or more scanning elements in the computing grid of processors.

17. The method of claim 15, further comprising generating a scan report after having completed a data scan and further comprising taking a user-defined action based on the report.

18. The method of claim 17, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

19. The method of claim 15, wherein scanning the plurality of files comprises scanning for viruses or other malicious software code.

20. The method of claim 15, wherein scanning the plurality of files comprises scanning for content violations of a local administrator policy.