Data identification system

• US 8,640,241 B2
• Filed: 04/21/2010
• Issued: 01/28/2014
• Est. Priority Date: 11/16/2009
• Status: Active Grant

• Current Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Original Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Inventors: Wade, Gregory L., Haile, J. Mitchell
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US12/764,771
• Publication Number:
  US 20110119763A1
• Time in Patent Office: 1,378 Days
• Field of Search: 726/24, 713/187
• US Class Current: 726/24
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed is a method of operating a data storage system. The method comprises identifying changed segments of a primary storage volume, receiving a data request for a plurality of data items in a secondary storage volume, identifying changed data items of the plurality of data items in the secondary storage volume based on a correspondence between the plurality of data items in the secondary storage volume and the changed segments of the primary storage volume, and transferring the changed data items in response to the data request.

Claims

1. A method of operating a data identification system for identifying data items in a storage system, the method comprising:

receiving a scan request to scan files on a secondary storage volume;

identifying changed segments of a primary storage volume, wherein the primary storage volume comprises a virtual disk file;

wherein the identifying the changed segments of the primary storage volume comprising the steps of;

generating a request for a changed segment list;

transferring the request for the changed segment list;

receiving the changed segment list;

processing the changed segment list to determine the changed segments of the primary storage volume;

identifying changed data items of the plurality of data items in the secondary storage volume based on a correspondence between the plurality of data items in the secondary storage volume and the changed segments of the primary storage volume;

retrieving the changed data items from the secondary storage volume; and

transferring the changed data items in response to the scan request.

2. The method of claim 1 wherein the scan request comprises a scan request to scan the plurality of data items.

3. The method of claim 2 further comprising receiving the changed data items and responsively scanning the changed data items for a virus.

4. The method of claim 3 further comprising transferring unchanged data items in response to detecting a virus in one of the changed data items.

5. The method of claim 1 further comprising transferring a request for the changed data items to the virtual storage device and receiving the changed data items in response to the request.

6. The method of claim 1 wherein the data request further comprises a request for a plurality of data items in a second secondary storage volume.

7. The method of claim 6 further comprising:

identifying second changed blocks of a second primary storage volume;

identifying second changed data items of the plurality of data items in the second secondary storage volume based on a correspondence between the plurality of data items in the second secondary storage volume and the second changed blocks of the second primary storage volume; and

transferring the second changed data items in response to the data request.

8. A data identification system, the system comprising:

a storage system configured to store a primary storage volume comprising a plurality of segments;

a communication interface configured to receive a scan request for a plurality of data items in a secondary storage volume and transfer changed data items in response to the scan request;

a processing system configured to identify changed segments of the primary storage volume, identify the changed data items of the plurality of data items in the secondary storage volume based on a correspondence between the plurality of data items in the secondary storage volume and the changed segments of the primary storage volume, wherein the processing system is further configured to generate a request for a changed segment list, transfer the request for the changed segment list to the primary storage volume, receive the changed segment list from the primary storage volume, and process the changed segment list in order to determine the changed segments of the primary storage volume.

9. The data identification system of claim 8 wherein the scan request comprises a scan request to scan the plurality of data items.

10. The data identification system of claim 9 further comprising a data item scanner configured to receive the changed data items and responsively scan the changed data items for a virus.

11. The data identification system of claim 10 wherein the processor is further configured to transfer unchanged data items in response to the data item scanner detecting a virus in one of the changed data items.

12. The data identification system of claim 8 wherein the primary storage volume comprises a virtual disk file.

13. The data identification system of claim 12 wherein the secondary storage volume comprises a virtual storage device, and wherein the virtual disk file contains the first virtual storage device.

14. The data identification system of claim 13 wherein the processor is further configured to transfer a request for the changed data items to the virtual storage device and receive the changed data items in response to the request.

15. The data identification system of claim 8 wherein the processor is further configured to identify changed blocks of a second primary storage volume, identify changed data items of the plurality of data items in the second secondary storage volume based on a correspondence between the plurality of data items in the second secondary storage volume and the changed blocks of the second primary storage volume, and transfer the changed data items in response to the scan request.

16. A non-transitory computer readable medium having program instructions stored thereon for operating a data identification system that, when executed by a data identification system, direct the data identification system to:

receive a scan request for a plurality of data items in a secondary storage volume;

identify changed segments of a primary storage volume, wherein the primary storage volume comprises a virtual disk file stored on a storage system;

wherein the identifying the changed segments of the primary storage volume comprising the steps of;

generating a request for a changed segment list;

transferring the request for the changed segment list;

receiving the changed segment list;

processing the changed segment list to determine the changed segments of the primary storage volume;

identify changed data items of the plurality of data items in the secondary storage volume based on a correspondence between the plurality of data items in the secondary storage volume and the changed segments of the primary storage volume;

retrieving the changed data items from the secondary storage volume; and

transfer the changed data items in response to the scan request.