Restoration of data corrupted by viruses using pre-infected copy of data

• US 20050055559A1
• Filed: 08/26/2004
• Published: 03/10/2005
• Est. Priority Date: 08/29/2003
• Status: Active Grant

• Current Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Original Assignee: Seagate Technology LLC (Seagate Technology Holdings Plc)
• Inventors: Bucher, Tim
• Granted Patent: US 7,392,542 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Post-infection virus protection through data restoration using mirrored data that has been obtained prior to the virus infection. A network appliance in a network mirrors the data of a number of computers in an ongoing manner. An anti-virus module of the network appliance scans data received from a computer to determine whether the computer is infected by a virus. If no virus is identified, the network appliance uses the received data to update a mirrored copy of the computer'"'"'s data. If, however, the network appliance identifies a virus, the mirrored copy is not updated. Instead, the previous mirrored copy, which represents a pre-infection state of the data, is used to restore the infected computer to its pre-infection state. In this manner, a single copy of an anti-virus utility executed at the network appliance can protect an arbitrary number of computers, which do not require their own anti-virus software.

Claims

1. In a network appliance that maintains a mirrored copy of data from each of one or more computers, a method of restoring data of the one or more computers after corruption thereof, comprising the acts of:

determining whether the set of data received from a computer exhibits an indication of data corruption at the computer;

if the set of data does not exhibit an indication of data corruption, updating a mirrored copy of the data of the computer using the set of data; and

if the set of data exhibits an indication of data corruption, performing the acts of;

causing data at the computer to be deleted so as to eliminate the source of the data corruption; and

transmitting a copy of the mirrored data from the network appliance to the computer to restore the data that has been corrupted at the computer, wherein the mirrored data represents data that was stored at the computer prior to the data corruption.

2. The method of claim 1, wherein the act of determining whether the set of data exhibits an indication of data corruption comprises the act of performing signature analysis on the set of data.

3. The method of claim 2, wherein the act of performing signature analysis on the set of data is conducted so as to determine whether the set of data is consistent with the computer having received a virus.

4. The method of claim 1, wherein the act of causing data at the computer to be deleted comprises the acts of:

deleting all data on a storage device associated with the computer; and

reformatting the storage device.

5. The method of claim 1, wherein the act of transmitting a copy of the mirrored data is performed by transmitting the copy of the mirrored data using a wireless communications interface.

6. The method of claim 1, wherein the act of transmitting a copy of the mirrored data is performed by transmitting the copy of the mirrored data using a wired communications interface.

7. The method of claim 1, further comprising the act of receiving the set of data in response to the computer sending the set of data to the network appliance to enable the network appliance to perform a mirroring operation.

8. The method of claim 1, wherein:

the network appliance maintains a mirrored copy of data from each of a plurality of computers; and

the act of determining is performed in response to each of the plurality of computers sending sets of data to the network appliance to enable the network appliance to perform mirroring operations for each of the plurality of computers.

9. The method of claim 1, wherein the indication of data corruption comprise an indication that the computer has received a virus.

10. The method of claim 1, wherein the network appliance resides in a local network that also includes said plurality of computers, wherein none of said plurality of computers operates anti-virus software.

11. In a network appliance that maintains a mirrored copy of data from each of one or more computers, a method of restoring data of the one or more computers from after corruption thereof by viruses, comprising the acts of:

receiving a set of data from a computer;

determining whether the set of data exhibits an indication of the computer having received a virus;

if the set of data does not exhibit said indication, updating a mirrored copy of the data of the computer using the set of data; and

if the set of data exhibits said indication, performing the acts of;

causing data at the computer to be deleted so as to eliminate any copy of the virus at the computer; and

transmitting a copy of the mirrored data from the network appliance to the computer to restore the data that has been corrupted at the computer, wherein the mirrored data represents data that was stored at the computer prior to the data corruption.

12. The method of claim 11, wherein the network appliance is incorporated in a network appliance that maintains mirrored a copy of data from each of a plurality of computers.

13. The method of claim 12, wherein the network appliance also operates as a router that enables the plurality of computers to communicate with the internet.

14. The method of claim 13, wherein the network appliance further includes anti-virus software that scans data received from the internet for viruses prior to the data received from the internet being routed to any of the plurality of computers.

15. The method of claim 13, wherein none of the plurality of computers operates anti-virus software.

16. The method of claim 11, wherein the act of determining whether the set of data exhibits an indication of the computer having received a virus comprises the act of performing signature analysis on the set of data.

17. A computer network enabling the restoration of corrupted data, comprising:

one or more computers, each having a storage device in which data is stored; and

a network appliance including;

a mirroring storage device that maintains a mirrored copy of the data stored in the storage device of each of the one or more computers;

a signature analyzer that performs signature analysis on sets of data received from the one or more computers to determine whether the sets of data exhibit an indication of corruption of the data stored in the storage devices of the corresponding computers; and

a scrubbing module that, if it is determined that a particular set of data exhibits said indication, controls restoration of the data stored in the storage device of the corresponding computer.

18. The computer network of claim 17, wherein the signature analyzer operates to determine whether the sets of data exhibit an indication that the corresponding computers have received a virus.

19. The computer network of claim 17, wherein the network appliance is incorporated in a network appliance that also includes a router that enables the one or more computers to communicate with the internet.

20. The computer network of claim 19, wherein the network appliance further includes anti-virus software that scans data received from the internet for viruses prior to the data received from the internet being routed to any of the one or more of computers

21. The computer network of claim 17, wherein none of the one or more computers executes anti-virus software.