SYSTEMS AND METHODS FOR GRID-BASED DATA SCANNING

• US 20090193113A1
• Filed: 01/30/2008
• Published: 07/30/2009
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Lunde, Norman R.
• Granted Patent: US 7,836,174 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computing grid for performing scanning operations on electronic data in a networked computing environment. The data scanning operations may include scanning data for viruses or other malicious software code. The computing grid for performing data scanning operations may include one or more event detectors to detect data scanning events and one or more grid scanning elements to perform the data scanning operations. The computing grid may also include a grid coordinator to monitor the grid configuration, perform necessary updates to the grid, and to take pre-determined actions based on the results of the data scans.

Claims

1. A computer system for scanning electronic data, the system comprising:

one or more event detectors to detect a data scanning event and to generate a data scanning event message; and

a computing grid of processors, the computing grid of processors comprising one or more scanning elements to receive the data scanning event message, to access event-causing data from one or more data storage devices accessible to a networked computing system, and to scan the event-causing data.

2. The system of claim 1, wherein the one or more data storage devices are accessible to the networked computing system via a Storage Area Network, a Network Attached Storage unit, or a combination of the two.

3. The system of claim 1, wherein the data scanning event message comprises a multi-cast message from an event detector to the one or more scanning elements.

4. The system of claim 1, wherein a data scanning event comprises the creation of new data.

5. The system of claim 1, wherein a data scanning event comprises an attempted modification to existing data.

6. The system of claim 1, wherein the one or more scanning elements are configured to generate a scan report after having completed a data scan and further comprising a grid coordinator to receive the scan report and to take a user-defined action based on the report.

7. The system of claim 6, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

8. The system of claim 1, wherein the one or more event detectors and the computing grid of processors are configured for integration with a data storage system, the data storage system configured to perform storage-related operations for one or more networked client computers.

9. The system of claim 8, wherein the storage-related operations comprise data backup, migration, or recovery.

10. The system of claim 8, wherein the storage system comprises modular storage cells which can be added to or subtracted to provide more or less storage capacity and storage operation functionality.

11. The system of claim 1, wherein each of the one or more scanning elements receives the data scanning event message and independently performs an operation to determine whether to handle the detected scanning event.

12. The system of claim 1, wherein the one or more scanning elements scan event-causing data for viruses or other malicious software code.

13. The system of claim 1, wherein the one or more scanning elements scan event-causing data for content violations of a local administrator policy.

14. The system of claim 1, wherein the one or more event detectors comprise a local area network (LAN) sniffer or a Storage Area Network (SAN) sniffer.

15. A method comprising:

detecting a data scanning event;

accessing data associated with the scanning event from one or more data storage devices accessible to a networked computing system;

and scanning the event-causing data with a computing grid of processors.

16. The method of claim 15 further comprising generating a data scanning event message in response to the data scanning event, wherein the data scanning event message comprises a multi-cast message to one or more scanning elements in the computing grid of processors.

17. The method of claim 15, wherein accessing and scanning the data associated with the data scanning event comprises generating a scan report after having completed a data scan and further comprising taking a user-defined action based on the report.

18. The method of claim 17, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

19. The method of claim 15, wherein scanning the data associated with the data scanning event comprises scanning for viruses or other malicious software code.

20. The method of claim 15, wherein scanning the data associated with the data scanning event comprises scanning for content violations of a local administrator policy.

21. A computer system comprising:

means for detecting a data scanning event;

means for accessing data associated with the scanning event from one or more data storage devices accessible to a networked computing system;

a plurality of means for scanning the event-causing data; and

means for selecting one of the plurality of means for scanning the event-causing data to scan the event-causing data.

22. The system of claim 21, wherein the means for detecting comprises a file system filter driver, a local area network (LAN) sniffer, or a Storage Area Network (SAN) sniffer.

23. The system of claim 21, wherein the means for accessing data comprises a file server computer, a Storage Area Network (SAN), a Network Attached Storage (NAS) unit, or a combination of the two.

24. The system of claim 21, wherein the plurality of means for scanning comprises a computing grid of processors.

25. The system of claim 21, wherein the means for selecting one of the plurality of means for scanning comprises a computer configured to perform a load-balancing algorithm.