Systems and methods for grid-based data scanning

• US 7,836,174 B2
• Filed: 01/30/2008
• Issued: 11/16/2010
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: CommVault Systems Incorporated
• Original Assignee: CommVault Systems Incorporated
• Inventors: Lunde, Norman R.
• Primary Examiner(s): Jean; Frantz B
• Application Number:
  US12/022,822
• Publication Number:
  US 20090193113A1
• Time in Patent Office: 1,021 Days
• Field of Search: 709/203, 709/224, 709/206, 709/219, 713/201
• US Class Current: 709/224
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computing grid for performing scanning operations on electronic data in a networked computing environment. The data scanning operations may include scanning data for viruses or other malicious software code. The computing grid for performing data scanning operations may include one or more event detectors to detect data scanning events and one or more grid scanning elements to perform the data scanning operations. The computing grid may also include a grid coordinator to monitor the grid configuration, perform necessary updates to the grid, and to take pre-determined actions based on the results of the data scans.

Claims

1. A computer system for scanning electronic data, the system comprising:

one or more event detectors to detect a data scanning event associated with a file in a file system and to generate a data scanning event message, wherein the one or more event detectors comprise at least one file system monitor that intercepts data storage transactions, wherein the one or more event detectors further determine whether to generate a scanning event message based on information about the data storage transaction, and wherein the event scanning message comprises pathname identification information that uniquely identifies and locates the file in the file system; and

a computing grid of processors that are separate from the file system, wherein the computing grid of processors receive the event scanning message from the one or more detectors, the computing grid of processors comprising one or more scanning elements to receive the data scanning event message, wherein the one or more scanning elements determine based on the pathname, identification information which scanning element is to process the data scanning message to access event-causing data from one or more data storage devices accessible to a networked computing system, and to scan the event-causing data.

2. The system of claim 1, wherein the one or more data storage devices are accessible to the networked computing system via a Storage Area Network, a Network Attached Storage unit, or a combination of the two.

3. The system of claim 1, wherein the data scanning event message comprises a multi-cast message from an event detector to the one or more scanning elements.

4. The system of claim 1, wherein a data scanning event comprises the creation of new data.

5. The system of claim 1, wherein a data scanning event comprises an attempted modification to existing data.

6. The system of claim 1, wherein the one or more scanning elements are configured to generate a scan report after having completed a data scan and further comprising a grid coordinator to receive the scan report and to take a user-defined action based on the report.

7. The system of claim 6, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

8. The system of claim 1, wherein the one or more event detectors and the computing grid of processors are configured for integration with a data storage system, the data storage system configured to perform storage-related operations for one or more networked client computers.

9. The system of claim 8, wherein the storage-related operations comprise data backup, migration, or recovery.

10. The system of claim 8, wherein the storage system comprises modular storage cells which can be added to or subtracted to provide more or less storage capacity and storage operation functionality.

11. The system of claim 1, wherein each of the one or more scanning elements receives the data scanning event message and independently performs an operation to determine whether to handle the detected scanning event.

12. The system of claim 1, wherein the one or more scanning elements scan event-causing data for viruses or other malicious software code.

13. The system of claim 1, wherein the one or more scanning elements scan event-causing data for content violations of a local administrator policy.

14. The system of claim 1, wherein the one or more event detectors comprise a local area network (LAN) sniffer or a Storage Area Network (SAN) sniffer.

15. A method comprising:

detecting a data scanning event associated with a file in a file system with one or more event detectors, wherein the one or more event detectors comprise at least one file system monitor that intercepts data storage transactions, wherein the one or more event detectors further determine whether to generate a scanning event message based on information about the data storage transaction, and wherein the event scanning message comprises pathname identification information that uniquely identifies and locates the file in the file system;

accessing data associated with the scanning event from one or more data storage devices accessible to a networked computing system;

and scanning the event-causing data with a computing grid of processors, wherein the computing grid of processors are separate from the file system, wherein the computing grid of processors receive the event scanning message from the one or more detectors, the computing grid of processors comprising one or more scanning elements to receive the data scanning event message, and wherein the one or more scanning elements determine based on the pathname identification information, which scanning element is to scan the data associated with the scanning event.

16. The method of claim 15 wherein the data scanning event message comprises a multi-cast message to one or more scanning elements in the computing grid of processors.

17. The method of claim 15, wherein accessing and scanning the data associated with the data scanning event comprises generating a scan report after having completed a data scan and further comprising taking a user-defined action based on the report.

18. The method of claim 17, wherein the user-defined action comprises deleting the data, quarantining the data, or notifying an administrator of the scan results.

19. The method of claim 15, wherein scanning the data associated with the data scanning event comprises scanning for viruses or other malicious software code.

20. The method of claim 15, wherein scanning the data associated with the data scanning event comprises scanning for content violations of a local administrator policy.

21. A computer system comprising:

means for detecting a data scanning event associated with a file in a file system with one or more event detectors, wherein the one or more event detectors comprise at least one file system monitor that intercepts data storage transactions, wherein the one or more event detectors further determine whether to generate a scanning event message based on information about the data storage transaction, and wherein the event scanning message comprises pathname identification information that uniquely identifies and locates the file in the file system;

means for accessing data associated with the scanning event from one or more data storage devices accessible to a networked computing system;

a plurality of means for scanning the event-causing data, wherein the means for scanning is separate from the file system; and

means for selecting one of the plurality of means for scanning the event-causing data to scan the event-causing data wherein the means for selecting uses the pathname identification information to determine which of the plurality of means for scanning is to scan the data associated with the scanning event.

22. The system of claim 21, wherein the means for detecting comprises a file system filter driver, a local area network (LAN) sniffer, or a Storage Area Network (SAN) sniffer.

23. The system of claim 21, wherein the means for accessing data comprises a file server computer, a Storage Area Network (SAN), a Network Attached Storage (NAS) unit, or a combination of the two.

24. The system of claim 21, wherein the plurality of means for scanning comprises a computing grid of processors.

25. The system of claim 21, wherein the means for selecting one of the plurality of means for scanning comprises a computer configured to perform a load-balancing algorithm.