Abstract:
In one embodiment a method comprises initiating, by a network attached storage device, a virus scan process on the network attached storage device, receiving, by the network attached storage device, a first file access request that identifies a file, and interrupting the virus scan process to respond to the first file access request.

Description:
BACKGROUND 
     The term Network Attached Storage (NAS) refers to a dedicated data storage device(s) connected directly to a computer network to provide centralized data access and storage services to one or more network clients such as, e.g., a personal computer. NAS devices typically comprise one or more storage media such as, e.g., magnetic disk drives, optical drives, magneto-optical drives, tape drives, or the like. The storage media may be configured to implement logical storage objects such as, e.g., RAID (redundant array of inexpensive/independent disks). NAS devices may implement a file sharing operating system such as, e.g., Network File System (NFS) to provide data storage and access management services to network clients. 
     NAS devices are not commonly targeted by computer viruses and/or Trojan horses. However, NAS devices may store files that are infected with a virus or a Trojan horse. Network clients that access the infected file(s) on the NAS device may then become infected with the virus or Trojan horse. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a schematic illustration of one embodiment of network attached storage environment. 
         FIG. 2  is a schematic illustration of an exemplary network attached storage device. 
         FIG. 3  is a flowchart illustrating operations in one embodiment of a method of anti-viral scanning in network attached storage. 
         FIG. 4  is a flowchart illustrating operations in one embodiment of a method of anti-viral scanning in network attached storage. 
     
    
    
     DETAILED DESCRIPTION 
     Described herein are exemplary systems and methods for anti-viral scanning in network attached storage. The methods described herein may be embodied as logic instructions stored on a computer-readable medium. When executed on a processor, the logic instructions cause a general processor to be programmed as a special-purpose machine that implements the described methods. The processor, when configured by the logic instructions to execute the methods recited herein, constitutes structure for performing the described methods. 
       FIG. 1  is a schematic illustration of one embodiment of network attached storage environment. Environment  100  may comprise a one or more network attached storage devices  110   a ,  110   b ,  110   c  connected to one or more network clients  112   a ,  112   b ,  112   c  by a communication network  120 . 
     Network attached storage devices  110   a ,  110   b ,  110   c  may be implemented as one or more communicatively connected storage devices. Exemplary storage devices may comprise, but are not limited to, the ProLiant™ line of storage devices commercially available form Hewlett-Packard Corporation of Palo Alto, Calif., USA. In some embodiments, at least a portion of communication network  120  may be implemented as a private, dedicated network such as, e.g., a local area network (LAN) or a wide area network (WAN). Alternatively, portions of communication network  120  may be implemented using public communication networks pursuant to a suitable communication protocol such as, e.g., the Internet. 
     Network clients  112   a ,  112   b ,  112   c  may be implemented as computing devices such as, e.g., a networked computer  112   a , a laptop computer  112   b , a desktop computer  112   c , or the like. Applications running on network clients  112   a ,  112   b ,  112   c  may initiate file access requests to access information stored in network attached storage devices  110   a ,  110   b ,  110   c . Network attached storage devices  110   a ,  110   b ,  110   c  receive file access requests and, in response, locate and return the requested information to the network client that originated the request. 
       FIG. 2  is a schematic illustration of one embodiment of a network attached storage (NAS) device  200 , which may be used to implement one or more of network attached storage devices  110   a ,  110   b ,  110   c  depicted in  FIG. 1 . Referring to  FIG. 2 , network storage device  200  comprises one or more network interfaces  210  which enables a communication connection with a network such as, e.g., network  120 . 
     Network interface  210  may comprise an input/output (I/O) port to provide a physical connection with a network. For example, network interface  210  may comprise an Ethernet port. Network interface  210  may comprise a network interface card (NIC), also commonly referred to as a network adapter or a network card. The NIC manages I/O operations to enable NAS device  200  to communicate over a network. Alternatively, the operations of the NIC may be implemented on a main circuit board such as, e.g., a motherboard of NAS device  200 . 
     NAS device  200  further comprises at least one processor  212 . As used herein, the term “processor” means any type of computational element, such as but not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) microprocessor, a reduced instruction set (RISC) microprocessor, a very long instruction word (VLIW) microprocessor, or any other type of processor or processing circuit. 
     NAS device  200  further comprises system random access memory and/or read-only memory  230 . Memory  230  comprises an operating system  240  for managing operations of NAS device  200 . In one embodiment, operating system  240  comprises a hardware interface module  254  that provides an interface to system hardware. The particular embodiment of operating system  240  is not critical to the subject matter described herein. Operating system  240  may be embodied as a UNIX operating system or any derivative thereof (e.g., Linux, Solaris, etc.) or as a Windows® brand operating system. 
     Operating system  240  comprises (or interfaces with) a file system(s)  250  that manages files used in the operation of NAS device  200 . For example, file system(s)  250  may implement one or more of a Network File System (NFS) protocol, a Common Internet File System (CIFS) protocol, or the like. In one embodiment operating system  240  may comprise a file cache management system  244  interposed logically between the file system(s)  250  and underlying modules such as, e.g., the hardware interface module  254 . File cache management system  244  interfaces with the file system(s)  250  to manage the file cache  256  as a resource that may be shared between users of the computer system, e.g., on a per-workload basis. 
     Operating system  240  further comprises a system call interface module  242  that provides an interface between the operating system  240  and one or more application modules that execute on NAS device  200 . 
     NAS device  200  further comprises storage media  280 . For example, storage media  280  may be embodied as one or more arrays of magnetic disk drives. Alternatively, storage media  280  may comprise optical, magneto-optical, or electro-optical storage media. Storage media  280  may be configured to implement RAID redundancy. 
     NAS storage device  200  further comprises a virus scanning module  260 . In some embodiments, virus scanning module is embodied as a software module that executes on processor(s)  212 . In such embodiments, virus scanning module  260  executes as a background process to scan files stored on NAS storage device  200  for viruses, Trojan horses, worms, or the like. 
     NAS storage device  200  further comprises a control module  262  that controls the operation of virus scanning module  260  in response to file access requests from network clients such as, e.g., network clients  112   a ,  112   b ,  112   c . Operations implemented by some embodiments of control module  262  are described with reference to  FIG. 3  and  FIG. 4 . 
       FIG. 3  is a flowchart illustrating operations in one embodiment of a method of anti-viral scanning in network attached storage. The operations of  FIG. 3  cause virus scan process executing in NAS device  200  to be interrupted in response to a file access request from a network client  112 . Interrupting the virus scan process enhances the response time of the NAS device  200 . In some embodiments, the operations depicted in  FIG. 3  are implemented by the virus scanning module  260  and/or the control module  262 . 
     At operation  310  a virus scan process scans files on the NAS device  200  for infected files. In some embodiments the virus scanning module  260  initiates the virus scan process, which sequentially scans the entire contents of the storage media  280 . In some embodiments a subset of files on the storage media  280  is scanned. For example, virus scanning module  260  scans only files that have been accessed since a previous virus scan. Alternatively, virus scanning module  260  may scan only files that have been the recipients of a read or a write operation since a previous virus scan. 
     At operation  315  the control module  262  monitors for file access requests directed to NAS storage device  200 . If, at operation  315 , no file access request is received, then the scanning process continues while the control module  262  continues to monitor for file access requests. 
     By contrast, if at operation  315  a file access request is received then at operation  320  the virus scan process is interrupted. For example, the control module  262  transmits an instruction to the virus scanning module  260  to interrupt the virus scanning process. At operation  325  the file access request is processed. For example, the I/O operation (e.g., read, write, open) associated with the file access request is executed by the NAS storage device  200 . 
     In some embodiments, the virus scanning process is interrupted until the I/O operation associated with the file access request is completed. Thus, at operation  330  the virus scanning process is restarted. For example, the control module  262  transmits an instruction to the virus scanning module  260  to resume the virus scanning process. Control then passes back to operation  310  and the virus scanning process continues until the next file access request is received. 
       FIG. 4  is a flowchart illustrating operations in one embodiment of a method of anti-viral scanning in network attached storage. The operations of  FIG. 4  also cause virus scan process executing in NAS device  200  to be interrupted in response to a file access request from a network client  112 . Interrupting the virus scan process enhances the response time of the NAS device  200 . In some embodiments, the operations depicted in  FIG. 4  are implemented by the virus scanning module  260  and/or the control module  262 . 
     At operation  410  a virus scan process scans files on the NAS device  200  for infected files. In some embodiments the virus scanning module  260  sequentially scans the entire contents of the storage media  280 . In some embodiments, a subset of files on the storage media  280  is scanned. For example, virus scanning module  260  scans only files that have been accessed since a previous virus scan. Alternatively, virus scanning module  260  may scan only files that have been the recipients of a read or a write operation since a previous virus scan. 
     At operation  415  the control module  262  monitors for file access requests directed to NAS storage device  200 . If, at operation  415 , no file access request is received, then the scanning process continues (operation  410 ) while the control module  262  continues to monitor for file access requests. 
     By contrast, if at operation  415  a file access request is received then at operation  420  the virus scan process is interrupted. For example, the control module  262  transmits an instruction to the virus scanning module  260  to interrupt the virus scanning process. 
     In some embodiments a virus scan process may be initiated on the file identified in the file access request. Thus, at operation  425  the requested file is scanned for viruses, Trojan horses, or the like. If, at operation  430 , the requested file is infected, then control passes to operation  435  and an error routine is implemented. In some embodiments an error routine generates a signal that indicates the file is infected. In some embodiments, in response to the signal, logic in the NAS storage device  200  terminates the file access request. Alternatively, or in addition, the NAS storage device may transmit an error message to the network client  112   a ,  112   b ,  112   c  which generated the file access request. The virus scanning process then continues at operation  410 . 
     By contrast, if at operation  430  the requested file is not infected, then the file access request is processed (operation  440 ). For example, the I/O operation (e.g., read, write, open) associated with the file access request may be executed by the NAS storage device  200 . 
     In some embodiments, the virus scanning process is interrupted for a specified period of time. The specified period of time may be fixed such as, for example, a fixed number of milliseconds. Alternatively, the specified period of time may be determined in part as a function of the type of I/O operation specified in the file access request. For example, the specified period of time may be set to “n” milliseconds for a read operation, and a multiple of “n” milliseconds for a write operation. Alternately, the specified period of time may be dynamically set by performance parameters associated with NAS storage device. 
     Thus, if at operation  445  the specified interrupt time period has not lapsed, then the virus scanning process effectively “times out.” When the specified interrupt time elapses, the virus scan is restarted at operation  450  and the virus scanning process continues scanning for infected files (operation  410 ). 
     In the operations of  FIG. 4 , the control module  262  may continue to monitor for file access requests from network clients  112   a ,  112   b ,  112   c  during the interrupt time period implemented in operation  445 . Thus, if a second file access request is received during the interrupt time period, then the interrupt may be maintained for an additional time period in response to the second file access request. 
     Some embodiments may be provided as computer program products, which may comprise a machine-readable or computer-readable medium having stored thereon instructions used to program a computer (or other electronic devices) to perform a process discussed herein. The machine-readable medium may comprise, but is not limited to, floppy diskettes, hard disk, optical disks, CD-ROMs, magneto-optical disks, ROMs, RAMs, erasable programmable ROMs (EPROMs), electrically erasable EPROMs (EEPROMs), magnetic or optical cards, flash memory, or other suitable types of media or computer-readable media suitable for storing electronic instructions and/or data. Moreover, data discussed herein may be stored in a single database, multiple databases, or otherwise in select forms (such as in a table). 
     Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is comprised in at least an implementation. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.