Method, electronic device and computer program product for storage management

Abstract

Embodiments of the present disclosure relate to a method, an electronic device and a computer program product for storage management. According to an exemplary implementation of the present disclosure, a method for storage management comprises: receiving, at a storage server, an access request for target data from a client, the access request occurring in a session between the storage server and the client; determining security information of the session based on attribute information of the client, the security information indicating whether the session is protected by an antivirus; and performing an access operation specified by the access request on the target data based on the security information. In this way, the performance of the storage server can be improved while ensuring the security of the storage server.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure generally relate to storage management, and in particular, to a method, an electronic device and a computer program product for storage management. BACKGROUND

[0002] With the development of information technology, more and more data is stored into a storage system, resulting in higher and higher requirements for security and access performance of the storage system. In the storage system, when receiving an access request for target data from a client, in order to prevent malicious operations from the client and thus ensure the security of data on the storage server, the storage server sometimes uses third-party antivirus software to identify and eliminate viruses. Although this ensures the security of the storage system, it will cause the access performance of the storage system to decrease. SUMMARY

[0003] Embodiments of the present disclosure provide a method, an electronic device and a computer program product for storage management.

[0004] In a first aspect of the present disclosure, a method for storage management is provided. The method comprises: receiving, at a storage server, an access request for target data from a client, the access request occurring in a session between the storage server and the client; determining, based on attribute information of the client, security information of the session, the security information indicating whether the session is protected by antivirus; and performing, based on the security information, an access operation specified by the access request on the target data.

[0005] In a second aspect of the present disclosure, an electronic device is provided. The device comprises at least one processing unit and at least one memory. The at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. The instructions, when executed by the at least one processing unit, cause the device to perform actions comprising: receiving, at a storage server, an access request for target data from a client, the access request occurring in a session between the storage server and the client; determining, based on attribute information of the client, security information of the session, the security information indicating whether the session is protected by antivirus; and performing, based on the security information, an access operation specified by the access request on the target data.

[0006] In a third aspect of the present disclosure, a computer program product is provided. The computer program product is tangibly stored on a non-transitory computer readable medium and comprises machine executable instructions that, when executed, cause a machine to implement any of the steps of the method described according to the first aspect of the present disclosure.

[0007] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the figures. BRIEF DESCRIPTION OF DRAWINGS

[0008] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the figures.

[0009] Figure 1 A schematic diagram showing an example of a storage management environment in which some embodiments of the present disclosure can be implemented;

[0010] Figure 2 A flowchart showing an example of a method for storage management according to some embodiments of the present disclosure;

[0011] Figure 3 A flowchart showing another example of a method for storage management according to some embodiments of the present disclosure; and

[0012] Figure 4 A schematic block diagram showing an example of an apparatus that can be used to implement embodiments of the present disclosure.

[0013] In the various drawings, like reference numerals refer to like parts throughout the several views. DETAILED DESCRIPTION

[0014] Preferred embodiments of the present disclosure will be described herein below with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms without being limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0015] The term "include," and derivations thereof, means "including, but not limited to," unless specifically indicated otherwise. The term "or" means "and / or" unless specifically indicated otherwise. The term "based on" means "based, at least in part, on" unless specifically indicated otherwise. The term "one example embodiment" and "an embodiment" means "at least one example embodiment." The term "another embodiment" means "at least one additional embodiment." The terms "a first," "a second," etc. can refer to different or identical objects. Other explicitly and implicitly recited definitions can also be possible.

[0016] Traditionally, in a storage system, a storage server (such as a Network Attached Storage (NAS) server) can utilize an antivirus agent to provide an antivirus solution for clients (such as Common Internet File System (CIFS) clients) using the storage server. The antivirus agent can communicate using a communication protocol such as Server Message Block (SMB) protocol, and use a virus detector such as third-party antivirus software to identify and eliminate viruses to prevent the viruses from infecting data on the storage system.

[0017] For example, after the storage server receives an access request from a client for target data (such as an access request to write to the target data to create a new file or update an existing file), the storage server will utilize the antivirus agent to send a request to the virus detector to perform a virus detection on the target data. After receiving the request to perform a virus detection on the target data, the virus detector will access the target data and perform a detection thereon, and return a response to the storage server indicating whether the target data is threatened by a virus. The storage server will determine whether to perform an access operation specified by the access request on the target data based on the received response. For example, if the response indicates that the target data is not threatened by a virus, the storage server can write to the target data. Otherwise, the storage server will delete the target data to prevent infection by a virus.

[0018] This antivirus solution can reduce the chance of a malicious client storing target data infected by a virus on the storage server. However, due to the performance of many additional operations (e.g., the storage server sending a request to the virus detector, the virus detector accessing the target data, and the virus detector sending a response to the storage server), the access or input / output performance of the storage system will be significantly degraded.

[0019] According to an example embodiment of the present disclosure, an improved solution for storage management is proposed. In the solution, at a storage server, an access request for target data from a client is received, the access request occurs in a session between the storage server and the client; based on attribute information of the client, security information of the session is determined, the security information indicates whether the session is protected by an antivirus; and based on the security information, an access operation specified by the access request is performed on the target data.

[0020] In this way, the present solution determines whether a session is protected by antivirus based on attribute information of the client, and omits the additional operation of detecting the target data by the virus detector in the case where the session is protected by antivirus, so that the performance of the storage server can be improved while ensuring the security of the storage server. In addition, since the virus detector does not need to detect the target data in the case where the session is protected by antivirus, the traffic on the network for detecting the security of the target data is reduced.

[0021] In the following, specific examples of the present solution will be described in more detail. Figures 1-4 In the following, specific examples of the present solution will be described in more detail. Figure 1 A schematic diagram showing an example of a storage management environment 100 according to some embodiments of the present disclosure is shown. The storage management environment 100 comprises a storage server 110, a client 120, a security manager 130 and a virus detector 140.

[0022] The storage server 110 can be used for data storage and can be any device with storage capability, such as a network attached storage server, a rack server, a tower server, a blade server, an edge server, a mainframe, a personal computer, a distributed computing system, a cloud, etc.

[0023] The client 120 can be used to perform access operations on the storage server 110. In some embodiments, the client 120 can send an access request for target data to the storage server 110 to cause the storage server 110 to perform an access operation specified by the access request on the target data. For example, the client 120 can request to write or store target data on the storage server 110, or to update target data. The client 120 can be any computing device, such as a general network file system client, a desktop computer, a notebook computer, a tablet computer, a personal computer, a digital assistant, etc.

[0024] Before the storage server 110 performs the access operation specified by the access request on the target data, the storage server 110 needs to determine the security of the client 120. To this end, the storage server 110 can utilize the security manager 130 to determine the security of the client 120. The security manager 130 can provide the storage server 110 with information of the antivirus software installed on the client 120. This is because the antivirus software on the client 120 usually has two installation modes: managed mode and unmanaged mode. In the managed mode, the client 120 will communicate with the security manager 130, so that the security manager 130 can know the status of the antivirus software on the client 120.

[0025] In most cases, the antivirus software on the client 120 is installed in a managed mode, and thus the storage server 110 can determine the security of the client 120 based on the information provided by the security manager 130 of the antivirus software on the client 120. If the client 120 is determined to be sufficiently protected by the antivirus software and is secure, then the access request from the client 120 for the target data can also be considered secure. The reason is that if the client 120 attempts to store the target data into the storage server 110, the local antivirus software on the client 120 will perform a virus check on the target data. In this case, if the target data is infected by a virus, the local antivirus software will delete the target data or quarantine it. Thus, the storage server 110 does not need to perform a virus check on the target data.

[0026] However, if the client 120 is determined to not be sufficiently protected by the antivirus software, or because the antivirus software on the client 120 is installed in an unmanaged mode or even no antivirus software is installed, the storage server 110 can determine that the client 120 is not secure. In this case, the storage server 110 will perform a virus check on the target data using the virus checker 140. The virus checker 140 can be any device that has virus identification and handling capabilities, such as any computing device that has an antivirus engine, antivirus software, etc.

[0027] It should be appreciated that in some embodiments, the access request occurs in a session between the storage server 110 and the client 120. Such a session can follow any appropriate communication protocol, such as the server message block protocol, etc. Since the access request occurs in a session between the storage server 110 and the client 120, in order to save resources, the security of the client 120 does not need to be determined for each communication in the session, but rather the security of the client 120 is determined at the initiation of the session as the security for all communications in the session.

[0028] In this manner, by omitting the additional operation of the virus checker 140 to perform a virus check on the target data in the case where the client 120 or the session is protected by antivirus, the performance of the storage server 110 can be improved while ensuring the security of the storage server 110. Furthermore, since the work of performing a virus check on the target data is performed by the secure client 120, the cost of using the virus checker 140 is reduced. Further, since the virus checker 140 does not need to perform a check on the target data in the case where the client 120 or the session is protected by antivirus, the traffic on the network for checking the security of the target data is reduced.

[0029] The following will be described in conjunction with Figures 2-4 The operations performed by the storage server 110 will be described in detail.Figure 2 A flowchart of a method 200 for storage management according to some embodiments of the present disclosure is shown. For example, the method 200 can be performed by the storage server 110 as shown. It should be understood that the method 200 can also include additional steps not shown and / or can omit steps shown, without limitation in this regard. Figure 1

[0030] At 210, the storage server 110 receives an access request for target data from the client 120. For example, the client 120 can request to write or store target data on the storage server 110, or to update the target data. The access request occurs in a session between the storage server 110 and the client 120. Such a session can follow any appropriate communication protocol, such as the server message block protocol, etc.

[0031] At 220, the storage server 110 determines security information of the session based on attribute information of the client 120. The security information indicates whether the session is protected by an antivirus. In some embodiments, the attribute information can include an address of the client 120 (such as an IP address, a MAC address, etc.), an identification of the client 120 (such as a client name), and a user identification of a user initiating the access request (such as a user name), etc. It should be understood that the address of the client 120 can be any information used to address the client 120, and the identification of the client 120 and the user can be any information used to uniquely identify the client 120 and the user.

[0032] In some embodiments, the storage server 110 can send the attribute information to the security manager 130 associated with the client 120. In some embodiments, the storage server 110 can determine the address of the client 120 and the identification of the client 120 from the attribute information, and send the address of the client 120 and the identification of the client 120 to the security manager 130.

[0033] The security manager 130 can determine information of an antivirus installed on the client corresponding to the attribute information, and provide the information to the storage server 110. In some embodiments, the storage server 110 can send a query containing the attribute information to the security manager 130 using a Restful API, for example, to obtain the information of the antivirus. In some embodiments, the information of the antivirus can include an identification of the antivirus, an update time of the antivirus, and a function enabled in the antivirus, etc.

[0034] ​The storage server 110 can determine the security information based on the received information of the antivirus software. In some embodiments, the storage server 110 can determine whether the identification of the antivirus software matches an identification of a specified antivirus software. In addition, the storage server 110 can determine whether the update time of the antivirus software exceeds a threshold time. For example, whether the antivirus software is the latest version. Further, the storage server 110 can determine whether the enabled function is a specified function. For example, whether a function of performing virus detection on the network drive is enabled. The specified antivirus software, the threshold time, and the specified function can be specified by an administrator of the storage server 110, or automatically determined according to a required security level.

[0035] In a case where the information of the antivirus software satisfies the specified conditions, such as matching the identification of the specified antivirus software, being the latest version, or enabling the specified function, the security information can be determined to indicate that the session is protected by antivirus. Otherwise, in a case where the information of the antivirus software does not satisfy all or any of the specified conditions, the security information can be determined to indicate that the session is not protected by antivirus.

[0036] At 230, the storage server 110 performs the access operation specified by the access request on the target data based on the security information. Specifically, if the security information indicates that the session is protected by antivirus, the storage server 110 can perform the access operation specified by the access request on the target data. For example, the storage server 110 can write or store the target data, or update the target data.

[0037] If the security information indicates that the session is not protected by antivirus, the storage server 110 will perform virus detection on the target data with the virus detector 140. For example, the storage server 110 can send a request to the virus detector 140 to perform virus detection on the target data. The virus detector 140, upon receiving the request to perform virus detection on the target data, can access the target data and perform detection thereon, and return a response to the storage server 110 indicating whether the target data is threatened by virus. The storage server 110 can determine whether to perform the access operation specified by the access request on the target data based on the received response.

[0038] If the response indicates that the target data is not threatened by virus, the storage server 110 can perform the access operation specified by the access request on the target data. If the response indicates that the target data is threatened by virus, the storage server 110 will not perform the access operation specified by the access request on the target data. Further, the storage server 110 can also delete the target data to prevent virus from the target data from infecting the storage server 110.

[0039] In this way, by omitting the additional operation of having the virus detector 140 detect the target data in the case where the session is antivirus-protected, the performance of the storage server 110 can be improved while ensuring the security of the storage server 110. Moreover, since the work of virus detection of the target data is performed by the secure client 120, the cost of using the virus detector 140 is reduced. Further, since the virus detector 140 does not need to detect the target data in the case where the session is antivirus-protected, the traffic on the network for detecting the security of the target data is reduced.

[0040] In Figure 2 In the example storage management method 200 shown, the information of the antivirus software provided by the security manager 130 is used to ensure the security of the storage server 110. In some embodiments, additional means can also be used to further ensure the security. For example, the security can be further ensured by determining whether the user who initiates the access request is a trusted user. In the following, the example storage management method 300 will be described with reference to Figure 3 The example storage management method 300 will be described.

[0041] Figure 3 A flowchart of another example of a method 300 for storage management according to some embodiments of the present disclosure is shown. For example, the method 300 can be performed by a storage server 110 as shown in Figure 1 It should be understood that the method 300 can also include additional steps not shown and / or the steps shown can be omitted, and the scope of the present disclosure is not limited in this respect.

[0042] At 310, the storage server 110 can receive an access request for target data from the client 120. The access request occurs in a session between the storage server 110 and the client 120.

[0043] At 315, the storage server 110 can determine whether the security information has been determined in advance. In some embodiments, before determining whether the security information has been determined in advance, the storage server 110 can also determine whether it is necessary to determine the security information. In the case where it is not necessary to determine the security information, the storage server 110 can directly perform virus detection of the target data using the virus detector 140, and perform the access operation on the target data based on the detection result.

[0044] In the case where the security information needs to be determined, the storage server 110 can determine whether the security information has been determined in advance. In some embodiments, for the session for which the security information has been determined, the storage server 110 can store the session in association with its security information. In this case, the storage server 110 can obtain the corresponding security information of the session based on the identification of the session. In this way, instead of determining the security of the session for each communication in the session, the security of the session is determined at the initiation of the session, thereby saving resources. For example, the storage server 110 can maintain a session list. The session list includes session records. The session records include the identification of the session and its security information. In some embodiments, the session list will be updated over time. For example, when the session is disconnected or timed out (e.g., 10 minutes), the session record can be deleted from the session list.

[0045] In the case where the security information has been determined in advance, the storage server 110 can determine whether the security information indicates that the session is protected by an antivirus. If the security information of the session indicates that the session is protected by an antivirus, the storage server 110 can perform the access operation specified by the access request on the target data. If the security information indicates that the session is not protected by an antivirus, the storage server 110 can perform virus detection on the target data with the virus detector 140, and perform the access operation on the target data based on the detection result

[0046] In the case where the security information has not been determined in advance, at 320, the storage server 110 can obtain attribute information of the client 120. In some embodiments, the attribute information can include the address of the client 120 (such as IP address, MAC address, etc.), the identification of the client 120, and the user identification of the user initiating the access request, etc.

[0047] At 325, the storage server 110 can send the attribute information to the security manager 130 associated with the client 120. In some embodiments, the storage server 110 can determine the address of the client 120 and the identification of the client 120 from the attribute information, and send the address of the client 120 and the identification of the client 120 to the security manager 130.

[0048] At 330, the storage server 110 can receive information of the antivirus software installed on the client 120 corresponding to the attribute information from the security manager 130. At 335, the storage server 110 can determine the security information based on the information of the antivirus software. In some embodiments, the storage server 110 can determine whether the identification of the antivirus software matches the identification of the specified antivirus software. In addition, the storage server 110 can determine whether the update time of the antivirus software exceeds a threshold time. For example, whether the antivirus software is the latest version. Further, the storage server 110 can determine whether the enabled function is the specified function. For example, whether the function of detecting viruses for network drives is enabled. The specified antivirus software, the threshold time, and the specified function can be specified by an administrator of the storage server 110 or automatically determined according to a required security level.

[0049] In a case where the information of the antivirus software satisfies the specified conditions, such as matching the identification of the specified antivirus software, being the latest version, or enabling the specified function, the security information can be determined to indicate that the session is protected by antivirus. Otherwise, in a case where the information of the antivirus software does not satisfy all or any of the specified conditions, the security information can be determined to indicate that the session is not protected by antivirus.

[0050] At 340, the storage server 110 can determine whether the security information indicates that the session is protected by antivirus. If the security information indicates that the session is not protected by antivirus, the storage server 110 can perform the access operation on the target data with the virus detector 140 detecting viruses for the target data and based on the detection result. In some embodiments, the storage server 110 can also store a session record of the session in the session list. The session record includes an identification of the session and the security information indicating that the session is not protected by antivirus.

[0051] If the security information indicates that the session is protected by antivirus, the storage server 110 can determine whether the user initiating the access request is a trusted user. For example, the storage server 110 can maintain a trusted user list. The trusted user list stores user identifications of trusted users.

[0052] Before determining whether the user is a trusted user, the storage server 110 can also determine whether it is necessary to determine whether the user is a trusted user. In a case where it is not necessary to determine whether the user is a trusted user, the storage server 110 can perform the access operation on the target data since the session has been determined to be safe. In some embodiments, the storage server 110 can also store a session record of the session in the session list. The session record includes an identification of the session and the security information indicating that the session is protected by antivirus.

[0053] In a case where it is necessary to determine whether the user is a trusted user, at 345, the storage server 110 can determine a user identification of the user initiating the access request (hereinafter referred to as "first user identification") from the attribute information. At 350, the storage server 110 can determine whether the first user identification matches a user identification of a trusted user (hereinafter referred to as "second user identification") stored in the storage server 110. If the first user identification matches the second user identification, at 355, the storage server 110 can perform the access operation specified by the access request on the target data.

[0054] If the first user identification does not match the second user identification, at 360, the storage server 110 can send a request for virus detection of the target data to the virus detector 140. At 365, the storage server 110 can determine whether a response is received from the virus detector 140 indicating that the target data is not threatened by a virus. If the response is received from the virus detector 140 indicating that the target data is not threatened by a virus, at 370, the storage server 110 can perform the access operation on the target data.

[0055] In this way, based on the session-based security information and the determination of whether the user initiating the access request is a trusted user, the additional operation of detection of the target data by the virus detector 140 can be omitted, the performance of the storage server 110 can be improved while ensuring the security of the storage server 110. Furthermore, since the work of virus detection of the target data is performed by the secure client 120, the cost of using the virus detector 140 is reduced. Further, since the virus detector 140 does not need to detect the target data in a case where the session is protected by an antivirus, the traffic on the network for detecting the security of the target data is reduced.

[0056] Figure 4 A schematic block diagram of an example device 400 that can be used to implement embodiments of the present disclosure is shown. For example, a storage system as shown can be implemented by the device 400. As shown, the device 400 includes a central processing unit (CPU) 410 that can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 420 or loaded into a random access memory (RAM) 430 from a storage unit 480. Various programs and data required for the operation of the device 400 can also be stored in the RAM 430. The CPU 410, the ROM 420, and the RAM 430 are connected to each other through a bus 440. An input / output (I / O) interface 450 is also connected to the bus 440. Figure 1

[0057] ​A number of the components in device 400 are connected to I / O interface 450, including an input unit 460, such as a keyboard, mouse, etc.; an output unit 470, such as various types of displays, speakers, etc.; a storage unit 480, such as a disk, a CD, etc.; and a communication unit 490, such as a network card, a modem, a wireless communication transceiver, etc. Communication unit 490 allows device 400 to exchange information / data with other devices over a computer network, such as the Internet, and / or various telecommunication networks.

[0058] The various processes and processes described above, such as methods 200 and 300, can be performed by processing unit 410. For example, in some embodiments, methods 200 and 300 can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 480. In some embodiments, part or all of the computer program can be loaded and / or installed on device 400 via ROM 420 and / or communication unit 490. When the computer program is loaded onto RAM 430 and executed by CPU 410, one or more acts of methods 200 and 300 described above can be performed.

[0059] The present disclosure can be a method, apparatus, system, and / or computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for performing various aspects of the present disclosure.

[0060] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched tape, a

[0061] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0062] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0063] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0064] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include a non-transitory computer readable storage medium that can be a computer- readable storage medium having no data storage cycles that change state. The instructions can be executed by one or more processors of a computer, to cause a series of operational elements or steps to be performed on the computer to produce a computer implemented process. Such instructions can also be stored and / or executed by other computer-readable media. Computer-readable media storing the computer readable instructions can include computer-readable storage media facilitating transfer of the computer readable instructions to the computer or other programmable data processing apparatus.

[0065] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include a non-transitory computer readable storage medium that can be a computer- readable storage medium having no data storage cycles that change state. The instructions can be executed by one or more processors of a computer, to cause a series of operational elements or steps to be performed on the computer to produce a computer implemented process. Such instructions can also be stored and / or executed by other computer-readable media. Computer-readable media storing the computer readable instructions can include computer-readable storage media facilitating transfer of the computer readable instructions to the computer or other programmable data processing apparatus.

[0066] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational elements or steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0067] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative of the embodiments and not exhaustive, and is not limited to the embodiments disclosed. Numerous modifications and adaptations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The selection of the terms to be used in the description is intended to best express the principles of the embodiments, practical application, or technical improvement over the technology in the market, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. A method for storage management, comprising: receiving, at a storage server, an access request for target data from a client, the access request occurring in a session between the storage server and the client; determining, based on attribute information of the client, security information of the session, the security information indicating whether the session is protected by an antivirus; performing, based on the security information, an access operation specified by the access request on the target data; determining, from the attribute information, a first user identification of a user initiating the access request; determining that the first user identification does not match a second user identification of a trusted user stored in the storage server; and in response to determining that the first user identification does not match the second user identification, sending, to a virus detector, a request for virus detection of the target data; wherein performing the access operation is in response to receiving, from the virus detector, a response indicating that the target data is not threatened by a virus. 2.The method of claim 1, further comprising: determining that the security information has not been pre-determined; and in response to determining that the security information has not been pre-determined, obtaining the attribute information. 3.The method of claim 1, wherein the attribute information comprises at least one of: an IP address of the client, a MAC address of the client, an identification of the client, and a user identification of a user initiating the access request. 4.The method of claim 1, wherein determining the security information comprises: sending, to a security manager associated with the client, the attribute information; receiving, from the security manager, information of an antivirus software installed on the client corresponding to the attribute information; and determining, based on the information of the antivirus software, the security information. 5.The method of claim 4, wherein the information of the antivirus software comprises at least one of: an identification of the antivirus software, an update time of the antivirus software, and an enabled function of the antivirus software. 6.The method of claim 5, wherein determining the security information comprises determining at least one of: whether the identification of the antivirus software matches an identification of a specified antivirus software, whether the update time exceeds a threshold time, and whether the enabled function is a specified function. 7.The method of claim 1, further comprising: in response to the security information of the session indicating that the session is protected by the antivirus, determining a trustworthiness of the user; and performing, based on the trustworthiness, the access operation on the target data. 8.The method of claim 7, wherein determining the trustworthiness comprises: determining, from the attribute information, a first user identification of the user initiating the access request; and determining that the first user identification matches a second user identification of a trusted user stored in the storage server; wherein performing the access operation is in response to determining that the first user identification matches the second user identification. 9.An electronic device, comprising: ​ ​ ​ ​ at least one processing unit; at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, cause the device to perform acts comprising: receiving, at a storage server, an access request for target data from a client, the access request occurring in a session between the storage server and the client; determining, based on attribute information of the client, security information of the session, the security information indicating whether the session is protected by an antivirus; and performing, based on the security information, an access operation specified by the access request on the target data; determining, from the attribute information, a first user identity of a user initiating the access request; determining that the first user identity does not match a second user identity of a trusted user stored in the storage server; and in response to determining that the first user identity does not match the second user identity, sending, to a virus detector, a request for virus detection of the target data; wherein performing the access operation is in response to receiving, from the virus detector, a response indicating that the target data is not threatened by a virus.

10. The device of claim 9, the acts further comprising: determining that the security information has not been predetermined; and in response to determining that the security information has not been predetermined, obtaining the attribute information.

11. The device of claim 9, wherein the attribute information comprises at least one of: an IP address of the client, a MAC address of the client, an identity of the client, and a user identity of a user initiating the access request.

12. The device of claim 9, wherein determining the security information comprises: sending, to a security manager associated with the client, the attribute information; receiving, from the security manager, information of an antivirus installed on the client corresponding to the attribute information; and determining the security information based on the information of the antivirus.

13. The device of claim 12, wherein the information of the antivirus comprises at least one of: an identity of the antivirus, an update time of the antivirus, and a function enabled in the antivirus.

14. The device of claim 13, wherein determining the security information comprises determining at least one of: whether the identity of the antivirus matches an identity of a specified antivirus, whether the update time exceeds a threshold time, and whether the enabled function is a specified function.

15. The device of claim 9, the acts comprising: in response to the security information of the session indicating that the session is protected by the antivirus, determining a trustworthiness of the user; and performing, based on the trustworthiness, the access operation on the target data.

16. The device of claim 15, wherein determining the trustworthiness comprises: determining, from the attribute information, a first user identification of the user that initiated the access request; and determining that the first user identification matches a second user identification of a trusted user stored in the storage server; wherein the access operation is performed in response to determining that the first user identification matches the second user identification.

17. A computer program product tangibly stored on a non-transitory computer readable medium and comprising machine executable instructions that, when executed, cause a machine to perform the steps of the method according to any one of claims 1 to 8.

Images