Maintaining file integrity

Abstract

A method for updating a file, wherein the method includes operations performed by a processor, wherein the operations include: Receiving update data to update a first subfile of a file, where the contents of the first subfile are located in a first position; Creating a first temporary copy subfile that corresponds to the first subfile of the file, with the contents of the first temporary copy subfile located in a first temporary location; Updating the first temporary copy subfile with the update data instead of updating the first subfile with the update data; Scanning the updated first temporary copy subfile; and If the updated first temporary copy subfile passes the scan check, update the first subfile with the scanned update of the first temporary copy subfile. where updating the first sub-file with the contents of the first temporary copy sub-file involves copying scanned update data from the first temporary location of the updated temporary copy sub-file to the first location of the first sub-file.

Description

BACKGROUND OF THE INVENTION AREA OF THE INVENTION

[0001] The subject matter disclosed here concerns data updates to files and antivirus scanning of files. DESCRIPTION OF RELATED TECHNOLOGY

[0002] Files are often scanned for computer viruses and other malicious software, frequently referred to as "malware." Such malicious software includes various forms of hostile or harmful software. Examples of malware include computer viruses, worms, Trojans, and ransomware. Other examples include spyware, adware, scareware, and other malicious programs. Malware can take the form of executable program code, scripts, active content, and other software. Malware is often disguised as or embedded within harmless files to facilitate its spread and make detection more difficult.

[0003] In some systems, after a write operation to update a file, the write data is committed to the file itself to update it, and an antivirus scan is then performed on the updated file. In some systems, a file to be scanned is also divided into subfiles, which are scanned separately by one or more scan servers to simplify the scanning process. If the last write command introduces malware, the antivirus scan can often detect it, and an attempt can be made to repair the infected file. If the repair of the infected file fails, the entire file is usually quarantined to prevent subsequent read operations on the infected file, which could lead to the spread of the malware. Users are therefore denied access to a quarantined file.However, a read operation directed at an infected file that has not been quarantined can enable the spread of the malware. According to a first aspect, a method for updating a file is provided, wherein the method has operations by a processor, wherein the operations include: receiving update data to update a first subfile of a file; creating a first temporary copy subfile corresponding to the first subfile of the file; instead of updating the first subfile with the update data, updating the first temporary copy subfile with the update data; scanning the updated first temporary copy subfile; and if the updated first temporary copy subfile passes the scan check, updating the first subfile with the scanned update of the first temporary copy subfile.

[0004] Documents already exist in this technical field. Document US 6088 803 A describes a system for virus scanning network data during download to a client device. The scan is performed before the download. Furthermore, document US 8 220 053 B1 describes a malware scan using a shadow copy. This makes it possible, using a suitable interface, to scan not only the file system but also files that may already be blocked by malware. Finally, document WO 2013 / 014 033 A1, as mentioned above, describes a system and method for detecting virus software on a mobile phone.

[0005] Despite these advances already made, there remains a need to better neutralize potentially invading startup software in order to ensure a continued high level of security for operating computer systems. SUMMARY

[0006] This task is solved by the subject matter of the independent patent claims. Further details arise from the respective dependent patent claims.

[0007] According to a second aspect, a system is provided comprising: at least one storage system comprising at least one storage unit designed to store a file which has a subfile of the file, and at least one storage control unit designed to access and control storage units of the at least one storage system; and at least one computer-readable storage medium with computer-readable program instructions implemented thereon, wherein the program instructions can be executed by the storage system to cause the storage system to perform operations, wherein the operations comprise: receiving update data to update a first subfile of a file; creating a first temporary copy subfile corresponding to the first subfile of the file;Instead of updating the first subfile with the update data, update the first temporary copy subfile with the update data; scan the updated first temporary copy subfile; and if the updated first temporary copy subfile passes the scan check, update the first subfile with the scanned update of the first temporary copy subfile.

[0008] According to a third aspect, a computer program product is provided for use with at least one storage system, which includes at least one storage unit designed to store a file containing a subfile of the file, and at least one storage control unit designed to access and control storage units of the at least one storage system, wherein the computer program product has at least one computer-readable storage medium with computer-readable program instructions implemented thereon, wherein the program instructions can be executed by the storage system to cause the storage system to perform operations, wherein the operations include: receiving update data to update a first subfile of a file; creating a first temporary copy subfile corresponding to the first subfile of the file;Instead of updating the first subfile with the update data, update the first temporary copy subfile with the update data; scan the updated first temporary copy subfile; and; If the updated first temporary copy subfile passes the scan check, update the first subfile with the scanned update of the first temporary copy subfile.

[0009] According to a preferred embodiment, a method for preserving file integrity in conjunction with a write operation to update a file is provided, in which a temporary copy subfile is created that corresponds to the originally intended part of the file. Instead of committing the update data for the write operation to the originally intended part of the file, the write data is instead directed to update the temporary copy subfile. The updated temporary copy subfile can be scanned for malware, and if the updated temporary copy subfile passes the scan, the originally intended part of the file can be updated with the scanned update data contained in the temporary copy subfile, which has been found to be free of malware.

[0010] Because the temporary copy subfile is updated instead of the original file, the temporary copy subfile, after being updated with the write data, can optionally be scanned for viruses or other malware separately from the original file or its original subfile in one embodiment. Consequently, in one embodiment, read access to the original file containing the corresponding original subfile can optionally be permitted while the temporary copy subfile is being updated and scanned.

[0011] Conversely, if the write update operation has introduced malware into the temporary copy subfile, the original file and its corresponding original subfile remain uncontaminated by the write update operation. In a single embodiment, access to the original file and its corresponding original subfile can therefore optionally continue, as they remain uncontaminated and their integrity has been preserved.

[0012] Furthermore, the original file and its corresponding original subfile do not need to be quarantined, as their integrity has been preserved, even if the contaminated temporary copy subfile were to be quarantined according to a single implementation. Consequently, access to the original file and its corresponding original subfile can optionally continue, as they remain uncontaminated and are not quarantined.

[0013] In one embodiment, storage space for the temporary copy subfile can optionally be obtained from a pool of available storage spaces for temporary subfiles. In another embodiment, one or more attempts can optionally be made to repair the temporary copy subfile in order to remove the malware before the temporary copy subfile is quarantined. In yet another embodiment, the update data can optionally be resent once or several times to update one or more additional temporary copy subfiles instead of the original file.

[0014] Other embodiments relate to systems, devices, and computer program products. Further aspects are described. DETAILED DESCRIPTION OF THE DRAWINGS

[0015] Preferred embodiments of the present invention will now be described by way of example and with reference to the following drawings: Fig. Figure 1 is a schematic block diagram illustrating a single embodiment of a data processing system in which the preservation of file integrity according to the present description is applied; Fig. Figure 2 is a schematic block diagram showing a single embodiment of a file that is subdivided according to the present description for the purpose of preserving file integrity; Fig. Figure 3 is a schematic block diagram showing a single embodiment of updating a temporary copy subfile for the purpose of preserving file integrity according to the present description; Fig. Figure 4 is a schematic block diagram showing a single embodiment of creating a temporary copy subfile for the purpose of preserving file integrity according to the present description; Fig. Figure 5 is a schematic block diagram showing a single embodiment of updating the originally intended subfile for the purpose of preserving file integrity in accordance with the present description; Fig. Figure 6 is a schematic block diagram showing another aspect of updating an originally intended subfile for the purpose of preserving file integrity in accordance with the present description; Fig. Figure 7 is a schematic block diagram showing a single embodiment of placing a temporary copy subfile under quarantine for the purpose of preserving file integrity according to the present description; Fig. Figure 8 is a schematic block diagram showing a single embodiment of creating a second temporary copy subfile for the purpose of preserving file integrity according to the present description; Fig. Figure 9 is a schematic block diagram showing a single embodiment of an antivirus control file that can be used in conjunction with preserving file integrity according to the present description; Fig. Figure 10 is a schematic block diagram showing a single embodiment of a computer that can be used for the purpose of preserving file integrity according to the present description; Fig. Figure 11 is a schematic block diagram showing a single embodiment of a device for preserving file integrity according to the present description; and Fig. Figure 12 shows a single embodiment of operations for preserving file integrity according to the present description. Fig. Figure 13 shows another embodiment of operations for preserving file integrity according to the present description. Fig. Figure 14 shows another embodiment of operations for preserving file integrity according to the present description. DETAILED DESCRIPTION

[0016] In one embodiment of the file integrity preservation method described herein, a file is divided into a plurality of subfiles, and a write update operation originally intended for a portion of that file contained within one of the subfiles is instead directed to a temporary copy subfile. In this example, the temporary copy subfile contains a copy of the originally intended subfile of the file and thus corresponds to the originally intended subfile of the original file. Because the temporary copy subfile is updated instead of the original file, the temporary copy subfile, after being updated with the write data, can optionally be scanned for viruses or other malware separately from the original file or its original subfile.In a single embodiment, read access to the original file containing the corresponding original subfile can therefore be optionally permitted while the temporary copy subfile is being updated and scanned.

[0017] In a further embodiment of the present invention, the originally intended file can be updated with the updated content of the uninfected temporary copy subfile if the temporary copy subfile passes the scan test. Conversely, if the write update operation has introduced malware into the temporary copy subfile, the original file and its corresponding original subfile remain uncontaminated by the write update operation. Consequently, access to the original file and its corresponding original subfile can optionally continue, as they remain uncontaminated and their integrity has been preserved.

[0018] In cases where a read command is executed before a write update operation intended for the same file has been completed and scanned for malware, malware propagation can be avoided because the read operation can optionally be directed to the original file or the subfile, while the write update operation, which might transmit the malware, is directed to the temporary copy subfile. Therefore, if the update data for the write operation should be infected with malware, the read operation will not come into contact with the infected update data.

[0019] Furthermore, if the contaminated temporary copy subfile needs to be quarantined, the original file and its corresponding original subfile do not need to be quarantined, as their integrity has been preserved. Consequently, access to the original file and its corresponding original subfile can optionally continue, since they remain uncontaminated and are not quarantined.

[0020] As used herein, the terms "scan," "antivirus (AV) scan," and "antivirus (AV) program" refer to scanning processes and programs used to detect malware, including but not limited to computer viruses. The term "repair" refers to processing an infected file found to be infected with malware in order to remove or neutralize the malware. The term "quarantining" refers to restricting or completely blocking access to an infected file that has been quarantined to prevent or inhibit the spread of malware from the infected file.

[0021] Fig. Figure 1 is a schematic block diagram illustrating a single embodiment of a data processing system 100, which enables the preservation of file integrity according to a single embodiment of the present invention. The system 100 comprises a plurality of servers 110, represented by servers 110a to 110d, which can scan files, provide a host function, or both. Furthermore, the system 100 comprises a network 120 and a storage system. The network 120 can be the internet, a router, a wide area network, a local area network, or the like. The storage system comprises a first bus 125, a second bus 150, and one or more storage servers 130, represented by servers 130a and 130b, which, in conjunction with one or more storage subsystems 140, represented by storage subsystems 140a, 140b, and 140c, provide a data storage function.In a single embodiment, one or more servers 110, represented by servers 110e, 110f, are included in the storage subsystem.

[0022] One or more servers, such as servers 110a and 110b, can provide a host function to store data in and retrieve data from storage system 180. In some storage systems, an antivirus (AV) program runs outside the servers performing the storage function. Thus, the antivirus software can be run on one or more dedicated servers, such as servers 110c and 110d located outside storage system 180, or servers 110e and 110f located inside storage system 180, to verify that the data contained in a storage unit of storage system 180 is virus-free.To speed up file scanning and allow further use of files, especially large ones, while they are being scanned, a file is typically split into subfiles, and the scanning of these subfiles is distributed across different servers. This allows the various subfiles of a given file to be scanned by different servers, either concurrently or at different times. Furthermore, it is possible to access one subfile of a file while other subfiles of the same file are being scanned.

[0023] Previously, storage systems typically enabled real-time scanning during write operations ("on write"). For example, in conjunction with a write operation, the write data provided by a host server 110a, 110b was directly written to the designated file, and an antivirus scan was initiated on the updated file. This scan typically performed a full scan of the file after the write operation. If the last write command introduced malware and the antivirus scan detected it, an attempt was made to repair the infected file. If the repair failed, the infected file was typically quarantined, thus blocking access to the quarantined file.In some older systems, an entire file, which may be a terabyte or more in size, may be quarantined even though only a relatively small part of the file is actually infected.

[0024] As previously mentioned, according to one embodiment of the present invention, file integrity can be preserved by dividing a file into a plurality of subfiles and directing a write update operation intended for a portion of that file instead to a temporary copy subfile. The temporary copy subfile is a copy of the original portion of the file that was the target of the write operation. Consequently, if malware is included in the update data for the write operation, it would contaminate the temporary copy subfile and not the original intended file or its subfiles. In this way, it is possible to avoid quarantining either the original file or its original subfile.

[0025] Furthermore, it is acknowledged here that an antivirus scan may not have been sufficient to protect a file in cases where a read and a write operation occurred simultaneously. In many older systems, for example, an antivirus scan was typically only initiated after an "open for read" or "close after a write" operation. Consequently, an antivirus scan was often not initiated after every read operation. If one process opened a file for a read operation while another process was writing to the same file, and the write operation introduced malware, the read operation in an older storage system may have read this introduced virus before the antivirus scan and any subsequent repair or quarantine were complete.

[0026] As previously mentioned, according to one embodiment of the present invention, file integrity can be preserved by dividing a file into a plurality of subfiles and directing a write update operation, originally intended for a portion of that file, to a temporary copy subfile instead of to the original file itself or its subfile. If a process opens a file for a read operation while another process is writing infected data originally intended for the same file, the read operation, as a result of preserving file integrity according to one embodiment of the present invention, would accordingly not encounter this malware in the original file or its subfiles, since any malware would be introduced not into the original file being read, but into the temporary copy subfile.

[0027] Each storage subsystem 140 of Fig. 1 can contain one or more control units 160, which control one or more storage units 170. The storage units 170 can be hard disk drives, optical storage units, micromechanical storage units, semiconductor storage units, and the like. The storage servers 130 can manage and control the storage system 180. The storage servers 130 can exchange data with the network 120 and the storage subsystems 140 via the first bus 125 and the second bus 150, respectively.

[0028] Storage units 170 can store files, directory information, metadata, and the like, referred to below as files. Servers 110e and 110f can scan the files to detect and neutralize any malware that may be stored in a file. Servers 110 can be located outside of storage system 180 and / or inside storage system 180, as described above.

[0029] Files in the 180 storage system can grow to varying sizes; they can range from very small to very large. Scanning such large files with a single 110 server can be extremely time-consuming in some systems. Furthermore, a large file being scanned may be inaccessible for the duration of the scan. For important files, this is highly problematic. To speed up file scanning and enable the continued use of files, especially large ones, it is common practice to split a file into subfiles and distribute the scanning of these subfiles across different servers. This allows the various subfiles of a given file to be scanned by different servers, either concurrently or at different times.

[0030] Fig. Figure 2 is a schematic block diagram illustrating a single embodiment of a file 200, the integrity of which can be preserved according to a single embodiment of the present invention. The file 200 can, for example, be stored in the storage system 180 of Fig. 1. As mentioned earlier, a file such as file 200 can be quite large. In one embodiment, for example, file 200 might be larger than 1 terabyte (TB). Here, file 200 is divided into a multitude of subfiles 205, represented by subfiles 205a, 205b, 205c, 205d, and so on. In one embodiment, no subfile 205 exceeds a predetermined size. The predetermined size can vary, for example, from 1 megabyte (MB) to 1 gigabyte (GB). In another example, file 200 can be divided such that each subfile 205 does not exceed a predetermined size of 10 GB. It should be clear that the size of a subfile can vary depending on the specific application.This subdivision process can be started multiple times until the scan of the entire file is completed by the preceding scan of the subdivided file.

[0031] According to one embodiment of the present invention, the division of files into subfiles can serve to preserve file integrity by redirecting a write update operation intended for a part of a particular file to a temporary copy subfile which contains a copy of the intended part of the original file. Fig. Figure 3 shows an example of such file integrity preservation in conjunction with a write update operation for write update data sent from a host server, such as host server 110a. The write update data from host server 110a is intended for data located in a subfile 205b of file 200. Instead of immediately committing the write update data to the intended original subfile 205b of file 200, an initial temporary copy subfile 205b1 is created, corresponding to the original subfile 205b, and the contents of the original subfile 205b are copied into the temporary copy subfile 205b1.

[0032] In a single embodiment, a temporary copy subfile such as the temporary copy subfile 205b1 ( Fig. 3) are created by selecting a temporary storage space for the respective temporary copy subfile from a pool 210 ( Fig. 4) retrieves from available temporary storage locations 210a, 210b, 210c... In this example, the pool of available temporary storage locations 210a, 210b, 210c is provided by storage locations of a disk drive. However, it should be clear that in other embodiments, depending on the specific application, the pool of available temporary storage locations 210a, 210b, 210c can be provided by means of volatile or non-volatile main memory, or by means of storage locations provided by other types of storage units.

[0033] In one embodiment, the file integrity preservation process described herein can be invoked by a command-line interface (CLI) command with a suitable name, such as "Preserve File Integrity on Write". To enable the file integrity preservation process for a specific file, such as file 200, the file integrity preservation process, upon invocation of this command, creates a memory area such as that allocated by pool 210 ( Fig. 4) of available temporary storage locations 210a, 210b, 210c ... are shown, wherein a storage control unit 160 and the storage units 170 are used to hold temporary copy subfiles for file 200. In a single embodiment, the size of the pool 210 can depend on the size of file 200 for which the file integrity maintenance command was invoked and the frequency of write update operations performed on file 200. It should be clear that the size of the pool 210 can vary depending on the specific application.

[0034] In this example, the temporary copy subfile 205b1 is created by using available memory location 210b of the temporary copy subfile from pool 210 of available temporary memory locations. Consequently, a data structure for the temporary copy subfile 205b1 has a pointer to the file's memory location (represented by an arrow 212a) that points to memory location 210b of the temporary copy subfile from pool 210 of available temporary memory locations as the memory location of the temporary copy subfile 205b1. The contents of the intended original subfile 205b are copied to the memory location of the temporary copy subfile 205b1, so that the temporary copy subfile 205b1 is identical to the intended original subfile 205b.

[0035] When a host sends a "write command" to update a file, and the CLI command "Preserve File Integrity on Write" is enabled on the file, the write data associated with the "write command" is not committed to the original file, but rather to the temporary copy subfile at the specified memory location. Once the temporary copy subfile 205b1, which corresponds to the intended original subfile 205b, is available, the update data for the write operation, received for the original subfile 205b, is committed in this example to update the temporary copy subfile 205b1, as indicated by the arrow for the "Write Data Update" operation. Fig. 3 is specified, and is not fixed to update the original subfile 205b. Consequently, the temporary copy subfile 205b1, which is updated with the write data, can be scanned for malware separately from the original file 200 and its corresponding original subfile 205b, as indicated by the arrow for the "Antivirus Scan" operation. Fig. 3 is specified. In a single embodiment, access to the original file 200, which contains the corresponding original subfile 205b, can therefore be permitted while the temporary copy subfile 205b1 is being updated and scanned.

[0036] If the temporary copy subfile 205b1 passes the scan test, the original file 200 can be updated with the scanned and updated content of the uninfected temporary copy subfile 205b1, as indicated by the arrow for the operation "Update with scanned write data if uninfected". Fig. 5 is specified. In a single embodiment, the original file 200 can be updated by retrieving the scanned, updated content from temporary storage space 210b ( Fig. 4) The temporary copy subfile 205b1 is copied to the storage space of the designated original subfile 205b. After the original file 200 has been successfully updated with the scanned, updated content of the temporary copy subfile 205b1, the temporary main or mass storage space occupied by the temporary copy subfile 205b can be released for use by other processes. Thus, the storage space 210b of the temporary copy subfile can be released and returned to pool 210 of storage spaces for temporary copy subfiles.

[0037] Another example of a technique to update the original file 200 with the scanned, updated content of the temporary copy subfile 205b1 is referred to here as a "subfile pointer swap" operation, which is described below in conjunction with Fig. 6 is described. It should be clear that, depending on the specific application, the original file 200 can be updated using other techniques with uninfected update data from the temporary copy subfile 205b1.

[0038] As previously mentioned in connection with Fig. As mentioned in section 4, the temporary copy subfile 205b1 has a pointer to the file's memory location (represented by an arrow 212a) that points to memory location 210b of the temporary copy subfile from pool 210 of available temporary memory locations, which is the memory location of the temporary copy subfile 205b1. Likewise, the intended original subfile 205b has a pointer to the file's memory location (represented by an arrow 212b) that points to the memory location of the original subfile in file 200, which is the memory location of the intended original subfile 205b.Instead of copying the data of the updated and scanned temporary subfile 205b1 from the temporary copy subfile's storage location 210b in the pool to the intended original subfile 205b at its original storage location in file 200, the file pointers of the temporary copy subfile 205b1 and the intended original subfile 205b can be updated by swapping them, as shown in . Fig. 6 is shown.

[0039] After the swap, the intended original subfile 205b has a pointer to the file's storage location (represented by an arrow 212c) that points to storage location 210b of the temporary copy subfile from pool 210 of available temporary storage locations, which is the storage location of the intended original subfile 205b. Similarly, the temporary copy subfile 205b1 has a pointer to the file's storage location (represented by an arrow 212d) that points to the original subfile's storage location within file 200, which is the storage location of the temporary copy subfile 205b1. It is the temporary copy subfile 205b1 that contains the updated data. The swap only occurs after the temporary copy subfile 205b1 has been scanned and confirmed to be free of malware, as described above.In this way, the intended original subfile 205b of file 200 can be updated with the scanned update data for the write operation without actually copying it from the temporary copy subfile 205b1 into the original subfile 205b.

[0040] Updating the original intended subfile 205b with the updated and scanned content of the temporary copy subfile 205b1 involves updating a file pointer for the original intended subfile 205b to mark storage space 210b for the temporary copy subfile of temporary copy subfile 205b1 as the storage space of the original intended subfile 205b, instead of marking the original storage space in file 200 as the storage space of the original intended subfile 205b. Furthermore, it involves updating the pool pointer for the temporary copy subfile 205b1 to mark the storage space of the temporary copy subfile 205b1 as the original storage space of the intended subfile 205b in file 200, instead of marking storage space 210b of the original temporary copy subfile of temporary copy subfile 205b1.Compared to copying the scanned, updated data from the temporary copy subfile into the original subfile, updating file pointers according to the process described here can be achieved faster and more effectively in some embodiments.

[0041] Conversely, if the antivirus scan reveals that the write update operation introduced malware into the temporary copy subfile 205b1, the original file 200 and its corresponding original subfile 205b remain uncontaminated by the write update operation. Consequently, access to the original file 200 and its corresponding original subfile 205b can continue, as they remain uncontaminated and their integrity has been preserved.

[0042] An attempt can be made to repair the infected temporary copy subfile 205b1, as indicated by the arrow for the "Attempt repair if infected" operation. Fig. 3 is specified. The temporary copy subfile 205b1, which has been updated with the write data, can also be scanned again for malware separately from the original file 200 and its corresponding original subfile 205b after the repair attempt, as indicated by the arrow for the "Antivirus scan" operation. Fig. 3 is shown.

[0043] If the repaired temporary copy subfile 205b1 passes the rescan test, the original file 200 can be updated with the rescanned and updated content of the uninfected temporary copy subfile 205b1, as indicated by the arrow for the operation "Update with scanned write data if uninfected". Fig. 5 is specified, using update techniques such as those described above. Conversely, the temporary copy subfile 205b1 can be quarantined, as described in Fig. Figure 7 shows what happens if the subsequent antivirus scan reveals that the repair of the temporary copy subfile 205b1 failed, leaving the temporary copy subfile 205b1 contaminated by the write update operation. Consequently, memory area 210b ( Fig. 4), which is occupied by the quarantined temporary subfile 205b1, is marked as unavailable for use. It should be clear that the number of repair attempts and the number of failed rescans that occur before the temporary copy subfile is quarantined may vary depending on the application.

[0044] If the contaminated temporary copy subfile 205b1 is quarantined, the original file 200 and its corresponding original subfile 205b do not need to be quarantined, as described in Fig. As shown in Figure 7, their integrity has been preserved because subfile 205b1 is quarantined in temporary storage space and not pinned to a location within file 200. Consequently, access to the original file 200 and its corresponding original subfile 205b1 continues, as they remain uncontaminated and are not quarantined.

[0045] After the temporary copy subfile 205b1 is quarantined, file 200 does not contain the latest updates represented by the quarantined update data for the write operation. In one embodiment, the original host server 110a, which provided the original update data for the write operation, can be requested to resend the update data for the write operation. In another embodiment of the present invention, a second temporary copy subfile, derived from the temporary copy subfile 205b2 ( Fig. 8) is shown, if the first temporary copy subfile 205b1 is quarantined. In a single embodiment, a second temporary copy subfile, such as the temporary copy subfile 205b2 ( Fig. 8) can be created by retrieving temporary storage space in a manner similar to that described above in connection with the temporary copy subfile 205b1. In this example, the temporary copy subfile 205b2 is created by using an available storage space 210d of the temporary copy subfile from the pool of 210 available temporary storage spaces. Consequently, a data structure for the temporary copy subfile 205b2 has a file storage pointer (represented by an arrow 212e) that points to the storage space 210d of the temporary copy subfile from the pool of 210 available temporary storage spaces as the storage space of the temporary copy subfile 205b2.The contents of the intended original subfile 205b are copied to the storage space of the temporary copy subfile 205b2, so that the temporary copy subfile 205b2 corresponds to the intended original subfile 205b just as the first temporary copy subfile 205b1 did.

[0046] Once the temporary copy subfile 205b2, which corresponds to the intended original subfile 205b, is available, the update data for the write operation, which was resent by the original host server 110a for the write operation intended for the original subfile 205b, is committed to update the temporary copy subfile 205b2 in the same way as described above in connection with the temporary copy subfile 205b1. Consequently, the temporary copy subfile 205b2, updated with the write data, can be scanned for malware in the same way as described above in connection with the temporary copy subfile 205b1.

[0047] If the temporary copy subfile 205b2 passes the scan test, the original file 200 can be updated with the scanned and updated content of the uninfected temporary copy subfile 205b2, as described above in conjunction with the temporary copy subfile 205b1. After the successful update of the original file 200 with the scanned, updated content of the temporary copy subfile 205b2, the temporary main or mass storage space occupied by the temporary copy subfile 205b2 can be released and returned to pool 210 of storage spaces for temporary copy subfiles.

[0048] Conversely, if the antivirus scan reveals that the resent update data for the write operation has again introduced malware, this time into the temporary copy subfile 205b2, it can be attempted to repair and rescan the infected temporary copy subfile 205b1 one or more times, as described above in connection with temporary copy subfile 205b1. If the resent update data for the write operation is quarantined again, file 200 can be marked with a suitable message, such as "not up to date," to indicate that the respective file area (in this example, subfile 205b) has not been updated.In this example, the user can also be informed that the respective file area (in this example, subfile 205b) was not updated and that the temporary copy subfiles 205b1 and 205b2 have been quarantined. Furthermore, the original host server (in this example, host server 110a) can be requested not to resend the respective update data for the write operation that was found to contain malware and could not be repaired, as discussed above. In a single embodiment, all subsequent write update operations from the same host (in this example, host server 110a) to the same subfile (in this example, subfile 205b) can also be rejected.

[0049] In a further embodiment of the present invention, the user can optionally delete the quarantined subfile data of the quarantined subfiles 205b1 and 205b2 as soon as they are informed that subfile 205b has not been updated and that the temporary copy subfiles 205b1 and 205b2 have been quarantined. If this occurs, the contents of the infected storage locations 210b and 210d are deleted, and a further antivirus scan is performed in these areas. If it is determined that a storage location that previously contained a quarantined temporary copy subfile is free of malware, the storage location can be returned to the pool of temporary storage locations 210.In a single embodiment, subsequent write update operations can also be assumed to be performed from the same host (in this example from host server 110a) on the previous subfile 205b, for which the temporary copy subfiles 205b1, 205b2 were quarantined.

[0050] From the above, it can be seen that a host sending an "open read" command for the file receives file data that is virus-free. As mentioned earlier, the host is notified that the file contains a section (in this example, a subfile) that has not been updated due to a detected virus. Because the file has not been updated, an "open read" command from a host, as is currently the case, will not trigger an antivirus scan unless the antivirus scan engines have been updated with newer antivirus software.

[0051] After the first temporary copy subfile 205b1 is quarantined, file 200, as mentioned previously, does not contain the latest updates represented by the quarantined update data for the write operation. In another embodiment, the original host server 110a, which provided the initial update data for the write operation, can be requested not to send any update data for the write operation to subfile 205b. Instead, a second host, such as host server 110b, can be requested to provide the update data for the write operation intended for updating subfile 205b.In this example, the update data for the write operation provided by the second host server 110b can be the same as that provided by the first host server 110a, but it can be free of malware.

[0052] If the first temporary copy subfile 205b1 is quarantined, then in this example a second temporary copy subfile, which is derived from the temporary copy subfile 205b2 ( Fig. 8) is generated to receive the update data for the write operation from the second host server 110b in a manner similar to that described above in connection with the first host server 110a. If the temporary copy subfile 205b2, which contains the update data for the write operation from the second host server 110b, passes the scan test, the original file 200 can be updated with the scanned and updated content of the uninfected temporary copy subfile 205b2, as described above in connection with the temporary copy subfile 205b1.After the successful update of the original file 200 with the scanned, updated content of the temporary copy subfile 205b2, the temporary main or mass storage space occupied by the temporary copy subfile 205b2 can be released and returned to pool 210 of storage spaces for temporary copy subfiles. Furthermore, the first host server 110a can be permitted to resume sending subsequent write update operations intended for subfile 205b.

[0053] Conversely, file 200 can be marked with a suitable message, such as "not up to date," to indicate the specific file range (in this example, subfile 205b) that was not updated when the update data for the write operation sent by the second host server 110b is also quarantined. In this example, the user can also be informed that the specific file range (in this example, subfile 205b) was not updated and that the temporary copy subfiles 205b1 and 205b2 have been quarantined. Furthermore, the second host server (in this example, host server 110b) can be requested not to resend the respective update data for the write operation that was found to contain malware and could not be repaired, as discussed above.In a single embodiment, all subsequent write update operations from the same host (in this example, host server 110b) on the same subfile (in this example, subfile 205b) can also be rejected.

[0054] In a further embodiment of the present invention, the user can also selectively delete the quarantined subfile data of the quarantined subfiles 205b1 and 205b2 in this example as soon as they are informed that subfile 205b has not been updated and that the temporary copy subfiles 205b1 and 205b2 have been quarantined. If this is the case, the contents of the infected storage locations 210b and 210d are deleted, and a further antivirus scan is performed in these areas. If it is determined that a storage location that previously contained a quarantined temporary copy subfile is free of malware, the storage location can be returned to the pool of temporary storage locations 210.In a single embodiment, the subsequent write update operations would also be assumed to be performed by the same hosts (in this example, by host servers 110a, 110b) intended for subfile 205b, for which the temporary copy subfiles 205b1, 205b2 have been quarantined.

[0055] In one embodiment, the size of each subfile 205 can be chosen to be proportional to the capacity of a server 110 that scans the subfiles, such as the original subfile 205b and its corresponding temporary copy subfiles 205b1 and 205b2. The size can be fixed or dynamically assigned. It should be clear that other sizes and other techniques for selecting the respective size of the subfiles can be used depending on the specific application.

[0056] Fig. Figure 9 is a schematic block diagram showing a single embodiment of an antivirus control file 302. The antivirus control file 302 contains an entry 220 for each subfile, original or temporary, to be scanned. In a single embodiment, each entry 220 contains a status 230, a server identifier 235, and a subfile address 240.

[0057] Status 230 can be selected from the group consisting of the states "in-queue," "quarantined," and "cleared." The "in-queue" status can indicate that an original or temporary copy subfile 205 is scheduled for scanning a server 110 but has been found to be infected with malware. In one embodiment, subfiles 205 with the "in-queue" status can be accessed. Alternatively, subfiles 205 with the "in-queue" status can be inaccessible. In the manner used here, "accessed" refers to a subfile 205 being read from and / or written to by an application, operating system, or the like.

[0058] The status "quarantined" can indicate that malware has been found in subfile 205. In a single implementation, subfiles 205 with a "quarantined" status cannot be accessed. Subfiles 205 with a "quarantined" status can be scheduled for preventive cleanup, deletion, or other processing. Preventive cleanup can include repair to remove malware from subfile 205, overwriting subfile 205 with a backup copy, recreating subfile 205 using error codes and / or redundant data, and the like.

[0059] The status "cleared" can indicate that subfile 205 has been scanned and that no malware was found. In a single embodiment, subfiles 205 with a status of "cleared" can be accessed. For example, if the first subfile 205a of a large database file 200 has been scanned and has a status of "cleared", then the first subfile 205a can be accessed.

[0060] The server identifier 235 can identify server 110, which was assigned to scan subfile 205. In one embodiment, the server identifier 235 is a network address. Alternatively, the server identifier 235 can be a logical name.

[0061] Subfile address 240 can contain a start address and an end address for subfile 250. In a single embodiment, subfile address 240 contains start and end addresses for a plurality of segments that constitute the subfile.

[0062] Fig. Figure 10 is a schematic block diagram showing a single embodiment of a computer 300. The computer 300 can be the server 110. Alternatively, the computer 300 can be a storage server 130, a control unit 160, or the like. The computer 300 can contain a processor 305, main memory 310, and data transmission hardware 315. The main memory 310 can be a semiconductor memory unit, a hard disk drive, or a combination thereof. The main memory 310 can store computer-readable program code. The processor 305 can execute the computer-readable program code. The computer 300 can exchange data with the external units via the data transmission hardware 315.

[0063] Fig. Figure 11 is a schematic block diagram showing a single embodiment of a device 350 for preserving file integrity. The device 350 can be implemented in the computer 300. The device 350 includes an antivirus control file 320, a subdivision module 325, an access module 330, and a subfile update module 360.

[0064] In a single embodiment, the antivirus control file 320, the subdivision module 325, the access module 330, and the subfile update module 360 ​​can be configured in a computer-readable storage medium that stores computer-readable program code. The computer-readable storage medium can be the main memory 310. The processor 305 can execute the computer-readable program code to perform the functions of the antivirus control file 320, the subdivision module 325, the access module 330, and the subfile update module 360.

[0065] The subdivision module 325 can divide the file 200 into a multitude of subfiles 205 and create the temporary copy subfiles. The access module 330 can manage the status of each subfile 205. Furthermore, the access module 330 can scan each subfile 205 with a separate server 110, as described here. If the subfile passes the scan check, the subfile update module 360 ​​can update the subfile with the scanned update data.

[0066] Fig. Figure 12 shows a single embodiment of operations for preserving file integrity according to the present description. After a write data update is initiated (Block 400), in which a host provides write data intended to update a portion of a file, the write data update is instead used to update a temporary copy subfile, corresponding to a subfile of the file containing the intended portion of the write data operation (Block 404). After the temporary copy subfile of the file has been updated by the write update operation, the updated temporary copy subfile is scanned for malware (Block 408). If the scanned, updated temporary copy subfile passes the scan check (Block 412), the file or its original subfile can be updated with the scanned, updated contents of the temporary copy subfile (Block 416).Furthermore, any locks applied to older sources of infected write data for the file's subfile can be removed (block 420) to allow access to the subfile for the previously locked sources.

[0067] If the updated, scanned temporary copy subfile fails the scan check (Block 412) in that it is found to be infected with malware, an optional attempt (Block 434) can be made to repair the scanned, updated temporary copy subfile that was found to be infected with malware. After the repair attempt is complete, the temporary copy subfile can be rescanned (Block 436) to determine if the repair attempt was successful. If the temporary copy subfile fails the scan check again, that is, if the repair attempt was unsuccessful (Block 436), the temporary copy subfile can be quarantined (Block 440). In one embodiment, it can be determined (Block 448) whether a retransmission of the update data should be requested for the write operation.The request to resend the update data for the write operation can be made to the original source of the update data or to a different source. If a resend of the update data for the write operation is requested and received, the resent update data can be used to update another temporary copy subfile (block 404), and the operations of blocks 404 through 448 can be repeated.

[0068] If it is determined (block 448) that the retransmission of the update data for the write operation should not be requested, the source of the infected update data for the write operation can be temporarily blocked (block 450), so that no further access to the subfile for which the write data update was intended is possible. In a particular embodiment, further operations can be performed, as described in connection with Fig. 13 is explained in more detail below.

[0069] If the repair attempt (block 434) allows the updated temporary copy subfile to pass the scan check (block 436), indicating that the repair was successful, the file or its original subfile can be updated with the scanned, updated content of the temporary copy subfile (block 416). Furthermore, any locks applied to older sources of infected write data for the file's subfile can be removed (block 420) to allow access to the subfile for the previously locked sources.

[0070] As mentioned previously, further operations can optionally be performed if it is determined (Block 448) that no further retransmissions of the update data should be requested for the write operation. Fig. Figure 13 shows an example of operations that can be started (block 500) after a temporary copy subfile has been quarantined (block 440, Fig. 12) In a single embodiment, further operations may include deleting (block 504) the contents of the quarantined temporary copy subfiles and scanning (block 508) the storage locations of the deleted temporary copy subfiles to ensure they are free of malware. If so, the storage locations of the temporary copy subfiles may be returned to a pool of temporary copy subfiles for use by other processes (block 516). Alternatively, if scanning (block 508) the storage locations of the deleted temporary copy subfiles indicates that malware is still present, the storage locations of the temporary copy subfiles may remain quarantined (block 520).In some embodiments, one or more additional attempts may be made to clean up the storage locations of the temporary copy subfile that have been found to contain malware.

[0071] As previously mentioned in connection with Fig. As mentioned in point 12, this can happen if a temporary copy subfile is quarantined (block 440, Fig. 12), it will be determined (Block 448) whether a repeat transmission of the update data should be requested for the write operation. Fig. 14 refers to an embodiment in which the requirement to resend the update data for the write operation is made to a different source than the original source of the update data for the write operation.

[0072] In this embodiment, the resent update data for the write operation can be used from the second source to replace the originally intended subfile 205b ( Fig. 8) to update the original file 200 to another temporary copy subfile (Block 404, Fig. 12), and the operations of blocks 404 to 448 ( Fig. 12) can be repeated with reference to the second temporary copy subfile. After receiving (block 600) the retransmitted update data for the write operation from a second host, the retransmitted update data intended for updating subfile 205b is instead used to update (block 604) a second temporary copy subfile 205b2, which corresponds to subfile 205b of file 200, containing the intended portion of the write data operation. After the second temporary copy subfile of the file has been updated with the write update operation, the updated second temporary copy subfile is scanned for malware (block 608).If the scanned, updated second temporary copy subfile passes the scan check (block 612), file 200 or its original subfile 205b can be updated with the scanned, updated content of the second temporary copy subfile (block 616). Furthermore, any locks applied to older sources, such as the original source of the infected write data for the file's subfile, can be removed (block 620) to allow access to the subfile for the previously locked sources.

[0073] If the updated, scanned second temporary copy subfile 205b2 fails the scan check (Block 612) in that it is found to be infected with malware, an attempt can be made (Block 634) to repair the scanned, updated second temporary copy subfile that was found to be infected with malware. After the repair attempt is complete, the second temporary copy subfile can be scanned again (Block 636) to determine if the repair attempt was successful. If the second temporary copy subfile fails the scan check again, that is, if the repair attempt was unsuccessful (Block 636), the second temporary copy subfile can be quarantined (Block 640).In one embodiment, it can be determined (block 448) whether a retransmission of the update data for the write operation should be requested from the second source or another source. If a retransmission of the update data for the write operation is requested and this update data is received, the retransmitted update data for the write operation can be used to update another (such as a third) temporary copy subfile (block 604), and the operations of blocks 604 to 648 can be repeated.

[0074] If it is determined (block 648) that the retransmission of the update data for the write operation should not be requested again, the second source of the infected update data for the write operation can be temporarily blocked (block 650), so that no further access is possible to the subfile for which the write data update was intended. In a particular embodiment, further operations can be performed on the quarantined second temporary copy subfile, as described in conjunction with Fig. Section 13 above was explained in more detail.

[0075] If the repair attempt (block 634) allows the updated second temporary copy subfile to pass the scan check (block 636), indicating that the repair was successful, file 200 or its original subfile 205b can be updated with the scanned, updated content of the second temporary copy subfile (block 616). Furthermore, any locks applied to older sources of infected write data for the file's subfile can be removed (block 620) to allow access to the subfile for the previously locked sources.

[0076] The present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium (or storage media) containing computer-readable program instructions to instruct a processor to implement aspects of the present invention.

[0077] The computer-readable storage medium can be a physical entity capable of receiving and storing instructions for use by an instruction execution unit. For example, but not limited to, the computer-readable storage medium can be an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination thereof.A list of more specific, but not exhaustive, computer-readable storage media includes the following examples: a portable computer floppy disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically coded unit such as punched cards or raised structures in a groove with instructions recorded on them, and any suitable combination of the foregoing.A computer-readable storage medium in the manner used here is not to be interpreted as containing short-term signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating via a waveguide or other transmission media (e.g., light pulses guided through an optical fiber cable), or electrical signals transmitted via a cable.

[0078] Computer-readable program instructions, as described herein, can be downloaded from a computer-readable storage medium to appropriate computing / processing units or, via a network such as the internet, a local area network, a wide area network, and / or a wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer-readable program instructions from the network and forwards them to be stored on a computer-readable storage medium within the respective computing / processing unit.

[0079] The computer-readable program instructions for performing operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or either source code or object code written in any combination of one or more programming languages, including an object-oriented programming language such as Smalltalk, C++, or the like, as well as conventional procedural programming languages ​​such as the programming language "C" or similar programming languages.The computer-readable program instructions can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be established to an external computer (for example, via the internet through an internet service provider).In some embodiments, electronic circuits, including, for example, programmable logic circuits, free form factored general-purpose (FPGA) or programmable logic arrays (PLA), can execute computer-readable program instructions by using state information from the computer-readable program instructions to personalize the electronic circuits in order to implement aspects of the present invention.

[0080] Aspects of the present invention are described here with reference to representations in flowcharts and / or block diagrams of processes, devices (systems), and computer program products according to embodiments of the invention. It is understood that each block of the representations in the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be implemented as program instructions that can be read by a computer.

[0081] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or any other programmable data processing device to create a machine such that the instructions executed through the processor of the computer or other programmable data processing device will create a means of performing the functions / operations specified in the block or blocks of the flowcharts and / or block diagrams.These computer-readable program instructions can also be stored in a computer-readable storage medium that can instruct a computer, a programmable data processing device and / or other units to operate in a certain manner, such that the computer-readable storage medium containing instructions has a manufactured item that includes instructions implementing aspects of the function / operation which is specified in the block or blocks of the flowcharts and / or block diagrams.

[0082] The computer-readable program instructions can also be loaded onto a computer, other programmable data processing device, or other unit to effect the execution of a series of operational steps on the computer, other programmable device, or other unit to produce a computer-executed process, such that the instructions executed on the computer, other programmable device, or other unit perform the functions / operations specified in the block or blocks of the flowcharts and / or block diagrams.

[0083] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, processes, and computer program products according to various embodiments of the present invention. In this respect, each block in the flowcharts or block diagrams can represent a module, segment, or part of instructions, which includes one or more executable instructions for performing the specified logical function(s). In some alternative implementations, the functions specified in the block may not occur in the order shown in the figures.Depending on their associated functionality, for example, two blocks represented as consecutive blocks may actually be executed largely simultaneously, or the blocks may sometimes be executed in reverse order. It will also be found that each block in the block diagrams and / or flowcharts, as well as combinations of blocks in the block diagrams and / or flowcharts, can be implemented by systems based on specialized hardware that perform the specified functions or operations, or combinations of instructions from specialized hardware and computer instructions.

[0084] The descriptions of the various embodiments of the present invention are provided for illustrative purposes only, but do not claim to be exhaustive and are not to be understood as limited to the disclosed embodiments. Many modifications and alterations are recognizable to those skilled in the art without deviating from the scope and nature of the described embodiments. The terminology used here was chosen to best explain the basic concepts of the embodiments, their practical application, or technical improvements compared to technologies already on the market, or to enable other experts to understand the embodiments disclosed herein.

Claims

[1] Method for updating a file, wherein the method includes operations by a processor, wherein the operations include: Receiving update data to update a first subfile of a file, where the contents of the first subfile are located in a first position; Creating a first temporary copy subfile that corresponds to the first subfile of the file, with the contents of the first temporary copy subfile located in a first temporary location; Updating the first temporary copy subfile with the update data instead of updating the first subfile with the update data; Scanning the updated first temporary copy subfile; and If the updated first temporary copy subfile passes the scan check, update the first subfile with the scanned update of the first temporary copy subfile. where updating the first sub-file with the contents of the first temporary copy sub-file involves copying scanned update data from the first temporary location of the updated temporary copy sub-file to the first location of the first sub-file. [2] Method according to claim 1, wherein the operation comprises creating a first temporary copy subfile: Retrieving an initial temporary storage space for the first temporary copy subfile from a pool of available temporary storage spaces, wherein the operations further include freeing and returning the initial temporary storage space for the first temporary copy subfile to the pool of available temporary storage spaces after the first subfile has been updated with the scanned contents of the first temporary copy subfile. [3] Method according to claim 1, wherein the content of the first subfile is located at a first original memory location and the first subfile has a pointer to a first memory location that denotes the first original memory location of the first subfile, wherein the contents of the first temporary copy subfile reside in a first original temporary storage space and the first temporary copy subfile has a pointer to a first temporary storage space that denotes the first original temporary storage space of the first temporary copy subfile, and where updating the first subfile with scanned content of the first temporary copy subfile involves updating the pointer to a first storage location for the first subfile to mark the first original temporary storage location of the first temporary copy subfile as the storage location of the first subfile, rather than marking the first original storage location as the storage location of the first subfile, and wherein the operations further include updating the pointer to a first temporary storage location for the first temporary copy subfile to mark the temporary storage location of the first temporary copy subfile as the first original storage location, rather than marking the first original temporary storage location of the first temporary copy subfile. [4] The method of claim 1, wherein the operations further comprise: Repair the updated first temporary copy subfile if the updated first temporary copy subfile fails the scan check; Rescanning the updated first temporary copy subfile; and Update the first subfile with rescanned content from the first temporary copy subfile if the updated first temporary copy subfile passes the rescan check. [5] Method according to claim 4, wherein a first host is a source of update data for the first subfile and the operations further comprise: Sub-quarantine locations of the updated first temporary copy subfile and Block write access to the first subfile by the first host if the updated first temporary copy subfile fails the rescan check. [6] The method of claim 5, wherein the operations further comprise: Request and receive a repeat transmission of the update data to update the first subfile of the file when the updated first temporary copy subfile is quarantined; Create a second temporary copy subfile that corresponds to the first subfile of the file; Updating the second temporary copy subfile with resent update data, instead of updating the first subfile with the resent update data; Scanning the updated second temporary copy subfile; and If the updated second temporary copy subfile passes the scan check, update the first subfile with the scanned content of the second temporary copy subfile and remove the first host's block on write data access to the first subfile. [7] The method of claim 6, wherein the operations further comprise: Repair the updated second temporary copy subfile if the updated second temporary copy subfile fails the scan check; Rescanning the updated second temporary copy subfile; and Update the first subfile with the rescanned content of the second temporary copy subfile if the updated second temporary copy subfile passes the rescan check. [8] Method according to claim 7, wherein the operations further comprise: If the updated second temporary copy subfile fails the rescan check, quarantine the updated second temporary copy subfile. [9] The method of claim 5, wherein the operations further comprise: Requesting and receiving a repeat transmission of the update data from a second host to update the first subfile of the file when the updated first temporary copy subfile is quarantined; Create a second temporary copy subfile that corresponds to the first subfile of the file; Updating the second temporary copy subfile with resent update data instead of updating the first subfile with the resent update data; Scanning the updated second temporary copy subfile; and Updating the first subfile with the scanned content of the second temporary copy subfile and removing the first host's block on write data access to the first subfile if the updated second temporary copy subfile passes the scan check. [10] The method of claim 9, wherein the operations further comprise: Repair the updated second temporary copy subfile if the updated second temporary copy subfile fails the scan check; Rescanning the updated second temporary copy subfile; and Update the first subfile with rescanned content from the second temporary copy subfile if the updated second temporary copy subfile passes the rescan check. [11] The method of claim 10, wherein the operations further comprise: Place the updated second temporary copy subfile under quarantine if the updated second temporary copy subfile fails the rescan check. [12] System that features: at least one storage system comprising at least one storage unit configured to store a file which has a subfile of the file, and at least one storage control unit configured to access and control storage units of the at least one storage system; and at least one computer-readable storage medium with computer-readable program instructions implemented thereon, wherein the program instructions are executable by the storage system to cause the storage system to perform operations, wherein the operations comprise: Receiving update data to update a first subfile of a file, where the contents of the first subfile are located in a first position; Creating a first temporary copy subfile that corresponds to the first subfile of the file, with the contents of the first temporary copy subfile located in a first temporary location; Updating the first temporary copy subfile with the update data instead of updating the first subfile with the update data; Scanning the updated first temporary copy subfile; and Update the first subfile with the scanned update of the first temporary copy subfile if the updated first temporary copy subfile passes the scan check. where updating the first sub-file with the contents of the first temporary copy sub-file involves copying scanned update data from the first temporary location of the updated temporary copy sub-file to the first location of the first sub-file. [13] System according to claim 12, wherein at least one storage unit has a pool of available temporary storage spaces and wherein the operation of creating a first temporary copy subfile comprises retrieving a temporary storage space for the first temporary copy subfile from the pool of available temporary storage spaces, wherein the operations further comprise freeing and returning the temporary storage space for the first temporary copy subfile to the pool of available temporary storage spaces after the first subfile has been updated with the scanned content of the first temporary copy subfile. [14] System according to claim 12, wherein the content of the first subfile is located at a first original memory location and the first subfile has a pointer to a first memory location that identifies the first original memory location of the first subfile, wherein the content of the first temporary copy subfile is located at a first original temporary memory location and the first temporary copy subfile has a pointer to a first temporary memory location that identifies the first original temporary memory location of the first temporary copy subfile, and wherein updating the first subfile with the scanned content of the first temporary copy subfile comprises updating the pointer to a first memory location for the first subfile to identify the first original temporary memory location of the first temporary copy subfile as the memory location of the first subfile,instead of designating the first original memory location as the memory location of the first subfile, and wherein the operations further include updating the pointer to a first temporary memory location for the first temporary copy subfile in order to designate the temporary memory location of the first temporary copy subfile as the first original memory location, instead of designating the first original temporary memory location of the first temporary copy subfile. [15] System according to claim 12, wherein the operations further comprise: If the updated first temporary copy subfile fails the scan check, repair the updated first temporary copy subfile; Rescanning the updated first temporary copy subfile; and If the updated first temporary copy subfile passes the rescan check, update the first subfile with the rescanned content of the first temporary copy subfile. [16] System according to claim 15, further comprising a first host and / or a second host, wherein the first host is a source of update data for the first subfile, and wherein the operations further comprise: If the updated first temporary copy subfile fails the rescan check, the updated first temporary copy subfile will be quarantined and write access to the first subfile will be blocked by the first host; When the updated first temporary copy subfile is quarantined, request and receive a repeat transmission of the update data from the first host and / or the second host to update the first subfile of the file; Create a second temporary copy subfile that corresponds to the first subfile of the file; Updating the second temporary copy subfile with the resent update data, instead of updating the first subfile with resent update data; Scanning the updated second temporary copy subfile; If the updated second temporary copy subfile passes the scan check, update the first subfile with the scanned content of the second temporary copy subfile and remove the first host's block on write data access to the first subfile; If the updated second temporary copy subfile fails the scan check, repair the updated second temporary copy subfile; Rescanning the updated second temporary copy subfile; If the updated second temporary copy subfile passes the rescan check, update the first subfile with the rescanned content of the second temporary copy subfile; and Sub-quarantine locations of the updated second temporary copy subfile, if the updated second temporary copy subfile fails the rescan check. [17] Computer program product for use with at least one storage system, comprising at least one storage unit configured to store a file which has a subfile of the file, and at least one storage control unit configured to access and control storage units of the at least one storage system, wherein the computer program product comprises at least one computer-readable storage medium with computer-readable program instructions implemented therein, wherein the program instructions are executable by the storage system to cause the storage system to execute the method according to any one of claims 1 to 11.

Images