Maintaining the security of a system

Abstract

Method (200) implemented by a computer (150) for maintaining the security of a data processing system, wherein the method (200) comprises: Receiving (220) metadata from a metadata storage unit by one or more computer processors (154), wherein the metadata pertains to at least one part of a file and wherein the metadata contains one or more indicators of viruses; Generating (230) a priority by the one or more computer processors for at least one part of the data file according to the metadata; Performing a check (250) of at least one part of the data file by the one or more computer processors (154) according to priority; Updating (260) the metadata of at least one part of the data file according to the verification by the one or more computer processors; and Making (280) the data file available for further processing by the one or more computer processors (154), where a checksum is assigned to the metadata, which is continuously determined in parallel with the flow of the data file into a data storage device.

Description

Technical area

[0001] The disclosure generally relates to maintaining the security of a data processing system and the integrity of data in a large data storage system. More particularly, the disclosure relates to maintaining system security and data integrity by checking for malicious code and data. BACKGROUND

[0002] Current multi-tenant systems, such as those in healthcare, retail, telecommunications, and financial services, may encompass multiple vendors, customers, and service organizations connected to a single logical data processing system. The logical data processing system can be cloud-based or on-premises and receive both continuous data streams and bulk data packets, accumulating in a data store to gigabytes and terabytes of data.

[0003] Incoming data must be scanned for viruses, malware, and other malicious data to maintain the security of the system and its users. Existing data must be rescanned, as virus definitions are updated when new zero-day exploits are discovered. An intrusion prevention system (IPS) is used to monitor incoming data. The IPS can be integrated, monitoring real-time data as it is transferred from external sources in the data stream to the data lake for storage, or it can be external, processing copies of the data forwarded to the IPS. Incoming data can also include redundant data, increasing the IPS's workload because duplicate content must be reviewed.

[0004] The IPS's audit activities must be performed without interrupting customer access to the data and without disrupting the continuous flow of incoming data. Data flows must be delivered to the system without interruption to continue normal operations, reduce ingress / egress costs, reduce or eliminate waste of system resources, and maintain full access to system services for users and other parts of the system platform.

[0005] There are already a number of publications in this technical field. Document EP 2 686 803 B1 describes systems and methods for looking up metadata for protection against malware. Methods and systems are described that predict when anti-malware metadata is needed. Based on this information, malware lookups are then prioritized. Document US 8 302 193 B1 additionally describes methods and systems for searching files for switching programs. For this purpose, initial malware identifiers associated with a first malware program are determined in the files. A similar procedure is followed for a second malware identifier. Furthermore, document WO 2005 / 119 489 A2 describes an email distribution system using metadata for emails to manage a virtual memory. The metadata indicates the processing status of emails.Finally, document EP 2 002 640 B1 describes a file transcoding process using a distributed file system. This process also involves the creation of checksums, which help confirm that data in specific sections has not been corrupted by random hardware errors, such as those that can occur in complex electronic systems.

[0006] Despite these advances, there is still a need in technology to solve the aforementioned problem in order to provide further improved protection against malware. SUMMARY

[0007] This object is achieved by the subject matter of the independent patent claims. Further embodiments are described by the respective dependent patent claims. In a further aspect, the present invention provides a computer-implemented method for maintaining the security of a data processing system, the method comprising: receiving, by one or more computer processors, metadata from a metadata storage unit, wherein the metadata is associated with at least a portion of a data file; generating, by the one or more computer processors, a priority for the at least a portion of the data file according to the metadata; and performing, by the one or more computer processors, a check of the data file according to the priority; wherein the metadata comprises one or more indicators of viruses.

[0008] In another aspect, the present invention provides a computer-implemented method for maintaining the security of a system, the method comprising: receiving, by one or more computer processors, an updated virus definition; obtaining, by one or more computer processors, metadata associated with at least one data file from a metadata storage device; generating, by the one or more computer processors, a priority for the at least one data file according to the metadata and the updated virus definition; selecting, by the one or more computer processors, a data file according to the priority; performing a check on the data file, by the one or more computer processors; updating, by the one or more computer processors, the metadata of the data file according to the check;and making the data file available to the one or more computer processors for further processing;

[0009] In another aspect, the present invention provides a computer-implemented method for maintaining the security of a system, the method comprising: obtaining, by one or more computer processors, metadata associated with at least one data file from a metadata storage device; generating, by the one or more computer processors, a priority for the at least one data file according to the metadata; selecting, by the one or more computer processors, a data file according to the priority; performing a review of the data file, by the one or more computer processors; determining, by the one or more computer processors, a common vulnerabilities and exposures (CVE) assessment for the data file; updating, by the one or more computer processors, the metadata of the data file according to the review;and providing the assessment by the one or more computer processors to a system user for evaluation.;

[0010] In another aspect, the present invention provides a computer system for maintaining the security of a system, the computer system comprising: one or more computer processors; one or more computer-readable storage devices; and stored program instructions on the one or more computer-readable storage devices for execution by the one or more computer processors, the stored program instructions comprising: program instructions for receiving metadata associated with at least one data file from a metadata storage device; program instructions for generating a priority for the at least one data file according to the metadata; and program instructions for performing a check on the data file according to the priority; wherein the metadata comprises one or more indicators of viruses.

[0011] In another aspect, the present invention provides a computer program product for maintaining the security of a system, the computer program product comprising a computer-readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit to perform a method for performing the steps of the invention.

[0012] In another aspect, the present invention provides a computer program stored on a computer-readable medium and loadable into the internal memory of a digital computer, the computer program comprising software code portions for performing the steps of the invention when the program is executed on a computer.

[0013] In another aspect, the present invention provides a computer program product for maintaining the security of a system, the computer program product comprising one or more computer-readable storage devices and stored program instructions on the one or more computer-readable storage devices, the stored program instructions comprising: program instructions for receiving metadata associated with at least one data file from a metadata storage device; program instructions for generating a priority for the at least one data file according to the metadata; and program instructions for performing a check on the data file according to the priority; wherein the metadata comprises one or more indicators of viruses.

[0014] The following is a brief summary to provide a basic understanding of one or more embodiments of the disclosure. This brief summary is not intended to identify important or critical elements or to delimit the scope of any embodiment or the scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that follows later. In one or more embodiments described herein, devices, systems, computer-implemented methods, apparatus, and / or computer program products enable prioritizing and scanning data files for malicious code before allowing users to access the data.

[0015] In one aspect, the invention comprises methods, systems, and computer-readable media related to maintaining the security of a system by continuously monitoring data files as they are received in stream or in bulk before the files are processed or otherwise accessed by users. In this aspect, the systems, methods, and computer program products operate by receiving metadata associated with at least a portion of a data file from a metadata storage device, generating a priority for the at least a portion of a data file according to the metadata, and performing a scan of the portion of the data file. The metadata includes one or more indicators of viruses. Once received, the data is made available to users without interruption.

[0016] In one aspect, the invention encompasses methods, systems, and computer-readable media related to maintaining the security of a system as virus definitions change over time. In this aspect, the systems, methods, and computer program products operate by receiving an updated virus definition, obtaining metadata associated with at least one data file from a metadata storage device, generating a priority for the at least one data file according to the metadata and the updated virus definition, selecting a data file according to the generated priority, performing a check on the data file, updating the metadata of the data file according to the check, and providing the data file for further processing.

[0017] In one aspect, the invention encompasses methods, systems, and computer-readable media related to maintaining the security of a system, with the additional benefit of providing a user or an automated receiving system with an assessment of common vulnerabilities and threats for each scanned file. The user or receiving system then determines whether the scanned file should be loaded into a data processing system for further processing and use.The inventions in this aspect proceed by obtaining metadata associated with at least one data file from a metadata storage unit, generating a priority for the at least one data file according to the metadata, selecting a data file according to the priority, performing a review of the data file, determining an assessment of general vulnerabilities and threats to the data file, updating the metadata of the data file according to the review, and providing the assessment to a system user for evaluation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above and other objects, features, and advantages of the present disclosure will become more apparent by describing some embodiments of the present disclosure in more detail in the accompanying drawings, wherein the same reference numeral generally refers to the same components in the embodiments of the present disclosure. Fig. 1 is a schematic illustration of a system according to an embodiment of the invention. Fig. 2 illustrates a flowchart showing a processing sequence according to an embodiment of the invention. Fig. 3 shows a cloud computing environment according to an embodiment of the invention. Fig. 4 shows abstraction model layers according to an embodiment of the invention. DETAILED DESCRIPTION

[0019] Some embodiments will be described in more detail with reference to the accompanying drawings, which illustrate embodiments of the present disclosure. However, the present disclosure may be implemented in various ways and should therefore not be construed as limited to the embodiments disclosed herein.

[0020] In one embodiment, one or more components of the system may employ hardware and / or software to solve highly technical problems (e.g., prioritizing files based on metadata and reviewing prioritized files, etc.). These solutions are not abstract and cannot be performed as a series of human mental actions due to the processing capabilities required, for example, to enable code review and debugging. Furthermore, some of the processes performed may be performed by a specialized computer to perform certain tasks related to memory operations. For example, a specialized computer may be employed to perform tasks related to code review and debugging and the like.

[0021] Distributed big data processing systems pose particular system security challenges. These systems receive and distribute very large data files, measured in gigabytes and terabytes. The received data comes from a variety of sources, some more reliable than others, and some of which may not verify or ensure that the provided data is free of viruses, malware, and other embedded data issues. System users require uninterrupted access to system data in a distributed environment where stopping services or data access to verify or resolve data issues is not a practical option. System users can download blocks of data for further processing and use. Specifying the security profile of the data helps users determine which blocks are safe and can be added to a data processing system for use.Such systems can also receive duplicate files from a single source or from multiple sources. Processing duplicate records for security reasons wastes scarce system resources.

[0022] In one embodiment, the system comprises a data store for storing large (gigabyte and terabyte in size) files. The system also comprises a metadata storage unit that caches one or more metadata tables. The metadata storage unit can be local or cloud-based. The tables comprise metadata records for the large files cached in the data store. In this embodiment, the tables store metadata fields, including some or all of the following: data related to a file identifier, status of file processing—is the file available for downstream use, etc., time of file processing—a record of the last time the data was processed by the method, a CVE rating for the file, viruses detected in the file, detailed virus description data, information about the file format, and data related to downstream processing requirements for the file.Different file formats are more closely correlated with data-related issues. Files intended for downstream processing require more attention and immediate review than those intended for long-term storage.

[0023] The disclosed inventions are applicable to single or multiple application systems permanently installed on a single server or distributed across multiple cloud leases. The inventions are applicable to near-real-time data processing of data streams, as well as to batch and bulk data processing.

[0024] In some embodiments, the metadata also includes checksum data associated with the data files. For batch or bulk data files received externally, the method calculates a checksum, such as the hash value (SHA256), for the file. Even minor changes to the file result in a different checksum value, indicating that the file has been modified. The checksum is stored as metadata associated with the file. In some embodiments, the file may be provided with a checksum value. In these embodiments, the method compares the calculated checksum with the provided value to determine if changes have been made to the file. The checksum may use a checksum technique such as SHA256, MD5, or another method for calculating a checksum using the byte representation of the data file.

[0025] In one embodiment, the method calculates checksum values ​​for data streaming files as well as for externally received bulk files. For data streams, the method continuously calculates checksum values ​​in parallel with the data streams arriving in the system's data storage. The method stores the checksum values ​​calculated during streaming as metadata in a lookup table. After the data file has arrived in full, the final checksum value for the file is stored in association with the streaming file in the metadata storage unit. In one embodiment, the method divides the data file into parts such as blocks or segments of the file. In this embodiment, the method calculates a checksum for each part of the data file. When each part has been completely received, the checksum for each part of the data file is stored in the form of metadata associated with that part of the file.In one embodiment, the portions overlap to ensure that viruses are not split between adjacent blocks and missed. Segments can be padded so that each segment encompasses a portion of the previous segment; for example, each 100-megabyte segment can be padded to encompass the last 100 kilobytes of the previous segment. In one embodiment, 100-megabyte segments are padded by + / - 500 kilobytes to ensure that no gaps are created due to segmenting the data file when the segments are checked. In this embodiment, the segments would range from 0 to 1.5 MB, 1 to 2.5 MB, 2 to 3.5 MB, etc., reducing the likelihood that a piece of malicious code will escape detection by being split between two adjacent segments.

[0026] In one embodiment, the method compares the checksum values ​​with stored metadata values ​​associated with existing data files and segments. The comparison detects duplicates of the current batch or streaming file / segment. The method continuously compares calculated checksums as files are streamed into the data store to detect potentially similar or identical files. In this embodiment, the method uses the final checksum to confirm all potentially identical files as actually identical.

[0027] In one embodiment, in response to matching a checksum in the metadata, the method initiates a cleanup routine for the file or file segment based on the CVE rating and virus details of the matched file / segment. In this embodiment, the matched metadata is associated with a file containing known viruses. In this embodiment, the method cleans the file or segment and updates the metadata to indicate that the cleanup has occurred. Cleaning the files may include removing known malicious code pieces associated with a detected virus from the file or restoring the file using a backup copy of the file. The cleaned file is added to a list for prioritization.In this embodiment, the method calculates a new checksum for the cleaned file and adds the new checksum to the metadata.

[0028] In one embodiment, the method checks the metadata storage unit to determine whether new data storage batch files have been loaded or to determine whether new streaming data files are being loaded. In this embodiment, the method checks the metadata associated with all new files. The method then continuously monitors the metadata storage unit for indications of new data files. In one embodiment, the method and systems of the invention hibernate if no new files or virus definitions are detected.

[0029] In one embodiment, the method obtains the metadata for all recently loaded or current streaming files. The method creates a prioritized list of new data files using the metadata. The files are prioritized with respect to indicators of viruses or the likelihood that a file contains malware. The method correlates the metadata of all new files to create the prioritized list. The method considers checksum values ​​regarding previously scanned files with respect to previously found viruses. The method also considers the virus definition used in a previous scan of a file or duplicate and whether the virus definition is up to date. Scans performed with an outdated virus definition are given higher priority for rescanning.Data files that require downstream processing are assigned a higher priority than files that do not. Files with a checksum discrepancy compared to a provided checksum or a checksum from a previous scan are assigned a higher priority for rescan. In this embodiment, the method considers the metadata of the set of new and existing files for any changes to the virus definitions. The method ranks the set of data files and prioritizes the files from highest (most in need of scanning) to lowest (least in need of scanning).In this embodiment, the method scans new, unprocessed files—those without a matching file identifier or file checksum—ranks these files as high priority, and creates a new metadata list in the metadata storage unit for the files. The method also blocks user access to unprocessed files at least until a scan of the files is complete. In this embodiment, the method considers duplicate files that have the same file identifier and file checksum as an existing file to be low priority.

[0030] In one embodiment, the method selects a file from the generated prioritized list and scans the file for viruses, malware, and other data-related issues. In this embodiment, the method selects the data file according to its priority, starting with the highest priority. Each file on the list is scanned in turn according to descending priority. In this embodiment, the method selects the highest priority file on the list. Files are added to the list along with their priority so that a new high-priority file can be scanned before an older low-priority file.

[0031] In one embodiment, the method scans the files for viruses using the detailed, current virus definitions. In this embodiment, the method determines a CVE rating for each file, as well as a list of viruses found for each file. The time of the scan, the virus definition used, the viruses found, the number of viruses found, the file checksum, the file format, and downstream processing requirements associated with the file are all updated as metadata for the file in the metadata storage unit.

[0032] In one embodiment, files are divided into blocks or segments to enable faster scanning and optimize file storage. In this embodiment, the method determines and stores metadata for each segment as well as for the entire file. In this embodiment, the method includes related segment data as part of the metadata. Scanning one segment of a group of related segments triggers scanning of the adjacent related segments. In this embodiment, the scans of the related segments overlap, increasing the likelihood of finding viruses and malware. In this embodiment, the file can be divided, stored, and scanned as a series of logically related segments—Segment0, Segment1, Segment2, etc. In one embodiment, the method scans binary versions of files.In this embodiment, the method retains the files as binary files until the validation is complete and the file is suitable for downstream processing and user access as part of the available data store. In this embodiment, the method uses extract-transform-load or another operation of a data processing means to retrieve the data from the file for use as part of the data store.

[0033] In one embodiment, after scanning a file or file segment, the method evaluates the metadata. The method then makes the file available for downstream processing, transfers it to a virus / malware cleanup routine, or quarantines the file if no cleanup routines are available. In one embodiment, the method provides users with access to the CVE rating of each file. In this embodiment, the user determines an acceptable risk level associated with CVE ratings and sets a threshold for CVE ratings. Files with a CVE rating below the threshold are ingested into the user's computing system for use by data consumers. Files with ratings above the threshold are rejected. In one embodiment, the method uploads files with no viruses found or with acceptably low CVE ratings for downstream use.The procedure updates the metadata in the metadata storage unit for all scanned files.

[0034] Here is an example: A client application connects to a process platform using mutual authentication via Transport Layer Security (Transport Layer Security Mutual Authentication).

[0035] The client application begins uploading health data.

[0036] The client did not specify the size of the content, and the platform supports a maximum of several terabytes in size.

[0037] The platform streams the data into the data store and starts the checksum using SHA256.

[0038] The platform has not yet marked the data for download, and downstream consumers cannot yet use the new data.

[0039] The platform begins by calculating a checksum for the file's parts: {Part 1: 0 to 1M, Part 2: 1 to 2M, Part 3: 2 to 3M}.

[0040] The client application finishes uploading the file.

[0041] The platform updates the checksum - 01234567A in the metadata support column along with the calculated checksums for parts of files.

[0042] At the same time, the platform's virus scanning service checks the metadata column.

[0043] The metadata contains the following information for the uploaded file: FILE IDENTIFIER 1-2-1-1 PROCESSED N Checksum 01234567A PROCESSING TIME ZERO CVE assessment ZERO Virus and virus details ZERO Related segments (previous / next) ZERO

[0044] A process coordination facility checks whether the checksum already exists. If so, the invention prioritizes those that do not have relevant or similar checksums.

[0045] If the coordinator does not find any relevant checksums, it extracts the file based on time.

[0046] The coordination facility checks the file and returns the results - virus found, virus metadata and marks the file as processed, with virus content and CVE rating. FILE IDENTIFIER 1-2-1-1 PROCESSED N Checksum 01234567A PROCESSING TIME 2019-02-01 07:56:00AM UTC CVE assessment CVSS v2.0 Severity and Metrics: Base Score: 5.0 MEDIUM Vector: (AV:N / AC:L / Au:N / C:N / I:P / A:N) (V2 legend) Impact Subscore: 2.9 Actionability Subscore: 10.0 Virus assessment and content Eicar Related segments (previous / next) No

[0047] Fig.Figure 1 provides a schematic representation of exemplary network resources associated with carrying out the disclosed inventions. The inventions may be implemented in the processors of any of the disclosed elements that process a command stream. As shown in the figure, a networked client device 110 is wirelessly connected to a server subsystem 102. A client device 104 is wirelessly connected to the server subsystem 102 via a network 114. The client devices 104 and 110 include clients for virus scanning programs (not shown) along with sufficient computing resources (processor, memory, network data transmission hardware) to execute the program. As shown in Fig. 1, the server subsystem 102 includes a server computer 150. Fig.Figure 1 shows a block diagram of components of the server computer 150 in a networked computer system 1000 according to an embodiment of the present invention. It should be understood that Fig. 1 is merely an illustration of an implementation and does not imply any limitations on the environments in which various embodiments may be implemented. Many modifications may be made to the illustrated environment.

[0048] The server computer 150 may include one or more processors 154, a memory 158, persistent storage 170, a data transfer unit 152, one or more input / output (I / O) interfaces 156, and a data transfer fabric 140. The data transfer fabric 140 provides data transfer operations between a cache 162, the memory 158, the persistent storage 170, the data transfer unit 152, and the input / output (I / O) interface(s) 156. The data transfer fabric 140 may be implemented using any architecture designed to pass data and / or control information between processors (such as microprocessors, data transfer and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, the data transfer fabric 140 may be implemented using one or more buses.

[0049] Memory 158 and persistent storage 170 are computer-readable storage media. In this embodiment, memory 158 includes random access memory (RAM) 160. In general, memory 158 may include any suitable volatile or non-volatile computer-readable storage medium. Cache 162 is a fast memory that improves the performance of processor(s) 154 by caching recently accessed data and data near recently accessed data from memory 158.

[0050] Program instructions and data used to carry out embodiments of the present invention, e.g., virus checker 175, are stored in persistent storage 170 for execution and / or access by one or more of the respective processors 154 of server computer 150 via cache 162. In this embodiment, persistent storage 170 comprises a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent storage 170 may comprise a semiconductor storage device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0051] The media used by persistent storage 170 may also be removable. For example, a removable hard disk may be used for persistent storage 170. Other examples include optical and magnetic hard disks, memory sticks, and smart cards that are inserted into a media receptacle to be transferred to another computer-readable storage medium that is also part of persistent storage 170.

[0052] In these examples, the communications unit 152 provides the basis for data exchanges with other computing systems or devices, including resources of the client computing devices 104 and 110. In these examples, the communications unit 152 includes one or more network interface cards. The communications unit 152 may facilitate data exchanges using physical or wireless communications links. Software distribution programs and other programs and data used to implement the present invention may be downloaded to the persistent storage 170 of the server computer 150 via the communications unit 152.

[0053] The I / O interfaces 156 enable input and output of data to other devices that can be connected to the server computer 150. For example, one or more I / O interfaces 156 can connect to one or more external devices 190, such as a keyboard, a keypad, a touch-sensitive screen, a microphone, a digital camera, and / or another suitable input device. One or more external devices 190 can also include portable computer-readable storage media, for example, memory sticks, portable optical or magnetic hard drives, and memory cards. Software and data used to carry out embodiments of the present invention, for example,The virus checker 175 on the server computer 150 may be stored on such portable computer-readable storage media and loaded into the persistent memory 170 via the I / O interface(s) 156. The I / O interface(s) is / are also connected to a display 180.

[0054] The display 180 provides a mechanism for displaying data to a user and may, for example, be a computer monitor. The display 180 may also function as a touch-sensitive screen, for example, the display of a tablet computer.

[0055] Fig.2 provides a flowchart 200 illustrating example operations related to the application of the disclosure. After program startup, the method of program 175 checks at 210 for new batch or streaming files and / or new virus definitions. Batch files may already be present in data storage, and streaming files may arrive in data storage. New virus definitions may be communicated from network communication device 152 to an intrusion prevention system. At 220, the method checks for new file metadata in a metadata storage device of persistent storage 170, in a system storage area network, or other system storage. For new files with no stored metadata, the method of program 175 creates a new metadata set and begins collecting file metadata.The metadata is collected from both the file itself and the associated process activities. For new virus definitions, the process searches for files that have not yet been scanned with the new virus definitions.

[0056] At 230, the method of program 175 generates a prioritized list of all new files according to their need for virus scanning. The method determines the file priority using one or more calculated file checksum values ​​and a virus correlation indicator from the metadata of the new files. Higher priorities are assigned to files with a higher urgency for scanning (files that need to be accessed for downstream processing, files without historical metadata, files with checksum problems, etc.).

[0057] At 240, the method of program 175 selects the highest priority portion of the data file from the generated list for scanning. At 250, the method scans the file using the current virus definitions. At 260, the method updates the file's metadata, including the time and date of scanning, the virus definitions used, the number and details of viruses found, the new CVE rating for the file, any associated segment information, etc. At 270, the method marks the file as free of known viruses at the time of scanning. In this embodiment, the method provides the CVE rating to downstream data consumers, data users, and administrators. The recipients of the CVE rating determine whether the file is sufficiently clean to make it available to consumers.

[0058] The method forwards files containing viruses to file cleaning processes. In step 275, the method determines whether the file has been cleaned by the process. Uninfected files are forwarded to step 280. Virus-containing files that have not been cleaned are forwarded to step 290 and excluded from use by data consumers and from being made available for access by data consumers.

[0059] At 280, uninfected files are added to the data store so they are usable by data consumers. After step 280, the method returns to step 210 to check for new files / virus definitions. If no new files or definitions are found, the method proceeds to step 215 and determines whether all files on the generated priority list have been scanned with the current virus definitions. The method returns to step 240 and selects the next prioritized file if not all files have been scanned. If all files have been scanned, the method returns to step 210 and continues checking for new files and virus definitions.

[0060] While this disclosure includes a detailed description of cloud computing, it should be understood from the outset that implementations of the teachings herein are not limited to a cloud computing environment. Rather, embodiments of the present invention may be implemented in connection with any other type of computing environment now known or later developed.

[0061] Cloud computing is a service model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model can encompass at least five characteristics, at least three service models, and at least four deployment models.

[0062] The characteristics are as follows: On-demand self-service: A cloud customer can unilaterally and automatically access data processing resources such as server time and network storage as needed, without requiring human interaction with the service provider. Broad network access: Resources are available over a network and accessible through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: The provider's computing resources are pooled to serve multiple customers, using a multi-tenant model in which various physical and virtual resources are dynamically allocated and re-allocated according to demand. There is a degree of location independence in that the customer generally has no control over or knowledge of the exact location of the deployed resources, but can specify the location at a higher level of abstraction (e.g., region, state, or data center). Rapid elasticity: Resources can be provisioned quickly and adaptably, in some cases automatically, to provide rapid scale-out and released quickly, allowing rapid scale-in. From the customer's perspective, the resources available for provisioning often appear unlimited and can be acquired in any quantity at any time. Measured service: Cloud systems automatically control and optimize resource usage by applying a metering function at an abstraction level appropriate to the type of service (e.g., storage space, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and recorded, providing transparency for both the provider and the consumer of the service.

[0063] The service models are as follows: Software as a Service (SaaS): The functionality provided to the customer consists of the use of the provider's applications running in a cloud infrastructure. The applications can be accessed from various client devices through a thin client interface such as a web browser (e.g., web-based email). The customer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0064] Platform as a Service (PaaS): The functionality provided to the customer consists of the use of applications created or requested by the customer, generated using programming languages ​​and utilities supported by the provider, on the cloud infrastructure. The customer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly over configurations of the application hosting environment.

[0065] Infrastructure as a Service (IaaS): The functionality provided to the customer consists of the provision of computing, storage, networking, and other basic computing resources, allowing the customer to deploy and run any software, including operating systems and applications. The customer does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control over the selection of network components (e.g., host firewalls).

[0066] The deployment models are as follows: Private Cloud: The cloud infrastructure is operated solely for an organization. It can be managed by the organization itself or by a third party and can be located on its own premises or on third-party premises. Community cloud: The cloud infrastructure is shared by multiple organizations and supports a specific user community with common interests (e.g., objectives, security requirements, strategic and compliance considerations). It can be managed by the organizations or a third party and can be located on their own premises or on external premises. Public cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services. Combined cloud (hybrid cloud): The cloud infrastructure consists of two or more clouds (private, shared, or public) that remain independent entities but are interconnected by a standardized or proprietary technology that enables the portability of data and applications (e.g., cloud targeting for load balancing between clouds).

[0067] A cloud computing environment is service-oriented with a focus on state independence, loose coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure consisting of a network of interconnected nodes.

[0068] With reference to Fig.3, an illustrative cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as the personal digital assistant (PDA) or mobile phone 54A, the desktop computer 54B, the laptop computer 54C, and / or the automotive computer system 54N, can communicate. The nodes 10 can communicate with each other. They can be physically or virtually grouped into one or more networks, such as private, shared, public, or combined clouds (not shown), as described above, or a combination thereof. This enables the cloud computing environment 50 to offer infrastructure, platforms, and / or software as a service, for which a cloud user does not need to maintain resources on a local computing device.It should be noted that the types of in . Fig. 3 are intended to be merely illustrative and that the computing nodes 10 and the cloud computing environment 50 can communicate with any type of computer-based device via any type of network and / or via any type of network-accessible connection (e.g., using a web browser).

[0069] With reference to Fig. 4 shows a set of functional abstraction layers that are implemented by the cloud computing environment 50 ( Fig. 3) are provided. It should be clear from the outset that the Fig. The components, layers, and functions shown in Figure 4 are intended to be illustrative only, and embodiments of the invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0070] A hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframe computers 61; servers based on the RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and networks and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0071] A virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be deployed: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0072] In one example, a management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking when using resources within the cloud computing environment, as well as billing or invoicing for the use of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud customers and tasks, as well as protection for data and other resources. The user portal 83 provides access to the cloud computing environment for users and system administrators.Service level management (SLA) 84 provides the allocation and management of cloud computing resources so that service level requirements are met. Service level agreement planning and fulfillment (SLA) 85 provides the preparation and procurement of cloud computing resources for which future demand is anticipated according to an SLA.

[0073] A workloads layer 90 provides examples of functionality for which the cloud computing environment can be used. Examples of workloads and functions that can be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom 93 as an educational offering; data analytics processing 94; transaction processing 95; and a virus scanning program 175.

[0074] The present disclosure may be a system, method, and / or computer program product with any possible level of technical integration. The invention may be advantageously applied in any system, singly or in parallel, that processes a stream of instructions. The computer program product may comprise computer-readable storage medium(s) having computer-readable program instructions thereon for causing a processor to perform aspects of the present disclosure.

[0075] The computer-readable storage medium may be any physical device that can retain and store instructions for use by a device to execute instructions. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM).Flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, mechanically encoded device such as punched cards or raised structures in a groove on which instructions are stored, and any suitable combination thereof. A computer-readable storage medium, as used herein, shall not be construed as carrying transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., pulses of light traveling through an optical fiber cable), or electrical signals carried through a wire.

[0076] Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to respective computing / processing units or to an external computer or storage unit via a network such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routers, firewalls, switching units, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing unit.

[0077] Computer-readable program instructions for performing operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data, or either source code or object code written in any combination of one or more programming languages, including an object-oriented programming language such as Smalltalk, C++, or the like, as well as procedural programming languages ​​such as the "C" programming language or similar programming languages.The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, over the Internet using an Internet service provider).In some embodiments, electronic circuits, including, for example, programmable logic circuits, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuits to perform aspects of the present invention.

[0078] Aspects of the present invention are described herein with reference to flowchart and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart and / or block diagrams, as well as combinations of blocks in the flowchart and / or block diagrams, may be implemented by computer-readable program instructions.

[0079] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce a means for implementing the functions / steps defined in the flowchart and / or block diagram block(s).These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, a programmable data processing device, and / or other devices to function in a particular manner, such that the computer-readable storage medium having instructions stored thereon comprises an article of manufacture, including instructions that implement aspects of the function / step specified in the block(s) of the flowchart and / or block diagrams.

[0080] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-executing process such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / steps specified in the block(s) of flowchart and / or block diagrams.

[0081] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions comprising one or more executable instructions for performing the particular logical function(s). In some alternative implementations, the functions specified in the block may occur in a different order than shown in the figures. For example, two blocks shown consecutively may actually execute substantially concurrently, or the blocks may sometimes execute in reverse order depending on the corresponding functionality.It is further to be understood that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or by combinations of special purpose hardware and computer instructions.

Claims

[1] A method (200) implemented by a computer (150) for maintaining the security of a data processing system, the method (200) comprising: Receiving (220) metadata from a metadata storage device by one or more computer processors (154), wherein the metadata is associated with at least a portion of a file, and wherein the metadata includes one or more indicators of viruses; generating (230) a priority by the one or more computer processors for the at least a portion of the data file according to the metadata; performing a check (250) of the at least a portion of the data file by the one or more computer processors (154) according to the priority; updating (260) the metadata of the at least one portion of the data file according to the review by the one or more computer processors; and Providing (280) the data file for further processing by the one or more computer processors (154), where the metadata is assigned a checksum that is continuously determined in parallel with the flow of the data file into a data store. [2] The computer (150) implemented method (220) of claim 1, wherein the priority is generated according to a correlation of the metadata of the data file. [3] The computer (150) implemented method (200) of claim 1, further comprising passing the data file, by the one or more computer processors (154), to a cleanup routine. [4] A method (200) implemented by a computer (150) according to any one of the preceding claims, the method (200) further comprising: comparing a checksum for a portion of the data file with a checksum in the metadata storage unit by the one or more computer processors (154); and initiating a data cleansing routine by the one or more computer processors (154) in response to the matching. [5] A computer (150) implemented method (200) according to any one of the preceding claims, wherein the method (200) further comprises updating (260) by the one or more computer processors (154) checksum metadata associated with a portion of the data file. [6] A method (200) implemented by a computer (150) according to any one of the preceding claims, wherein receiving (220) the metadata comprises: Receiving (220) an updated virus definition by one or more computer processors (154); and Obtaining, by the one or more computer processors (154), the metadata associated with the at least a portion of the data file from a metadata storage device; wherein generating (230) a priority for the at least one data file comprises generating the priority according to the metadata and an updated virus definition; and wherein performing the check (250) comprises: selecting the at least part of the data file by the one or more computer processors according to the priority; and Performing a check of the data file by the one or more computer processors. [7] A method (200) implemented by a computer (150) according to any one of claims 1 to 5, wherein receiving the metadata comprises: Obtaining (220) metadata associated with the at least one data file from a metadata storage device by the one or more computer processors; and wherein generating (230) the priority comprises generating the priority for the at least a portion of the data file according to the metadata; and wherein performing the check (250) comprises: selecting the at least a portion of the data file by the one or more computer processors (154) according to the priority; performing a review (250) of the at least a portion of the data file by the one or more computer processors (154); determining an assessment of general vulnerabilities and threats to the data file by the one or more computer processors (154); and Transmitting the evaluation by the one or more computer processors (154) to a system user for evaluation. [8] A computer system (150) for maintaining the security of a system, the computer system (150) comprising: one or more computer processors (154); one or more computer-readable storage units (158, 170); and stored program instructions on the one or more computer-readable storage units (158, 170) for execution by the one or more computer processors (154), the stored program instructions comprising program instructions for: Receiving metadata associated with at least one data file from a metadata storage device; Generating (230) a priority for the at least one data file according to the metadata; and performing (250) a check of at least a portion of the data file according to the priority; Updating (260) the metadata of at least a portion of the data file; and Making the data file available (280) for further processing, where the metadata includes one or more indicators of viruses, and where the metadata is associated with a checksum that is continuously determined in parallel with the flow of the data file into a data store. [9] The computer system (150) of claim 8, wherein the priority is generated according to a correlation of the metadata of the at least a portion of the data file. [10] The computer system (150) of claim 8 or 9, further comprising program instructions for passing the data file to a cleanup routine. [11] A computer system (150) according to any one of claims 8 to 10, further comprising: Program instructions for comparing a checksum for a portion of the data file with a checksum in the metadata storage unit by the one or more computer processors (154); and Program instructions to initiate a data cleansing routine in response to the checksum being reconciled. [12] The computer system (150) of any of claims 8 to 11, further comprising program instructions to update checksum metadata associated with a portion of the data file. [13] A computer program product for maintaining the security of a system (1000), the computer program product comprising: a computer-readable storage medium (150) readable by a processing circuit and storing instructions for execution by the processing circuit to perform a method according to any one of claims 1 to 7. [14] A computer program stored on a computer-readable storage medium (150) and loadable into the internal memory of a digital computer, the computer program comprising software code portions for carrying out the method according to any one of claims 1 to 7 when the program is executed in a computer.

Images