Shared Store for Malware Scan Result Caching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized environments, redundant malware scans on shared files across multiple virtual machines or physical devices lead to wastage of computing resources, potentially causing performance issues and system failures due to identical files being scanned multiple times.
Innovation Solution
A method and system that identify unique identifiers for files, query a shared store to determine if another system has already performed the scan, and retrieve results instead of repeating the scan, thereby reducing redundant operations and conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware scans are performed on all files in each virtual machine, then security coverage is improved, but computing resource consumption increases and system performance deteriorates
Solution Approach 1:
The patent merges the malware scanning operations across multiple virtual machines by introducing a shared store that consolidates scan results. When one VM performs a scan on a file, the result is stored and subsequently retrieved by other VMs that need to scan the same file, thereby combining redundant operations into a single execution while maintaining comprehensive security coverage across all VMs.
Solution Approach 2:
The patent uses file hash values as copies of file identity to enable result sharing. Instead of sharing the actual file content or scan engine state, the system copies only the essential identifier (hash) and scan result metadata to the shared store, allowing efficient comparison and result retrieval without duplicating the expensive scanning operation itself.
2Reliability
If identical files are scanned multiple times across related computing systems, then each system ensures its own security independently, but computing resources are wasted and host machine resources are swamped
Solution Approach 1:
The patent implements preliminary action by having computing systems check the shared store for existing scan results before performing new scans. The system proactively queries whether a file has already been scanned by retrieving its hash from the shared store, and if a valid scan result exists, it retrieves that result instead of performing a redundant scan, thereby eliminating wasted computing resources while maintaining security verification.
Solution Approach 2:
The patent establishes a feedback mechanism where scan results are published to a shared store and subsequently used by other systems to make decisions about whether to perform scans. The feedback loop consists of: (1) performing a scan and storing the result with file hash, (2) other systems querying the shared store using file hash, and (3) retrieving existing results to avoid redundant operations, thereby creating a self-regulating system that reduces resource waste based on previous actions.
3Productivity
If a shared store is implemented to cache scan results, then redundant operations are reduced and resources are conserved, but system complexity increases
Solution Approach 1:
The patent introduces a shared store as an intermediary component between virtual machines and the malware scanning infrastructure. This intermediary layer handles the complexity of result caching, hash-based lookup, and result retrieval, allowing individual VMs to maintain simple scanning logic while benefiting from the centralized optimization. The shared store acts as a mediator that absorbs the architectural complexity away from the VMs themselves.
4Loss of energy
If scan results are shared among virtual machines, then computing resources are conserved, but the overhead of managing shared storage and result retrieval may offset savings
Solution Approach 1:
The patent uses hash values as lightweight copies of file identity to enable efficient result sharing. The hash computation is performed once per file and stored in the shared store, allowing subsequent VMs to quickly compare file hashes and retrieve results without transferring or processing large amounts of data. This copying approach minimizes the time overhead while maximizing resource savings.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented for sharing the results of computing operations among related computing systems may include: 1) identifying a need to perform a computing operation on a file, 2) identifying a unique identifier associated with the file, 3) determining, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file, and then 4) retrieving the results of the computing operation from the shared store instead of performing the computing operation. Various other methods, systems, and computer-readable media are also disclosed.