Sparse File Antivirus Scanning for Virtual Disk Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus solutions in computing environments, particularly in virtual and physical data centers, face challenges such as high resource usage, duplication, and performance overhead due to snapshot-based scanning techniques, which introduce attack vectors, RBAC complexity, and require additional storage and metadata management.
Innovation Solution
A centralized scanning mechanism using sparse files to map virtual disks of VMs as local storage, allowing for efficient static and dynamic scanning without touching guest VMs, reducing storage usage and performance overhead by performing scans directly on actual virtual disks rather than snapshots.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If snapshot-based scanning techniques are used, then antivirus scanning can be performed on virtual machines, but resource usage increases and performance overhead occurs
Solution Approach 1:
The patent creates a copy of the virtual disk content into a sparse file that can be scanned by the antivirus software. Instead of scanning the actual virtual disk or creating full snapshots, the system creates a lightweight copy that represents the disk content for scanning purposes only, reducing resource overhead while maintaining scanning capability.
Solution Approach 2:
The patent applies different scanning approaches to different parts of the system. The antivirus software scans the sparse file copy locally on the scanning system rather than requiring the guest VM to run antivirus operations, allowing each component to operate in its optimal environment without unnecessary resource consumption.
2Reliability
If snapshot-based scanning techniques are used, then antivirus scanning can be performed, but device complexity increases due to RBAC and metadata management
Solution Approach 1:
The patent extracts the scanning operation from the guest virtual machine environment and performs it externally on a sparse file copy. This removes the complexity of RBAC management, metadata synchronization, and snapshot coordination from the guest VM, concentrating the scanning function in a dedicated external scanner that handles these complexities independently.
Solution Approach 2:
The patent segments the antivirus scanning function into separate components: the guest VM continues normal operations while an external scanner processes a sparse file copy. This segmentation isolates the complexity of scanning operations from the guest VM, allowing each to operate independently without the other's complexity overhead.
3Reliability
If snapshot-based scanning techniques are used, then antivirus scanning can be performed, but storage space consumption increases
Solution Approach 1:
The patent uses sparse files which are essentially porous storage structures that allocate space on-demand rather than pre-allocating full storage capacity. The sparse file only consumes storage space for the actual data blocks that need to be scanned, leaving gaps for unused portions of the virtual disk, thereby significantly reducing storage space consumption compared to full snapshots.
4Reliability
If traditional antivirus software is installed on each endpoint, then security coverage is comprehensive, but resource usage adds up significantly in data centers
Solution Approach 1:
The patent merges multiple antivirus scanning operations into a single centralized scanning system. Instead of each virtual machine running its own antivirus software and consuming resources independently, the system consolidates scanning operations into one external scanner that processes sparse file copies from multiple VMs, achieving comprehensive security coverage while significantly reducing total resource usage through shared scanning infrastructure.
Data Source
AI summary
System and method for executing scan operations on computing systems use a sparse file that represents a storage device of a computing system to scan a file stored in the storage device. The sparse file is created and mounted to a scanner appliance such that the sparse file appears to a scan engine of the scanner appliance as a local storage device. When a read request for the file stored in the storage device is issued from the scan engine that results in an implicit read request to the sparse file, the implicit read request is trapped. While the implicit read request is trapped, data of the file is retrieved from the storage device of the computing system to the scanner appliance using a communication transport. The retrieved data of the file is then scanned using the scan engine at the scanner appliance.