Storage System Virtual Volume Grouping for Virus Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, the risk of virus spread and inefficient virus scanning across multiple virtual machines (VMs) increases due to shared resources, particularly in large-scale VDI environments, where existing solutions do not adequately address the time required for virus scanning and the risk of infection spread.
Innovation Solution
A storage system that replicates master virtual volumes to multiple VMs, groups them based on duplication rates, and collectively unmounts infected volumes to prevent infection spread, allowing for efficient virus scanning by prioritizing volumes with high infection risk.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virus scanning is performed on each VM side individually, then comprehensive virus detection is achieved, but the operational cost and time consumption increase significantly
Solution Approach 1:
The patent merges the virus scanning function from individual VMs to the storage system level. The storage system performs centralized virus scanning on virtual volumes, replacing distributed VM-based scanning. This consolidation maintains comprehensive detection capability while significantly improving scanning efficiency and reducing operational costs by eliminating redundant scanning operations across multiple VMs.
2Reliability
If virus scanning is performed on a large number of virtual volumes, then thorough security checking is achieved, but the time required for scanning increases
Solution Approach 1:
The patent segments virtual volumes into scan groups based on duplication rates. Volumes with high duplication rates are grouped together and scanned more frequently, while volumes with low duplication rates are scanned less frequently. This segmentation strategy maintains thorough security checking for high-risk volumes while reducing overall scanning time by avoiding redundant scans of low-risk volumes.
Solution Approach 2:
The patent changes the scanning parameter (scanning frequency) based on the duplication rate parameter of virtual volumes. Volumes with duplication rates above a threshold are scanned more frequently, while those below the threshold are scanned less frequently. This dynamic parameter adjustment maintains security thoroughness for high-risk volumes while reducing total scanning time.
3Reliability
If one virtual volume is infected with virus, then virus detection is achieved, but the risk of spread to other VMs increases during scanning time
Solution Approach 1:
The patent implements preliminary action by collectively unmounting virtual volumes that belong to the same scan group when one volume is detected as infected. This prevents potential spread of infection to other volumes in the group before they can be scanned or accessed. The unmounting action is taken immediately upon detection, before complete scanning or analysis can occur, thereby preventing harmful spread.
4Productivity
If replication function is used to prepare large amount of VDIs at high speed, then deployment efficiency is improved, but the time required for virus scanning becomes significant
Solution Approach 1:
The patent performs preliminary virus scanning on virtual volumes at the storage system level before they are deployed to VMs. By scanning volumes in advance during the replication and deployment process, the system ensures that newly deployed VDIs are already verified as virus-free, eliminating the need for separate post-deployment scanning and reducing overall scanning time.
Solution Approach 2:
The patent merges the virus scanning operation with the VDI replication and deployment process. Instead of performing scanning as a separate step after deployment, the scanning function is integrated into the replication workflow, allowing volumes to be scanned while being replicated and prepared for deployment, thereby maintaining high deployment efficiency while reducing scanning time overhead.
Data Source
AI summary
Provided is a storage system in which a plurality of virtual volumes obtained by replicating a master virtual volume are provided to each of a plurality of virtual machines of a physical server, respectively, the storage system including: a snapshot management unit that configures a continuous scan generation from the plurality of virtual volumes; a selection processing unit that groups into at least one scan group on the basis of a duplication rate of the plurality of virtual volumes included in the continuous scan generation; and a path setting unit that collectively unmounts the plurality of virtual volumes belonging to the scan group from the physical server in a case where a replica of the virtual volume selected by the selection processing unit is attached to a virus scanning server and one of the plurality of virtual volumes belonging to the scan group is infected with virus.