The embodiment of the invention shall be described hereinbelow while referring to the appropriate drawings.
A1. System Configuration:
The client computers CL1-CL3 and the virus scan servers 50-52 are connected to the NAS device 10 via a network NW1. The client computers CL4 and CL5 and the virus scan server 53 are connected to the NAS device 10 via a network NW2. The networks NW1, NW2 are IP networks that transfer information using the TCP/IP protocol.
The storage device 20 is a large-capacity memory device comprising multiple hard disks in a RAID configuration, and is connected to the NAS device 10 via a network SAN. The use of the RAID configuration affords improved fault tolerance and access speeds. The network SAN transfers information using a SCSI protocol. In the embodiment, the network SAN utilizes Fibre Channel, which is capable of gigabit-order data transfer, as the SCSI protocol, and is set up using optical fiber cable. In the storage device 20, the physical memory areas of the hard disks are partitioned into a plurality of logical volumes (hereinafter termed logical volumes). The storage device 20 manages with a hierarchical structure the store locations of files stored on the hard disks, and associates the logical volumes with the physical memory areas of the hard disks. The storage device 20 provides the NAS device 10 with logical volumes of hierarchical structure.
The NAS device 10 is a computer having a CPU, ROM, and RAM, and has the function of mediating file transfer between the client computers and the storage device. The NAS device 10 manages the file store locations using the logical volumes provided by the storage device. The NAS device 10 in turn provides the client computers with the logical volumes provided to it by the storage device. By storing a file in a logical volume provided by the NAS device 10, a user operating a client computer is able to store the file on the storage device 20. The specifics of the configuration of the NAS device 10 shall be described later.
In the embodiment, the NAS device 10, upon detecting a virus infection of a file sent from a client computer, shuts down operation of any logical volume where the virus-infected file could possibly be stored. By so doing, even if one of the multiple logical volumes should become virus-infected, since usage of only virus-infected logical volumes are able to be shut down, the spread of secondary damage to other logical volumes by virus infection is preventable while minimizing the operational loss in the computer system. The specifics of the configuration and processes of the computer system 1000 shall be described below.
A2. Function Blocks:
The function blocks of the NAS device 10 and the storage device 20 shall be discussed with reference to
The storage device 20 shall be discussed. As shown in
The data storage unit 230 is has three hard disks 231, 232, 233. The data storage unit 230 stores files that have been sent via the NAS device 10 from the client computers CL1-C5 connected to the networks NW1, NW2.
The network interface 240 is a Fibre Channel adaptor used for physical connection to the network SAN. A driver, not shown, for operating the network interface 240 is pre-installed in the memory 210.
The memory 210 is has a control module 211. The control module 211 implements management of the logical volumes, specifically, association of the logical volumes with the data storage unit 230 which constitutes the physical memory area. The control module 211 also controls in relation to communication with the NAS device 10, configuration of the RAID, and backup/restore of data stored in the data storage unit 230.
The NAS device 10 comprises a control memory 100, a nonvolatile memory 110, a CPU 130, and network interfaces 141, 142, 150. The control memory 100 in turn comprises user OS 101-103, a management OS 104, a kernel 105, virtual network interfaces 106-108, and a network controller 109. The nonvolatile memory 110 comprises a user OS intercommunication state management table 111, an operation state management table 112, linked virus scan server management tables 113-115, file management module management tables 116-118, a shared memory area 119, and a shared memory area 120.
The network interface 141 is an adapter used for physical connection to the network NW1. Similarly, the network interface 142 is an adapter used for physical connection to the network NW2.
The network interface 150 is a Fibre Channel adaptor used for physical connection to the network SAN.
Drivers, not shown, for operating the network interfaces 141, 142, 150 are pre-installed in the control memory 100.
The virtual network interfaces 106-108 are modules that function as virtual network adaptors. Normally, a number of IP addresses equal to the number of physical network adapters are set up for a computer; with the virtual network interfaces, IP addresses are able to be set up in numbers equal to the number of virtual network interfaces.
The network controller 109 associates the virtual network interfaces with the user OS, and transfers input data to the associated user OS, via the network interfaces 141, 142, from the client computers connected to the networks NW1, NW2, to the virtual network interfaces 106-108. In the embodiment, the network controller 109 associates the virtual network interface 106 with the user OS 101, the virtual network interface 107 with the user OS 102, and the virtual network interface 108 with the user OS 103.
The user OS 101-103 manages in relation to storage of files sent from the client computers in the storage device 20. The specific modules of the user OS 101-103 shall be described with reference to
The file management module 301a shall be described with reference to
The file management module 301b, 301c have the same arrangement as above, and manage files using the directory groups assigned respectively to directory groups. The user OS 102 and the user OS 103 have the same module arrangement as the user OS 101, and both the user OS 102 and the user OS 103 manage files with three file management modules. Any number of file management modules are establishable in a user OS. In the embodiment, the names of the file management modules 301a-301c shall be denoted as “FS1”-“FS3.” The names of the three file management modules controlled by the user OS 102 shall be denoted as “FS4”-“FS6,” and the names of the three file management modules controlled by the user OS 103 shall be denoted as “FS7”-“FS9.”
The virus scan control module 302, upon receipt of a file save request, queries the virus scan server on the network NW1 associated with the user OS 101 whether the file to be saved is virus-infected, and when a virus is detected, instructs the virus infiltration notification control module 303 to notify of the virus infiltration to the management OS.
The virus infiltration notification control module 303 receives the notification instruction from the virus scan control module 302 and implements notification of the virus infiltration to the management OS 104.
The specific modules of the management OS 104 shall be described with reference to
The operation state acquisition module 311 periodically acquires, via the kernel 105, operation state information that represents the operation state of the entire user OS, and saves the acquired operation state information to the operation state management table 112.
The virus infiltration notification receipt control module 312, upon receipt of a virus infiltration notification from the virus scan control module 302 of a user OS, instructs the state analysis control module 313 to initiate state analysis.
The state analysis control module 313, in response to the instruction from the virus infiltration notification receipt control module 312, acquires and analyzes the operation state of the user OS from the operation state management table 112, and instructs the kernel 105 to shut down operation of the file management modules of directory groups that could possibly become infected with the virus.
The modules of the kernel 105 shall be described with reference to
The OS intercommunication control module 321 controls communication between the management OS 104 and the each of the user OS 101-103, and among the OS 101-103.
The forced shutdown control module 322, in response to an instruction from the state analysis control module 313 of the management OS 104, shuts down operation of the file management modules of directory groups that could possibly become infected with a virus.
The tables of the nonvolatile memory 110 shall be described next. The user OS intercommunication state management table 111 stores the communication states among the user OS, specifically, the states of TCP/IP protocol network connections and of network communication using the file sharing protocols NFS (Network File System) and CIFS (Common Internet File System).
The operation state management table 112 stores, for each file management module, the user OS that uses the file management module, IP addresses of the clients permitted to access the directory group of the file management module, and the user IDs permitted to access the directory group of the file management module.
The linked virus scan server management table 113 stores the server name of the virus scan server associated with the user OS 101. The linked virus scan server management table 114 stores the server name of the virus scan server associated with the user OS 102. The linked virus scan server management table 115 stores the server name of the virus scan server associated with the user OS 105.
The file management module management table 116 stores the operation state of the file management module of the user OS 101. The file management module management table 117 stores the operation state of the file management module of the user OS 102. The file management module management table 118 stores the operation state of the file management module of the user OS 103.
The shared areas 119 and 120 are memory areas used when detection of virus infection of files stored in any of the directory groups. They will be described in detail later.
A3. File Management Module Shutdown Process:
The file management module shutdown process shall be described in detail using
A3-1. Overall Process Flow:
When a file sent from a client computer is saved to the directory group of the file management module used by the user OS 101, the virus scan control module 302 sends to the virus scan server associated with the user OS 101 an instruction to implement a virus detection process (in the embodiment, hereinafter the virus detection process shall be termed a virus scan) on the saved file (hereinafter termed the target file) (Step S10). Specifically, the virus scan control module 302 of the user OS 101 looks up in the linked virus scan server management table 113 associated with the user OS 101, and acquires information that represents the virus scan server to which the virus scan instruction is targeted. As shown in
The virus scan control module 302 receives the result of the virus scan from the virus scan server 50 (Step S11), and when a virus infection is detected in the target file, instructs the virus infiltration notification control module 303 to issue a virus infiltration notification to the management OS (Step S12). virus infiltration notification includes the name of the user OS that received the target file, the file sharing protocol used to send the target file, the IP address of the client computer that was the source of the virus infection, and the user ID of the user who sent the target file.
The virus infiltration notification control module 303 receives the virus infiltration notification instruction from the virus scan control module 302, and writes to the shared memory area 119 the name of the user OS that was infected by the virus, the file sharing protocol used to send the target file, the IP address of the client computer that was the source of the virus infection, and the user ID of the user who sent the target file, which have been included in the virus infiltration notification (Step S13).
As shown in
The virus infiltration notification control module 303 receives the virus infiltration notification instruction from the virus scan control module 302, and then sends a command ID “1” to the OS intercommunication control module 321 of the kernel 105 (Step S14)
Instructions from the user OS 101-103 and the management OS 104 to the kernel 105 are implemented by sending a command ID. The command ID shall be described with reference to
When the OS intercommunication control module 321 of the kernel 105 receives the command ID “1,” the OS intercommunication control module 321 implements the requested process associated with command ID “1,” namely, sending a notification of virus infiltration to the virus infiltration notification receipt control module 312 of the management OS 104 (Step S15).
Once the virus infiltration notification receipt control module 312 of the management OS 104 receives the notification of virus infiltration from the OS intercommunication control module 321 of the kernel 105, the virus infiltration notification receipt control module 312 instructs the state analysis control module 313 to analyze the operation state of the file management module (Step S16).
The state analysis control module 313 then analyzes the user OS intercommunication state management table 111 and the operation state management table 112, and extracts therefrom the file management module that uses the directory group in which the target file could possibly be stored (Step S17). In the embodiment, the process of Step S17 is termed the state analysis process. The state analysis process shall be described in detail later.
The state analysis control module 313 then sends a command ID “2” to the OS intercommunication control module 321 of the kernel 105.
Once the OS intercommunication control module 321 receives the command ID “2,” the OS intercommunication control module 321 sends to the forced shutdown control module 322 an instruction to shut down the file management module on the basis of the command ID table 600 (Step S19).
The forced shutdown control module 322 receives the instruction of shut down the file management module, and forcibly shutdowns operation of the file management module 321 that manages the directory group which could possibly be infected with the virus by the target file (Step S20). In the embodiment, the process of Step S20 is termed the forced shutdown process. The forced shutdown process shall be discussed in detail later.
A3-2. State Analysis Process:
The state analysis process of Step S17 shall now be described in detail with reference to
The state analysis control module 313, referring to the user OS intercommunication state management table 111 and the shared memory area 119, analyzes network connection states among the user OS (Step S100). The OS intercommunication state management table 111 indicates the state of communication using ICMP (Internet Control Message Protocol), NFS, and CIFS among the user OS. ICMP is a protocol for transferring IP error messages or control messages, and represents the protocol used among TCP/IP-networked computers and network devices, to allow these devices to check each other's status. The network diagnostic program Ping uses ICMP.
In the user OS intercommunication state management table 111, a communication enabled state is represented by “1” and a communication disabled state is represented by “0.” For example, as shown in
As shown in
Next, the state analysis control module 313, making reference to the operation state management table 112 and the shared memory area 119, analyzes on the basis of the IP address the state of access to directory groups by the client computer, and on the basis of the user ID the state of access to directory groups by the user; and from the directory groups used by the virus-infected user OS 101 and the user OS 102 determined in Step S100 to possibly become infected by the virus, extracts those file management modules using directory groups that could possibly become virus infected (Step S102, Step S104).
Before proceeding to a detailed discussion of Steps S102 and 104, the operation state management table 112 shall be discussed referring to
The process of Steps S102 and 104 shall now be described specifically. The state analysis control module 313, referring to the user OS in the operation state management table 112, extracts the rows for the file management modules that are controlled by the currently virus-infected user OS 101, and the user OS 102 having network connectivity with the user OS 101 extracted previously in Step S100 (
The state analysis control module 313 then decides that these extracted file management modules are the file management module whose operation should be shut down (Step S106), and saves a list of the file management module whose operation should be shut down in the shared memory area 120.
The contents of the shared memory area 120 shall be described with reference to
A3-3. Forced Shutdown Process:
The forced shutdown process for forced shutdown of the file management modules targeted to be shut down determined in the above manner (Step S20 of
The forced shutdown control module 322 refers to the shared memory area 120 and loads the list of file management modules to be shut down (Step S200).
Of the file management modules contained in the file management module management tables 116-118, the forced shutdown control module 322 forces a change of operating status of all file management modules that are included in the loaded list (Step S202)
The file management module management tables 116-118 shall be described with reference to
According to the computer system 1000 of the embodiment discussed hereinabove, in an NAS device 10 that manages files using directory groups, when a virus infection is detected in a directory group used by one file management module, only the file management module that uses the virus-infected directory group and file management modules using other directory groups that could possibly become infected are forcibly shut down, whereby secondary damage caused by virus infection is preventable without shutting down the NAS device 10 itself. Consequently, stability is improvable in association with preventing virus infection of the numerous files stored in the storage device 20, and operational loss on the part of the computer system 1000 is able to be minimized.
According to the computer system of the embodiment, the NAS device 10 periodically acquires and manages states of the user OS, for example, operating status, permissions to access directory groups used by file management modules, and OS intercommunication states, and therefore when a virus is detected, a process to shut down the file management modules is implementable immediately, and spread of damage by the virus is able to be suppressed early on.
Moreover, according to the computer system of the embodiment, virus scanning is referred to separately constituted virus scan servers, so the processing load on the NAS device can be reduced.
(1) Whereas in the preceding embodiment, virus scanning is referred to virus scan servers connected to the networks NW1, NW2, but instead the NAS device 10 could be provided with a virus scan function, for example. By so doing, virus scanning is implementable without issuing instructions to a virus scan server, so processing time is able to be reduced.
(2) In the embodiment, file management modules to be shut down are determined in a detailed manner based on client computer access permissions and user access permissions, but it would be possible to instead shut down all file management modules controlled by user OS that have network connectivity with the user OS actually infected by the virus, for example. By so doing, user OS not having network connectivity with the user OS that has been actually infected by a virus is able to be kept operational without being shut down, so damage by a virus is able to be prevented early on. Damage by a virus is also able to be prevented early on without refining the determination of management modules to be shut down by user access permissions, by instead shutting down all file management modules extracted during refinement by client computer IP address.
(3) In the embodiment, the operation state acquisition module 311 of the NAS device periodically acquires the operation state of the file management modules, but could instead acquire the operation state when a virus is detected, for example. By so doing it is possible to acquire the most recent operation state when the virus is detected, so that the file management modules to be shut down are able to be determined with greater accuracy.
Although the present invention has been described and illustrated in detail, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, the spirit and scope of the present invention being limited only by the terms of the appended claims.
The Japanese patent applications as the basis of the priority claim of this application are incorporated in the disclosure here of by reference:
(1) Japanese Patent Application No. 2006-272595 (filing data: Oct. 04, 2006).
Number | Date | Country | Kind |
---|---|---|---|
2006-272595 | Oct 2006 | JP | national |