Cleaning malware from backup data

Patent metadata

Field	Value
Publication number	US-9940460-B1
Application number	US-201514975445-A
Country	US
Kind code	B1
Filing date	Dec 18, 2015
Priority date	Dec 18, 2015
Publication date	Apr 10, 2018
Grant date	Apr 10, 2018

Abstract

Embodiments described herein perform cleanup of backup images of a storage system by applying a record of I/O operations recorded while performing anti-malware operations on the storage system. The recording of the I/O operations can be replayed to resolve malware infections in the backup images, snapshots, or replicas of the storage system without requiring a restore-cleanup cycle for each backup image.

First claim

What is claimed is:

1. A computer-implemented method for cleaning backup images, the method comprising:
receiving a request from a backup server connected via a network;
in response to the request, beginning, by a backup cleaning logic executed by a processor, an input/output (I/O) recording session for I/O operations performed to a data storage system;
sending, by the backup cleaning logic, a request to anti-malware logic to scan the data storage system to locate a data object containing malicious instructions or data associated with a malware infection;
recording the I/O operations performed by the anti-malware logic to resolve the malware infection, including logging write IO requests to write data to a storage device of the data storage system, wherein the I/O operations replace at least a first sequence in the data object with a second sequence;
ending the I/O recording session after recording the I/O operations performed by the anti-malware logic; and
applying the I/O operations of the I/O recording session to resolve a malware infection in a backup image, wherein applying the IO operations comprises
transmitting the I/O operations of the I/O recording session over the network to a remote storage server and applying the I/O operations of the I/O recording session to the backup image via the remote storage server,
storing the I/O operations of the I/O recording session to a journal of a continuous data protection system wherein the journal of the continuous data protection system duplicates write operations to the remote storage server to a remote copy of the data storage system,
transmitting the journal over the network to the remote storage server, and
applying the recorder I/O operations to the backup image to resolve the malware infection in the backup image.

2. The computer-implemented method of claim 1 , further comprising providing a user interface to edit the I/O recording session before applying the I/O operations of the I/O recording session.

3. The computer-implemented method of claim 1 , wherein the I/O recording session records I/O operations to write to the data storage system without recording I/O operations to read from the data storage system.

4. The computer-implemented method of further comprising creating a remote journal including the I/O operations of the I/O recording session and applying the recorded I/O operations from the remote journal to the backup image to resolve the malware infection in the backup image.

5. A non-transitory machine-readable medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving a request from a backup server connected via a network;
in response to the request, beginning an input/output (I/O) recording session for I/O operations performed to a data storage system;
sending a request to anti-malware logic to scan the data storage system to locate a data object containing malicious instructions or data associated with a malware infection;
recording the I/O operations performed by the anti-malware logic to resolve the malware infection, including logging write IO requests to write data to a storage device of the data storage system, wherein the I/O operations replace at least a first sequence in the data object with a second sequence;
ending the I/O recording session after recording the I/O operations performed by the anti-malware logic; and
applying the I/O operations of the I/O recording session to resolve a malware infection in a backup image, wherein applying the IO operations comprises transmitting the I/O operations of the I/O recording session over the network to a remote storage server and applying the I/O operations of the I/O recording session to the backup image via the remote storage server,
storing the I/O operations of the I/O recording session to a journal of a continuous data protection system wherein the journal of the continuous data protection system duplicates write operations to the remote storage server to a remote copy of the data storage system,
transmitting the journal over the network to the remote storage server, and
applying the recorder I/O operations to the backup image to resolve the malware infection in the backup image.

6. The non-transitory machine-readable medium of claim 5 , the operations further comprising providing a user interface to edit the I/O recording session before applying the I/O operations of the I/O recording session.

7. The non-transitory machine-readable medium of claim 5 , wherein the I/O recording session records I/O operations to write to the data storage system without recording I/O operations to read from the data storage system.

8. The non-transitory machine-readable medium of claim 5 , further comprising creating a remote journal including the IO operations of the I/O recording session and applying the recorded I/O operations from the remote journal to the backup image to resolve the malware infection in the backup image.

9. A system comprising:
one or more server devices coupled to a data storage system, the one or more server devices configured to:
receive a request from a backup server connected via a network;
in response to the request, begin an input/output (I/O) recording session for I/O operations performed to the data storage system;
send a request to anti-malware logic executing on the one or more server devices to scan the data storage system to locate a data object containing malicious instructions or data associated with a malware infection;
record the I/O operations performed by the anti-malware logic to resolve the malware infection, including logging write IO requests to write data to a storage device of the data storage system, wherein the I/O operations replace at least a first sequence in the data object with a second sequence;
end the I/O recording session after recording the I/O operations performed by the anti-malware logic; and
apply the I/O operations of the I/O recording session to resolve a malware infection in a backup image, including
transmit the I/O operations of the I/O recording session over the network to a remote storage server and apply the I/O operations of the I/O recording session to the backup image via the remote storage server,
store the I/O operations of the I/O recording session to a journal of a continuous data protection system wherein the journal of the continuous data protection system duplicates write operations to the remote storage server to a remote copy of the data storage system,
transmit the journal over the network to the remote storage server, and
apply the recorded I/O operations to the backup image to resolve the malware infection in the backup image.

10. The system of claim 9 , wherein the one or more server devices are further configured to provide a user interface to edit the I/O recording session before applying the I/O operations of the I/O recording session.

11. The system of claim 9 , wherein the I/O recording session records I/O operations to write to the data storage system without recording I/O operations to read from the data storage system.

12. The system of claim 9 , wherein one or more server devices are further configured to create a remote journal including the I/O operations of the I/O recording session and apply the recorded I/O operations from the remote journal to the backup image to resolve the malware infection in the backup image.

Assignees

• Emc Corp
• Emc Ip Holding Co Llc

Inventors

• Derbeko Philip
• Natanzon Assaf
• Harel Yaniv
• Ram Harel
• Saad Yossef

Classifications

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• G06F11/1458

  Management of the backup or restore process · CPC title