Accelerating the execution of anti-virus programs in a virtual machine environment
AssigneeRed Hat Israel, Ltd.
InventorsItamar Heim, Shahar Frank
Life of this patent
Estimating the term…
Abstract
The execution of anti-virus programs can be accelerated in a virtual desktop environment. In one embodiment, a server hosts a plurality of virtual machines. Before performing a virus scan on a file, the server computes a signature value of the file, compares the signature value with the stored signature values in a central database, and performs virus scan on the file according to the result of the comparison. If the signature value exists in the central database, the virus scan on the file can be skipped.
Claims19
A method comprising:
- computing a signature value of a file managed by a guest operating system of a virtual machine, the virtual machine hosted by a server that supports a plurality of virtual machines having a plurality of guest operating systems;
- before computing the signature value, determining whether the file has been modified since a previous harmful code scan;
- determining, by the server, whether the signature value of the file managed by the guest operating system exists in a central database, wherein the central database includes signatures of files previously scanned by the plurality of guest operating systems;
- and
- refraining from performing a harmful code scan on the file in response to a determination that the signature value of the file managed by the guest operating system exists in the central database, or performing the harmful code scan on the file in response to a determination that the signature value does not exist in the central database.
A system comprising:
- a data storage to store a plurality of files, the files managed by a plurality of guest operating systems that operate on a plurality of virtual machines;
- a central database to store signature values;
- and
- a server comprising a processor coupled with a memory, the server coupled to the data storage and the central database to host the virtual machines, the server to compute a signature value of a file managed by the guest operating system and to be scanned for harmful code and before computing the signature value, determine whether the file has been modified since a previous harmful code scan, the server to perform harmful code scan on the file managed by the guest operating system according to a determination of whether the signature value exists in the central database, wherein the central database includes signatures of files previously scanned by the plurality of guest operating system, the server to refrain from performing the harmful code scan on the file in response to determination that the signature value of the file managed by the guest operating system exists in the central database, or perform the harmful code scan on the file in response to determination that the signature value does not exist in the central database.
A non-transitory computer readable storage medium including instructions that, when executed by a processing system, cause the processing system to perform operations comprising:
- computing a signature value of a file managed by a guest operating system of a virtual machine, the virtual machine hosted by a server that supports a plurality of virtual machines having a plurality of guest operating systems;
- before computing the signature value, determining whether the file has been modified since a previous harmful code scan;
- determining whether the signature value of the file managed by the guest operating system exists in a central database, wherein the central database includes signatures of files previously scanned by the plurality of guest operating systems;
- and
- refraining from performing a harmful code scan on the file in response to a determination that the signature value of the file managed by the guest operating system exists in the central database, or performing the harmful code scan on the file in response to a determination that the signature value does not exist in the central database.
Dependencies are inferred from the claim text.