Browse Prior Art Database

Virus Sensing Hard Drive Technology

IP.com Disclosure Number: IPCOM000032240D
Publication Date: 2004-Oct-26
Document File: 2 page(s) / 36K

Publishing Venue

The IP.com Prior Art Database

Abstract

Disclosed is a method that uses a hard drive with a limited processing core to do virus scans while the drive is operating normally. Benefits include increasing protection from viruses without increasing the overhead of active scans on the host system CPU.

This text was extracted from a Microsoft Word document.
At least one non-text object (such as an image or picture) has been suppressed.
This is the abbreviated version, containing approximately 62% of the total text.

Virus Sensing Hard Drive Technology

Disclosed is a method that uses a hard drive with a limited processing core to do virus scans while the drive is operating normally. Benefits include increasing protection from viruses without increasing the overhead of active scans on the host system CPU.

Background

Currently, virus scanners are susceptible to viruses. Being software themselves, virus scanners can be disabled or circumvented by advanced virus technologies (see Figure 1). To help secure the system, virus scanning must not rely completely on pure software.

General Description

Virus scanning involves a large amount of file activity, so the logical place to use a virus scanner is on the hard drive itself. The disclosed method uses a hard drive with a limited processing core to do virus scans while the drive is operating normally (see Figure 2). During file writes, the file is dumped into the hard drive cache, where it is scanned for virus contamination then flushed to the physical media. This is called a “passive” scan. During slow activity times, the processor accesses files already on the media, and performs an “active” scan of the files to make sure that a new virus is not on the media (due to a virus definition being out-of-date during the passive scan). On the read side, the normal flow is not impacted. Since there is a chance that the files being actively scanned could be requested, the data comes from the cache instead of the media, providing a small increase i...