Antivirus scanning architecture for uploaded files

Inventors: Darwin Ttito Concha (Walldorf, DE); Mark Waldaukat (Walldorf, DE); Rodrigo Augusto Scheller Boos (Blumenau, BR); Edison Kleiber Ttito Concha (Walldorf, DE)

Assignee: SAP SE

G06F21/565 G06F21/53 G06F21/54 G06F21/554 H04L67/06 H04L67/1097 G06F21/55

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12688289
App. No.: 18/464,480
Granted: Jul 21, 2026
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Provided is a system and method which perform an antivirus scan of incoming files via a file management application of a file system. Infected files can be prevented from being stored to the file system. In one example, the method may include receiving, via a first application contained in a first data container, a data file that is uploaded for storage to a file system, storing the data file in a temporary storage, transmitting a location of the data file in the temporary storage to a second application contained in a second data container, and receiving, via the first application contained in the first data container, a response from the second application contained in the second container, indicating results of a security scan performed on the data file.

Claims (37)

1 . A computing system comprising:

a non-transitory computer-readable medium comprising computer-executable instructions;

a processor configured to access the computer-executable instructions and to:

execute a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);

execute a second containerized application within the pod of the host platform in parallel with the first containerized application, wherein the second containerized application is distinct from the first containerized application;

establish a direct communication channel between a transmission control protocol (TCP) socket of a container of the first containerized application and a TCP socket of a container of the second containerized application within the pod; and

exchange data between the first and second containerized applications via the established socket-to-socket communication channel directly between the first and second containerized applications during execution of the first and second containerized applications;

wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and

wherein the processor is further configured to read a file from a storage location within the PV via the second containerized application, scan the file, and determine a status for the file based on the scan.

2 . The computing system of claim 1 , wherein the processor is further configured to open the TCP socket on the container of the first containerized application within the pod and open the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.

3 . The computing system of claim 1 , wherein the processor is configured to establish the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.

4 . The computing system of claim 1 , wherein the processor is further configured to establish the communication channel based on a port number of the TCP socket of the container of the first containerized application and a port number of the TCP socket of the container of the second containerized application.

5 . The computing system of claim 1 , wherein the processor is further configured to provision the PV within the pod, wherein the PV comprises a file store.

6 . The computing system of claim 5 , wherein the processor is further configured to transfer a file from the first containerized application to a storage location within the PV, and transmit an identifier of the storage location of the file within the PV to the second containerized application via the established communication channel.

7 . The computing system of claim 1 , wherein the processor is configured to generate a log of the data that is exchanged between the first and second containerized applications and store the log within the pod.

8 . A method comprising:

executing a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);

executing a second containerized application within the pod of the host platform in parallel with the first containerized application, wherein the second containerized application is distinct from the first containerized application;

establishing a direct communication channel between a transmission control protocol (TCP) socket of a container of the first containerized application and a TCP socket of a container of the second containerized application within the pod; and

exchanging data between the first and second containerized applications via the established socket-to-socket communication channel directly between the first and second containerized applications during execution of the first and second containerized applications;

wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and

9 . The method of claim 8 , wherein the method further comprises opening the TCP socket on the container of the first containerized application within the pod and opening the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.

10 . The method of claim 8 , wherein the establishing comprises establishing the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.

11 . The method of claim 8 , wherein the establishing comprises establishing the communication channel based on a port number of the TCP socket of the container of the first containerized application and a port number of the TCP socket of the container of the second containerized application.

12 . The method of claim 8 , wherein the method further comprises provisioning the PV within the pod, wherein the PV comprises a file store.

13 . The method of claim 12 , wherein the processor is further configured to transfer a file from the first containerized application to a storage location within the PV, and transmit an identifier of the storage location of the file within the PV to the second containerized application via the established communication channel.

14 . The method of claim 8 , wherein the processor is configured to generate a log of the data that is exchanged between the first and second containerized applications and store the log within the pod.

15 . A non-transitory computer-readable medium comprising instruction which when executed by a processor cause a computer to perform a method comprising:

executing a first containerized application within a pod of a host platform, the pod including a persistent volume (PV);

wherein the PV of the pod is separate from and accessible by each of the first containerized application and the second containerized application; and

16 . The non-transitory computer-readable medium of claim 15 , wherein the method further comprises opening the TCP socket on the container of the first containerized application within the pod and opening the TCP socket on the container of the second containerized application within the pod, prior to establishing the communication channel.

17 . The non-transitory computer-readable medium of claim 15 , wherein the establishing comprises establishing the communication channel based on an IP address of the TCP socket of the container of the first containerized application and an IP address of the TCP socket of the container of the second containerized application.