WO2002025413A2 - Ultrasound imaging system having virus protection - Google Patents

Ultrasound imaging system having virus protection Download PDF

Info

Publication number
WO2002025413A2
WO2002025413A2 PCT/US2001/028336 US0128336W WO0225413A2 WO 2002025413 A2 WO2002025413 A2 WO 2002025413A2 US 0128336 W US0128336 W US 0128336W WO 0225413 A2 WO0225413 A2 WO 0225413A2
Authority
WO
WIPO (PCT)
Prior art keywords
virus
user interface
graphical user
recited
registry
Prior art date
Application number
PCT/US2001/028336
Other languages
French (fr)
Other versions
WO2002025413A3 (en
Inventor
Charles Cameron Brackett
Larry Y. L. Mo
Original Assignee
Ge Medical Systems Global Technology Company Llc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ge Medical Systems Global Technology Company Llc filed Critical Ge Medical Systems Global Technology Company Llc
Priority to JP2002529349A priority Critical patent/JP4745595B2/en
Priority to DE10194214T priority patent/DE10194214T1/en
Publication of WO2002025413A2 publication Critical patent/WO2002025413A2/en
Publication of WO2002025413A3 publication Critical patent/WO2002025413A3/en

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562Static detection
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Definitions

  • This invention generally relates to ultrasound imaging systems.
  • the invention relates to methods for providing protection against computer viruses.
  • ultrasound imaging systems are capable of transferring images to various types of remote devices, such as storage devices and printers, and receiving worklists from remote worklist brokers, via communications networks using the DICOM (Digital Imaging and Communications in Medicine) protocol. Images can also be sent from and message sent to an ultrasound imager over the Internet using the TCP/IP protocol. Images and/or operational data are also transferred from remotely situated ultrasound imaging systems to a central service facility via networks for the purpose of diagnosis. Conversely, service facilities have the capability of loading programs and data into remote ultrasound imaging systems via networks .
  • DICOM Digital Imaging and Communications in Medicine
  • ultrasound imager manufacturers or service providers who provide the computer programming used by an ultrasound imaging system prohibit the installation of unauthorized software on the system.
  • that software in order to be in a position to guarantee the integrity of the system software, e.g., pursuant to an equipment warranty or service contract, that software must remain under the control of that manufacturer or service provider.
  • Software integrity cannot be guaranteed if persons having access to the system are able to add software to the system or alter the software already resident in the system.
  • the present invention is directed to an ultrasound imaging system having software for protecting the system against viruses.
  • virus means any program or piece of code that is loaded into the imaging system without the manufacturer's or service provider's knowledge and permission.
  • files are screened for the presence of known viruses before they are installed on the hard disk of the imaging system.
  • any time an application is started the application is checked to ensure that its presence on the system is authorized.
  • each file that enters the system is scanned to . detect the presence of any virus in the file.
  • the Checksum and Size of the file are verified, along with other virus-identifying attributes, to determine if the file is infected with a virus or if the file itself is a virus. If there is a discrepancy in either the Checksum or Size, then a dialogue box appears, warning the system operator that the file being installed may contain a virus. The system operator is given the options of continuing or canceling. If the operator elects to continue, the suspicious file is written to the scanner's hard disk and an entry is placed in a virus log. If the operator elects to cancel, then the suspicious file is not written to the scanner's hard disk and no entry is made in the virus log.
  • any process starting to run on the scanner is monitored.
  • the monitoring operation will be performed whenever the scanner has received an instruction requiring it to execute an application program not yet copied from the hard disk to system memory.
  • a virus protection monitor will suspend execution of the process and search in a Registry table for an entry matching a code identifying the starting process. If the starting process is listed in the table, then the suspension of execution of the authorized process is removed without the system user ever knowing what happened. If the virus protection monitor does not find the matching identifier in the Registry table, then a dialogue box appears on the screen, warning the system operator that the application may be a virus. The system operator is given the options of cleaning, canceling the process or adding.
  • the operator elects to clean, then execution of the unauthorized process is prevented, the file that started this process is removed and an entry is placed in the virus log. If the operator elects to cancel, then execution of the suspicious process is prevented, the file that started this process is not removed and an entry is placed in the virus log. If the operator elects to add, then another dialogue box appears requesting confirmation. If the system operator confirms, then the process identifying code is encrypted and then added to the Registry table, and an entry is made to the virus log. If the system operator declines to confirm, then the confirmation dialogue box disappears, again exposing the alert dialogue box.
  • the Registry table is prestored on the hard disk and updated as new authorized application programs are installed.
  • the virus protection monitoring software communicates with the Registry table via an encrypter/decrypter.
  • FIG. 1 is a block diagram showing a conventional ultrasound imaging system of the type which can be programmed with virus protection software.
  • FIG. 2 is a block diagram showing an ultrasound imaging system having a network connection for communicating with remote devices .
  • FIG. 3 is a block diagram showing a portion of an ultrasound imaging system having virus scanning software in accordance with the preferred embodiment of the invention.
  • FIG. 4 is a block diagram showing a portion of an ultrasound imaging system having virus protection monitoring software in accordance with the preferred embodiment of the invention.
  • FIG. 5 is a schematic showing an Alert dialogue box which appears on the display monitor of the ultrasound imager when the virus scanning software in accordance with the preferred embodiment of the invention determines that a file being written to the hard disk may contain a virus.
  • FIG. 6 is a schematic showing an Alert dialogue box which appears on the display monitor of the ultrasound imager when the virus protection monitoring software in accordance with the preferred embodiment of the invention determines that a file told to execute may contain or be a virus .
  • FIG. 7 is a schematic showing a Confirm dialogue box which appears on the display monitor of the ultrasound imager when the system operator is asked to confirm his/her instruction to add a suspicious process to a registry which lists approved processes .
  • FIG. 1 shows a conventional computerized ultrasound imaging system which can be programmed with software for detecting the presence of viruses in accordance with the preferred embodiments of the invention.
  • the type of imaging system depicted in FIG. 1 has a B mode whereby the imager creates two-dimensional images of tissue and/or blood flow in which the intensity of each pixel is a function of the amplitude of the echo returned from a corresponding sample volume.
  • the basic signal processing chain is as follows.
  • An ultrasound transducer array 2 is activated by a transmitter in a beamformer 4 to transmit an acoustic burst which is focused at a point or zone along a scan line.
  • the return RF signals are detected by the transducer elements and then dynamically focused to form a receive beam by a receiver in the beamformer 4.
  • the receive beamformer output data (I/Q or RF) for each scan line is passed through a B-mode processing chain 6, which preferably includes demodulation, filtering, envelope detection, logarithmic compression and edge enhancement.
  • a B-mode processing chain 6 which preferably includes demodulation, filtering, envelope detection, logarithmic compression and edge enhancement.
  • up to a few hundred receive vectors may be used to form a single acoustic image frame.
  • some acoustic frame averaging 8 may be performed before scan conversion.
  • the log- compressed display data is converted by the scan converter 10 into X- Y format for video display.
  • frame averaging may be performed on the X- Y data (indicated by dashed block 12) rather than the acoustic frames before scan conversion, and sometimes duplicate video frames may be inserted between acoustic frames in order to achieve a given video ' display frame rate.
  • the scan-converted frames are passed to a video processor 14, which maps the video data using a gray-scale mapping.
  • the gray-scaled image frames are then sent to a video monitor 18 for display.
  • System control is centered in a host computer 20, which accepts operator inputs through an operator interface 22 and in turn controls the various subsystems. (In FIG.
  • the operator interface comprises a keyboard, a trackball, a multiplicity of pushbuttons, and other input devices such as sliding and rotary knobs.
  • a long sequence of the most recent images are stored and continuously updated automatically in a cine memory 16.
  • Some systems are designed to save the R - ⁇ acoustic images (this data path is indicated by the dashed line in FIG. 1) , while other systems store the X- Y video images.
  • the image loop stored in cine memory 16 can be reviewed via trackball control, and a section of the image loop can be selected for hard disk storage.
  • the host computer controls the various subsystems in accordance with operating instructions which are stored on a hard disk and then copied to system memory when the system is powered up.
  • files may become installed on the hard disk of the scanner.
  • the first way is through physical media such as CD-ROM, MOD, " etc.
  • the second way is via a network.
  • the host computer of an ultrasound imaging system is programmed with virus protection features . For example, a hacker at a remote device 30 may attempt to send a file having a virus embedded therein to the ultrasound imager via a remote network connection 26, a network 28 and the imager network connection 24.
  • the network 28 may comprise a local area network, a wide area network, a corporate intranet, the Internet, or any other network system, including a system of networks interconnected via gateways .
  • the network connections typically each comprise a networking port and suitable networking software for formatting the data in accordance with the appropriate network protocol .
  • the host computer 20 will scan the infected file for the presence of viruses. If a possible virus is detected, the host computer sends an Alert dialogue box to the video memory 11 (part of the scan converter in FIG. 1) and a command to the video processor 14. In response to the command, the video processor 14 retrieves the dialogue box from the video memory and sends it to the display monitor 18 for display. As described in detail below, the dialogue box presents the system operator with optional responses to the virus alert. The system operator selects a response using the operator interface 22. The host computer 20 then takes appropriate action based on the system operator response.
  • each file that enters the system is scanned by virus scanning software 32 to detect the presence of any virus in the file.
  • the Checksum and Size of the received file is verified, along with other virus-identifying attributes, to determine if the file is infected with a virus or if the file itself is a virus.
  • the Checksum is a known error-detection scheme in which each transmitted file is accompanied by a numerical value based on the number of set bits in the file. The receiving station then applies the same formula to the file and checks to make sure the accompanying numerical value is the same.
  • the receiver can assume that the file has been garbled or infected with a virus. If there is a discrepancy in either the Checksum or Size, then the virus scanning function 32 sends an Alert dialogue box to the video memory 11 for display.
  • the Alert dialogue box contains a warning that the received file may contain a virus.
  • the content of this displayed Alert dialogue box is generally shown in FIG. 5.
  • the system operator is given two options respectively represented by the virtual Continue button 42 and the virtual Cancel button 44. The system operator may elect to continue installing by clicking on Continue button 42 or may elect to cancel the installation by clicking on Cancel button 44. Clicking may be performed by any conventional means, including, for example, a mouse or a trackball coupled with a Set key.
  • the virus scanner 32 will instruct the operating system 36 to proceed with installation of the suspicious file on the hard disk 21. Also the virus scanning function places an entry in a virus log 34, which is maintained on the scanner.
  • the virus log is in ASCII format and is written to by the virus scanner 32.
  • the virus log 34 contains only one type of entry. That entry is defined as follows: Date: Time: Current Logged in User: Process in Question: Action User Took
  • any process starting to run on the scanner is monitored.
  • the monitoring operation will be performed whenever the scanner has received an instruction requiring it to execute an application program not yet copied from the hard disk to system memory.
  • the operating system 36 will send notification to a virus protection monitor 38.
  • the virus protection monitor 38 comprises software for monitoring each starting process. For each starting process, the operating system 36 will copy the appropriate application program from the hard drive 21 to the system memory, but will suspend execution of the program until instructed to resume by the virus protection monitor 38.
  • the operating system sends the identifying code of the process being run to the virus protection monitor 38, which then searches in a Registry table 40 to determine whether the identified process is authorized.
  • the Registry table 40 is an encrypted file on the hard disk that contains a list of all processes that are approved by the system manufacturer or service provider to run on the scanner. Entries are made to this table manually by the field engineer or automatically by software applications written by the manufacturer or service provider and being installed on the system, i.e., the entry is written in the Registry table at the time when the software application is written to the hard disk. When a software application not written by the manufacturer or service provider is installed to the hard disk, no entry will be placed in the Registry table, thereby making such unauthorized software detectable at startup.
  • the virus protection monitor 38 reads the encrypted data from the Registry table. On the way to the virus protection monitor, the encrypted data read out of the Registry table 40 is decrypted by an encrypter/decrypter 39. The virus protection monitor 38 then searches the decrypted entries from the Registry table for an entry which matches the identifier received from the operating system for the starting process . If a match is found, this means that the starting process is authorized. The virus protection monitor 38 * then instructs the operating system 36 to lift the suspension, i.e., to start executing this authorized process. These monitoring steps are transparent to the system operator, i.e., the suspension of process execution is removed without the system user ever knowing what happened.
  • the virus protection monitor 38 If the virus protection monitor 38 does not find an entry from the Registry table which matches the identifier received from the operating system for the starting process, then the virus protection monitor 38 sends an Alert dialogue box to the video memory 11 for display.
  • the Alert dialogue box contains a warning that the starting application is unknown to the scanner and may be a virus.
  • the content of this displayed Alert dialogue box is generally shown in FIG. 6.
  • the system operator is given three options respectively represented by the virtual Clean button 46, the virtual Cancel button 48 and the virtual Add button 50. The system operator may elect to kill the process and remove the file that started the process by clicking on Clean button 46 or may elect to kill the process without removing the file by clicking on Cancel button 48 or may elect to register the starting process in the Registry table by clicking on Add button 50.
  • the virus protection monitor 38 will instruct the operating system 36 to kill the suspicious process (i.e., prevent it from starting) and to remove the file that started the suspicious process from the hard disk 21. In addition, the virus protection monitor 38 places an entry in the virus log 34. If the system operator clicks on the Cancel button, the virus protection monitor 38 will instruct the operating system 36 to kill the suspicious process, and the user may continue as if nothing unusual had happened. The operating system 36 is not instructed to remove the file which started the suspicious process from the hard disk 21. Again, an entry is placed in the virus log 34 to record this event. If the operator clicks on the Add button, then a secondary Confirmation dialogue box (see FIG.
  • the Confirmation dialogue box asks the system operator to confirm that the suspicious process (application) should be registered in the Registry table 40. If the system operator selects the virtual Yes button 52, then the process will be registered in the Registry table to prevent the virus protection monitor 38 from flagging this process in the future, thereby treating this process as any other valid, registered process. An entry is made in the Virus log 34. If the user selects the virtual No button 54, then the Confirmation dialogue box disappears and the system operator is taken back .to the Alert dialogue box shown in FIG. 6. To register the process, the identifying code previously received from the operating system 36 will be sent to the encrypter/decrypter 39 for encryption. The encrypted identifier is then written into the Registry table 40.

Abstract

An ultrasound imaging system is provided with virus protection. Each file that enters the system (via the hard disk (21) or he networking port) is scanned to detect the presence f any virus in the file. Before each file is written to the hard disk of the scanner, the Checksum and Size of the file are verified, along with other virus-identifying attributes, to determine if the file is infected with a virus or if the file itself is a virus. If there is a discrepancy in either the Checksum or Size, then a dialogue box appears, warning the system operator that the file being installed may contain a virus. In order to provide additional protection for the ultrasound scanner, all processes starting to run on the scanner are monitored. Each time a new process is started on the scanner, virus protection monitoring software (38) will suspend the process and search for encrypted data identifying the starting process in a Registry table (40). If the starting process is listed in the table, then the starting process is un-suspended without the user ever knowing what happened. If the virus protection monitor does not find a match in the table, then a dialogue box appears on the screen, warning the system operator that the application may be a virus.

Description

ULTRASOUND IMAGING SYSTEM HAVING VIRUS PROTECTION
FIELD OF THE INVENTION
This invention generally relates to ultrasound imaging systems. In particular, the invention relates to methods for providing protection against computer viruses.
BACKGROUND OF THE INVENTION
The use of computerized ultrasound imaging systems in the medical industry is widespread- Modern ultrasound imaging systems have the capability of communicating with other systems and other devices via networks, including local area networks, corporate intranets and the Internet.. For example, ultrasound imaging systems are capable of transferring images to various types of remote devices, such as storage devices and printers, and receiving worklists from remote worklist brokers, via communications networks using the DICOM (Digital Imaging and Communications in Medicine) protocol. Images can also be sent from and message sent to an ultrasound imager over the Internet using the TCP/IP protocol. Images and/or operational data are also transferred from remotely situated ultrasound imaging systems to a central service facility via networks for the purpose of diagnosis. Conversely, service facilities have the capability of loading programs and data into remote ultrasound imaging systems via networks .
As ultrasound scanners become networked to transfer information to and from the machine, the risk of computer viruses being installed on the scanner greatly increases. There is a need for a method of protecting an ultrasound imaging system against computer viruses.
Furthermore, ultrasound imager manufacturers or service providers who provide the computer programming used by an ultrasound imaging system prohibit the installation of unauthorized software on the system. Obviously, in order to be in a position to guarantee the integrity of the system software, e.g., pursuant to an equipment warranty or service contract, that software must remain under the control of that manufacturer or service provider. Software integrity cannot be guaranteed if persons having access to the system are able to add software to the system or alter the software already resident in the system. Thus, there is also a need to provide protection against the installation on the imaging system of unauthorized software.
SUMMARY OF THE INVENTION
The present invention is directed to an ultrasound imaging system having software for protecting the system against viruses. As used herein, the term "virus" means any program or piece of code that is loaded into the imaging system without the manufacturer's or service provider's knowledge and permission. In accordance with one protection feature, files are screened for the presence of known viruses before they are installed on the hard disk of the imaging system. In accordance with another protection feature, any time an application is started, the application is checked to ensure that its presence on the system is authorized.
In accordance with the preferred embodiment of the invention, each file that enters the system (via the hard disk or the networking port) is scanned to . detect the presence of any virus in the file. Before each file is written to the hard disk of the scanner, the Checksum and Size of the file are verified, along with other virus-identifying attributes, to determine if the file is infected with a virus or if the file itself is a virus. If there is a discrepancy in either the Checksum or Size, then a dialogue box appears, warning the system operator that the file being installed may contain a virus. The system operator is given the options of continuing or canceling. If the operator elects to continue, the suspicious file is written to the scanner's hard disk and an entry is placed in a virus log. If the operator elects to cancel, then the suspicious file is not written to the scanner's hard disk and no entry is made in the virus log.
In order to provide additional protection for the ultrasound scanner, any process starting to run on the scanner is monitored. The monitoring operation will be performed whenever the scanner has received an instruction requiring it to execute an application program not yet copied from the hard disk to system memory. Each time a new process is started on the scanner, a virus protection monitor will suspend execution of the process and search in a Registry table for an entry matching a code identifying the starting process. If the starting process is listed in the table, then the suspension of execution of the authorized process is removed without the system user ever knowing what happened. If the virus protection monitor does not find the matching identifier in the Registry table, then a dialogue box appears on the screen, warning the system operator that the application may be a virus. The system operator is given the options of cleaning, canceling the process or adding. If the operator elects to clean, then execution of the unauthorized process is prevented, the file that started this process is removed and an entry is placed in the virus log. If the operator elects to cancel, then execution of the suspicious process is prevented, the file that started this process is not removed and an entry is placed in the virus log. If the operator elects to add, then another dialogue box appears requesting confirmation. If the system operator confirms, then the process identifying code is encrypted and then added to the Registry table, and an entry is made to the virus log. If the system operator declines to confirm, then the confirmation dialogue box disappears, again exposing the alert dialogue box.
The Registry table is prestored on the hard disk and updated as new authorized application programs are installed. The virus protection monitoring software communicates with the Registry table via an encrypter/decrypter.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram showing a conventional ultrasound imaging system of the type which can be programmed with virus protection software.
FIG. 2 is a block diagram showing an ultrasound imaging system having a network connection for communicating with remote devices .
FIG. 3 is a block diagram showing a portion of an ultrasound imaging system having virus scanning software in accordance with the preferred embodiment of the invention.
FIG. 4 is a block diagram showing a portion of an ultrasound imaging system having virus protection monitoring software in accordance with the preferred embodiment of the invention.
FIG. 5 is a schematic showing an Alert dialogue box which appears on the display monitor of the ultrasound imager when the virus scanning software in accordance with the preferred embodiment of the invention determines that a file being written to the hard disk may contain a virus. FIG. 6 is a schematic showing an Alert dialogue box which appears on the display monitor of the ultrasound imager when the virus protection monitoring software in accordance with the preferred embodiment of the invention determines that a file told to execute may contain or be a virus .
FIG. 7 is a schematic showing a Confirm dialogue box which appears on the display monitor of the ultrasound imager when the system operator is asked to confirm his/her instruction to add a suspicious process to a registry which lists approved processes .
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
FIG. 1 shows a conventional computerized ultrasound imaging system which can be programmed with software for detecting the presence of viruses in accordance with the preferred embodiments of the invention. The type of imaging system depicted in FIG. 1 has a B mode whereby the imager creates two-dimensional images of tissue and/or blood flow in which the intensity of each pixel is a function of the amplitude of the echo returned from a corresponding sample volume. The basic signal processing chain is as follows. An ultrasound transducer array 2 is activated by a transmitter in a beamformer 4 to transmit an acoustic burst which is focused at a point or zone along a scan line. The return RF signals are detected by the transducer elements and then dynamically focused to form a receive beam by a receiver in the beamformer 4. The receive beamformer output data (I/Q or RF) for each scan line is passed through a B-mode processing chain 6, which preferably includes demodulation, filtering, envelope detection, logarithmic compression and edge enhancement. Depending on the scan geometry, up to a few hundred receive vectors may be used to form a single acoustic image frame. To smooth the temporal transition from one acoustic frame to the next, some acoustic frame averaging 8 may be performed before scan conversion. In general, the log- compressed display data is converted by the scan converter 10 into X- Y format for video display. On some systems, frame averaging may be performed on the X- Y data (indicated by dashed block 12) rather than the acoustic frames before scan conversion, and sometimes duplicate video frames may be inserted between acoustic frames in order to achieve a given video 'display frame rate. The scan-converted frames are passed to a video processor 14, which maps the video data using a gray-scale mapping. The gray-scaled image frames are then sent to a video monitor 18 for display. System control is centered in a host computer 20, which accepts operator inputs through an operator interface 22 and in turn controls the various subsystems. (In FIG. 1, only the image data transfer paths are depicted.) The operator interface comprises a keyboard, a trackball, a multiplicity of pushbuttons, and other input devices such as sliding and rotary knobs. During imaging, a long sequence of the most recent images are stored and continuously updated automatically in a cine memory 16.
Some systems are designed to save the R - θ acoustic images (this data path is indicated by the dashed line in FIG. 1) , while other systems store the X- Y video images. The image loop stored in cine memory 16 can be reviewed via trackball control, and a section of the image loop can be selected for hard disk storage.
The host computer controls the various subsystems in accordance with operating instructions which are stored on a hard disk and then copied to system memory when the system is powered up. There are two basic ways in which files may become installed on the hard disk of the scanner. The first way is through physical media such as CD-ROM, MOD," etc. The second way is via a network. In accordance with the preferred embodiments of the invention, the host computer of an ultrasound imaging system is programmed with virus protection features . For example, a hacker at a remote device 30 may attempt to send a file having a virus embedded therein to the ultrasound imager via a remote network connection 26, a network 28 and the imager network connection 24. The network 28 may comprise a local area network, a wide area network, a corporate intranet, the Internet, or any other network system, including a system of networks interconnected via gateways . The network connections typically each comprise a networking port and suitable networking software for formatting the data in accordance with the appropriate network protocol . In accordance with the preferred embodiment, before the infected file is installed on the hard disk 21, the host computer 20 will scan the infected file for the presence of viruses. If a possible virus is detected, the host computer sends an Alert dialogue box to the video memory 11 (part of the scan converter in FIG. 1) and a command to the video processor 14. In response to the command, the video processor 14 retrieves the dialogue box from the video memory and sends it to the display monitor 18 for display. As described in detail below, the dialogue box presents the system operator with optional responses to the virus alert. The system operator selects a response using the operator interface 22. The host computer 20 then takes appropriate action based on the system operator response.
In accordance with one feature of the preferred embodiment (which feature is shown in FIG. 3) , each file that enters the system (via the hard disk or the networking port) is scanned by virus scanning software 32 to detect the presence of any virus in the file. Before each file is written to the hard disk 21 of the scanner by the operating system software 36, the Checksum and Size of the received file is verified, along with other virus-identifying attributes, to determine if the file is infected with a virus or if the file itself is a virus. The Checksum is a known error-detection scheme in which each transmitted file is accompanied by a numerical value based on the number of set bits in the file. The receiving station then applies the same formula to the file and checks to make sure the accompanying numerical value is the same. If not, the receiver can assume that the file has been garbled or infected with a virus. If there is a discrepancy in either the Checksum or Size, then the virus scanning function 32 sends an Alert dialogue box to the video memory 11 for display. The Alert dialogue box contains a warning that the received file may contain a virus. The content of this displayed Alert dialogue box is generally shown in FIG. 5. The system operator is given two options respectively represented by the virtual Continue button 42 and the virtual Cancel button 44. The system operator may elect to continue installing by clicking on Continue button 42 or may elect to cancel the installation by clicking on Cancel button 44. Clicking may be performed by any conventional means, including, for example, a mouse or a trackball coupled with a Set key.
Returning to FIG. 4, if the system operator clicks on the Continue button using the operator interface 22, the virus scanner 32 will instruct the operating system 36 to proceed with installation of the suspicious file on the hard disk 21. Also the virus scanning function places an entry in a virus log 34, which is maintained on the scanner. The virus log is in ASCII format and is written to by the virus scanner 32. The virus log 34 contains only one type of entry. That entry is defined as follows: Date: Time: Current Logged in User: Process in Question: Action User Took
If the system operator clicks on the Cancel button using the operator interface 22, the virus scanner
32 will instruct the operating system 36 to not install the suspicious file on the hard disk 21. In that case no entry to the virus log 34 is made.
In accordance with another feature of the preferred embodiment (which feature is shown in FIG. 4) , any process starting to run on the scanner is monitored. The monitoring operation will be performed whenever the scanner has received an instruction requiring it to execute an application program not yet copied from the hard disk to system memory. Each time a new process is started on the scanner, the operating system 36 will send notification to a virus protection monitor 38. The virus protection monitor 38 comprises software for monitoring each starting process. For each starting process, the operating system 36 will copy the appropriate application program from the hard drive 21 to the system memory, but will suspend execution of the program until instructed to resume by the virus protection monitor 38. The operating system sends the identifying code of the process being run to the virus protection monitor 38, which then searches in a Registry table 40 to determine whether the identified process is authorized.
In accordance with the preferred embodiment of the invention, the Registry table 40 is an encrypted file on the hard disk that contains a list of all processes that are approved by the system manufacturer or service provider to run on the scanner. Entries are made to this table manually by the field engineer or automatically by software applications written by the manufacturer or service provider and being installed on the system, i.e., the entry is written in the Registry table at the time when the software application is written to the hard disk. When a software application not written by the manufacturer or service provider is installed to the hard disk, no entry will be placed in the Registry table, thereby making such unauthorized software detectable at startup.
In accordance with one preferred embodiment of the invention, the virus protection monitor 38 reads the encrypted data from the Registry table. On the way to the virus protection monitor, the encrypted data read out of the Registry table 40 is decrypted by an encrypter/decrypter 39. The virus protection monitor 38 then searches the decrypted entries from the Registry table for an entry which matches the identifier received from the operating system for the starting process . If a match is found, this means that the starting process is authorized. The virus protection monitor 38* then instructs the operating system 36 to lift the suspension, i.e., to start executing this authorized process. These monitoring steps are transparent to the system operator, i.e., the suspension of process execution is removed without the system user ever knowing what happened.
If the virus protection monitor 38 does not find an entry from the Registry table which matches the identifier received from the operating system for the starting process, then the virus protection monitor 38 sends an Alert dialogue box to the video memory 11 for display. The Alert dialogue box contains a warning that the starting application is unknown to the scanner and may be a virus. The content of this displayed Alert dialogue box is generally shown in FIG. 6. The system operator is given three options respectively represented by the virtual Clean button 46, the virtual Cancel button 48 and the virtual Add button 50. The system operator may elect to kill the process and remove the file that started the process by clicking on Clean button 46 or may elect to kill the process without removing the file by clicking on Cancel button 48 or may elect to register the starting process in the Registry table by clicking on Add button 50.
Returning to FIG. 4, if the system operator clicks on the Clean button using the operator interface 22, the virus protection monitor 38 will instruct the operating system 36 to kill the suspicious process (i.e., prevent it from starting) and to remove the file that started the suspicious process from the hard disk 21. In addition, the virus protection monitor 38 places an entry in the virus log 34. If the system operator clicks on the Cancel button, the virus protection monitor 38 will instruct the operating system 36 to kill the suspicious process, and the user may continue as if nothing unusual had happened. The operating system 36 is not instructed to remove the file which started the suspicious process from the hard disk 21. Again, an entry is placed in the virus log 34 to record this event. If the operator clicks on the Add button, then a secondary Confirmation dialogue box (see FIG. 7) appears on the screen, overlying the primary dialogue box shown in FIG. 6. The Confirmation dialogue box asks the system operator to confirm that the suspicious process (application) should be registered in the Registry table 40. If the system operator selects the virtual Yes button 52, then the process will be registered in the Registry table to prevent the virus protection monitor 38 from flagging this process in the future, thereby treating this process as any other valid, registered process. An entry is made in the Virus log 34. If the user selects the virtual No button 54, then the Confirmation dialogue box disappears and the system operator is taken back .to the Alert dialogue box shown in FIG. 6. To register the process, the identifying code previously received from the operating system 36 will be sent to the encrypter/decrypter 39 for encryption. The encrypted identifier is then written into the Registry table 40.
While the invention has been described with reference to preferred embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation to the teachings of the invention without departing from the essential scope thereof . Therefore it is intended that the invention not be limited to the particular embodiment disclosed as the best mode contemplated for carrying out this invention, but that the invention will include all embodiments falling within the scope of the appended claims .

Claims

1. An ultrasound imaging system comprising a hard disk (21) , an operating system (36) and a virus scanner (32) comprising means for detecting a file having an attribute of a virus before said file is installed on said hard disk by said operating system.
2. The ultrasound imaging system as recited in claim 1, wherein said attribute is a checksum of said file.
3. The ultrasound imaging system as recited in claim 1, wherein said attribute is a size of said file.
4. The ultrasound imaging system as recited in claim 1, further comprising a display subsystem (11, 14, 18), wherein said virus scanner further comprises:
means for actuating display of a graphical user interface by said display subsystem in response to detection of said file, said graphical user interface comprising a virus alert and a virtual actuator; and
means for instructing said operating system to install said file in response to selection of said virtual actuator.
5. The ultrasound imaging system as recited in claim 4, further comprising a log (34) of virus detection events, wherein said virus scanner further comprises means for logging an entry in said log in response to selection of said virtual actuator.
6. The ultrasound imaging system as recited in claim 1, further comprising:
a registry (40) containing information registering authorized processes; and
a virus protection monitor (38) comprising means for suspending a process to be started by said operating system, means for receiving an identifier identifying said suspended process from said operating system, and means for detecting that said suspended process is not registered in said registry.
7. The ultrasound imaging system as recited in claim 6, wherein said information in said registry is encrypted, further comprising a decrypter (39) arranged to decrypt encrypted information sent from said registry to said virus protection monitor.
8. The ultrasound imaging system as recited in claim 6, further comprising a display subsystem (11, 14, 18) , wherein said virus protection monitor further comprises means for actuating display of a first graphical user interface by said display subsystem in response to detection that said suspended process is not registered, said first graphical user interface comprising a virus alert and a virtual actuator.
9. The ultrasound imaging system as recited in claim 8, wherein said virus protection monitor further comprises means for instructing said operating system to kill said suspended process in response to selection of said virtual actuator on said first graphical user interface.
10. The ultrasound imaging system as recited in claim 9, further comprising a log (34) of virus detection events, wherein said virus protection monitor further comprises means for logging an entry in said log in response to selection of said virtual actuator on said first graphical user interface.
11. The ultrasound imaging system as recited in claim 9, wherein said virus protection monitor further comprises means for instructing said operating system to remove from said hard disk the file that started said suspended process in response to selection of said virtual actuator on said first graphical user interface.
12. The ultrasound imaging system as recited in claim 8, wherein said virus protection monitor further comprises :
means for actuating display of a second graphical user interface by said display subsystem in response to selection of said virtual actuator on said first graphical user interface, said second graphical user interface comprising a request for confirmation and a virtual actuator; and
means for adding information to said registry for registering said suspended process in response to selection of said virtual actuator on said second graphical user interface.
13. The ultrasound imaging system as recited in claim 12, wherein said information in said registry is encrypted, further comprising an encrypter (39) arranged to encrypt information sent from said virus protection monitor to said registry.
14. An ultrasound imaging system comprising:
a hard disk (21) ;
a registry (40) containing information registering authorized processes; and
a computer (20) programmed to perform the following steps: suspending a process to be started; and detecting that said suspended process is not registered in said registry.
15. The ultrasound imaging system as recited in claim 14, wherein said information in said registry is encrypted, said computer being further programmed to decrypt encrypted information read from said registry.
16. The ultrasound imaging system as recited in claim 14, further comprising a display subsystem (11, 14,
18) , wherein said computer is further programmed to actuate display of a first graphical user interface by said display subsystem in response to detection that said suspended process is not registered, said first graphical user interface comprising a virus alert and a virtual actuator.
17. The ultrasound imaging system as recited in claim 16, wherein said computer is further programmed to kill said suspended process in response to selection of said virtual actuator on said first graphical user interface.
18. The ultrasound imaging system as recited in claim 17, further comprising a log (34) of virus detection events, wherein said computer is further programmed to log an entry in said log in response to selection of said virtual actuator on said first graphical user interface.
19. The ultrasound imaging system as recited in claim 17, wherein said computer is further programmed to remove from said hard disk the file that started said suspended process in response to selection of said virtual actuator on said first graphical user interface.
20. The ultrasound imaging system as recited in claim 16, wherein said computer is further programmed to perform the following steps:
actuating display of a second graphical user interface by said display subsystem in response to selection of said virtual actuator on said first graphical user interface, said second graphical user interface comprising a request for confirmation and a virtual actuator; and
adding information to said registry for registering said suspended process in response to selection of said virtual actuator on said second graphical user interface.
21. The ultrasound imaging system as recited in claim 20, wherein said information in said registry is encrypted, said computer being further programmed to encrypt information before placing it in said registry.
22. A method of protecting an ultrasound imaging system against viruses, comprising the steps of:
storing a registry on a hard disk, said registry containing information registering authorized processes;
suspending a process to be started; and
detecting that said suspended process is not registered in said registry.
23. The method as recited in claim 22, wherein said information in said registry is encrypted, further comprising the step of decrypting information read from said registry.
24. The method as recited in claim 22, further comprising the step of displaying a first graphical user interface in response to detection that said suspended process is not registered, said first graphical user interface comprising a virus alert and a virtual actuator.
25. The method as recited in claim 24, further comprising the step of killing said suspended process in response to selection- of said virtual actuator on said first graphical user interface.
26. The method as recited in claim 25, further comprising the step of placing an entry in a log of virus detection events in response to selection of said virtual actuator on said first graphical user interface.
27. The method as recited in claim 25, further comprising the step of removing from said hard disk the file that started said suspended process in response to selection of said virtual actuator on said first graphical user interface.
28. The method as recited in claim 24, further comprising the steps of:
displaying a second graphical user interface in response to selection of said virtual actuator on said first graphical user interface, said second graphical user interface comprising a request for confirmation and a virtual actuator; and
adding information to said registry for registering said suspended process in response to selection of said virtual actuator on said second graphical user interface.
29. The method as recited in claim 28, wherein said information in said registry is encrypted, further comprising the step of encrypting information before placing it in said registry.
PCT/US2001/028336 2000-09-22 2001-09-10 Ultrasound imaging system having virus protection WO2002025413A2 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
JP2002529349A JP4745595B2 (en) 2000-09-22 2001-09-10 Ultrasound imaging system with virus protection function
DE10194214T DE10194214T1 (en) 2000-09-22 2001-09-10 Ultrasound imaging system with virus protection

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09/667,742 2000-09-22
US09/667,742 US7263616B1 (en) 2000-09-22 2000-09-22 Ultrasound imaging system having computer virus protection

Publications (2)

Publication Number Publication Date
WO2002025413A2 true WO2002025413A2 (en) 2002-03-28
WO2002025413A3 WO2002025413A3 (en) 2003-09-18

Family

ID=24679439

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2001/028336 WO2002025413A2 (en) 2000-09-22 2001-09-10 Ultrasound imaging system having virus protection

Country Status (4)

Country Link
US (1) US7263616B1 (en)
JP (1) JP4745595B2 (en)
DE (1) DE10194214T1 (en)
WO (1) WO2002025413A2 (en)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005182344A (en) * 2003-12-18 2005-07-07 Fuji Photo Film Co Ltd In-hospital management device and program
US7441273B2 (en) * 2004-09-27 2008-10-21 Mcafee, Inc. Virus scanner system and method with integrated spyware detection capabilities
US7685149B2 (en) * 2005-03-28 2010-03-23 Microsoft Corporation Identifying and removing potentially unwanted software
US8161548B1 (en) 2005-08-15 2012-04-17 Trend Micro, Inc. Malware detection using pattern classification
US7840958B1 (en) * 2006-02-17 2010-11-23 Trend Micro, Inc. Preventing spyware installation
KR100938672B1 (en) * 2007-11-20 2010-01-25 한국전자통신연구원 The method and apparatus for detecting dll inserted by malicious code
US8607347B2 (en) * 2008-09-29 2013-12-10 Sophos Limited Network stream scanning facility
US8181251B2 (en) * 2008-12-18 2012-05-15 Symantec Corporation Methods and systems for detecting malware
CN101877710B (en) * 2010-07-13 2012-10-17 成都市华为赛门铁克科技有限公司 Proxy gateway anti-virus implement method, pre-sorter and proxy gateway
US9027138B2 (en) 2012-06-29 2015-05-05 Centurylink Intellectual Property Llc Identification of infected devices in broadband environments
CN103778369B (en) * 2012-10-17 2016-12-21 腾讯科技(深圳)有限公司 Prevent virus document from subscriber equipment is carried out the device and method of illegal operation
KR20140124906A (en) * 2013-01-24 2014-10-28 주식회사 잉카인터넷 process check system and method based by behavior
KR101865238B1 (en) * 2016-12-13 2018-06-07 주식회사 엔피코어 Device for deactivating malicious code and method for operating the same
CN109325347B (en) * 2018-08-27 2020-11-03 杭州安恒信息技术股份有限公司 Method, system and device for searching and killing jump virus and readable storage medium

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0570123A1 (en) * 1992-05-15 1993-11-18 Addison M. Fischer Computer system security method and apparatus having program authorization information data structures
WO1993025024A1 (en) * 1992-05-26 1993-12-09 Cyberlock Data Intelligence, Inc. Computer virus monitoring system
DE4344280A1 (en) * 1993-12-23 1995-06-29 Terzibaschian Astrik Authorising digital data from text and images
WO1998045778A2 (en) * 1997-04-08 1998-10-15 Marc Zuta Antivirus system and method
US5944821A (en) * 1996-07-11 1999-08-31 Compaq Computer Corporation Secure software registration and integrity assessment in a computer system
WO2000036515A1 (en) * 1998-12-11 2000-06-22 Rvt Technologies, Inc. Method and apparatus for isolating a computer system upon detection of viruses and similar data
US6167520A (en) * 1996-11-08 2000-12-26 Finjan Software, Inc. System and method for protecting a client during runtime from hostile downloadables

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4442486A (en) * 1981-11-25 1984-04-10 U.S. Philips Corporation Protected programmable apparatus
US5191611A (en) * 1989-04-03 1993-03-02 Lang Gerald S Method and apparatus for protecting material on storage media and for transferring material on storage media to various recipients
JPH03233629A (en) * 1990-02-09 1991-10-17 Nec Corp System for checking destruction of execution format file
US5319776A (en) * 1990-04-19 1994-06-07 Hilgraeve Corporation In transit detection of computer virus with safeguard
US5818570A (en) * 1992-05-29 1998-10-06 Urbanczyk; Matthias Device and method for recording or transferring graphical information for analysis and storage purposes
JPH07146788A (en) * 1993-11-22 1995-06-06 Fujitsu Ltd System and method for preparing virus diagnostic mechanism and virus diagnostic mechanism and diagnostic method
JP3544557B2 (en) * 1994-04-08 2004-07-21 オリンパス株式会社 Image file device
US5684875A (en) * 1994-10-21 1997-11-04 Ellenberger; Hans Method and apparatus for detecting a computer virus on a computer
JPH08147159A (en) * 1994-11-16 1996-06-07 Hitachi Ltd Information processor
GB9616783D0 (en) * 1996-08-09 1996-09-25 Apm Ltd Method and apparatus
US5956481A (en) * 1997-02-06 1999-09-21 Microsoft Corporation Method and apparatus for protecting data files on a computer from virus infection
US6557102B1 (en) * 1997-09-05 2003-04-29 Koninklijke Philips Electronics N.V. Digital trust center for medical image authentication
US6275937B1 (en) * 1997-11-06 2001-08-14 International Business Machines Corporation Collaborative server processing of content and meta-information with application to virus checking in a server network
US6490684B1 (en) * 1998-03-31 2002-12-03 Acuson Corporation Ultrasound method and system for enabling an ultrasound device feature
US6694434B1 (en) * 1998-12-23 2004-02-17 Entrust Technologies Limited Method and apparatus for controlling program execution and program distribution
US6266773B1 (en) * 1998-12-31 2001-07-24 Intel. Corp. Computer security system

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0570123A1 (en) * 1992-05-15 1993-11-18 Addison M. Fischer Computer system security method and apparatus having program authorization information data structures
WO1993025024A1 (en) * 1992-05-26 1993-12-09 Cyberlock Data Intelligence, Inc. Computer virus monitoring system
DE4344280A1 (en) * 1993-12-23 1995-06-29 Terzibaschian Astrik Authorising digital data from text and images
US5944821A (en) * 1996-07-11 1999-08-31 Compaq Computer Corporation Secure software registration and integrity assessment in a computer system
US6167520A (en) * 1996-11-08 2000-12-26 Finjan Software, Inc. System and method for protecting a client during runtime from hostile downloadables
WO1998045778A2 (en) * 1997-04-08 1998-10-15 Marc Zuta Antivirus system and method
WO2000036515A1 (en) * 1998-12-11 2000-06-22 Rvt Technologies, Inc. Method and apparatus for isolating a computer system upon detection of viruses and similar data

Also Published As

Publication number Publication date
DE10194214T1 (en) 2003-08-28
JP4745595B2 (en) 2011-08-10
WO2002025413A3 (en) 2003-09-18
JP2004510226A (en) 2004-04-02
US7263616B1 (en) 2007-08-28

Similar Documents

Publication Publication Date Title
US7263616B1 (en) Ultrasound imaging system having computer virus protection
USRE45326E1 (en) Systems and methods for securing computers
US7711714B2 (en) Method and a device for sterilizing downloaded files
JP3848684B2 (en) Computer network system management method and computer used in computer network system
JP3638203B2 (en) Communication processing method and communication processing system
US6393568B1 (en) Encryption and decryption system and method with content analysis provision
JP4950384B2 (en) Medical diagnostic imaging apparatus and security management method thereof
US20040088565A1 (en) Method of identifying software vulnerabilities on a computer system
US20050132232A1 (en) Automated user interaction in application assessment
JPH08331267A (en) Method and system for communication between device to be monitored and monitoring device and computer program product
EP0948771A2 (en) Information security method and apparatus
EP1563665A2 (en) A method and system for access control
WO2005048114A1 (en) Invalidity monitoring program, invalidity monitoring method, and invalidity monitoring system
JP2007220073A (en) Image reader and program
JP2006094258A (en) Terminal device, its policy forcing method, and its program
US20190362075A1 (en) Preventing users from accessing infected files by using multiple file storage repositories and a secure data transfer agent logically interposed therebetween
WO2007134102A2 (en) System and method of agent self-repair within an intelligent agent system
US20070118256A1 (en) System and method of intelligent agent identification for vehicle diagnostics
JP2002149435A (en) Network centralized monitor method
KR20010037700A (en) System and method for detecting active intellectual property
JPH11306142A (en) Computer and security device for computer system
JP2002259149A (en) Remote computer virus prevention system through network and is method
JP3404032B1 (en) Computer virus countermeasure system and computer virus countermeasure method
JP2001229130A (en) Method and device for secure remote access to software of center service facility
US20030200488A1 (en) Method and network for containing the spread of damage from a network element subject to compromise

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): DE JP

ENP Entry into the national phase

Ref document number: 2002 529349

Country of ref document: JP

Kind code of ref document: A

RET De translation (de og part 6b)

Ref document number: 10194214

Country of ref document: DE

Date of ref document: 20030828

Kind code of ref document: P

WWE Wipo information: entry into national phase

Ref document number: 10194214

Country of ref document: DE

REG Reference to national code

Ref country code: DE

Ref legal event code: 8607

REG Reference to national code

Ref country code: DE

Ref legal event code: 8607