How to operate the media scanner

Abstract

A method for operating a media scanner to protect a target machine from malware on a removable storage device. The target machine and the removable storage device each include corresponding data lines, and the media scanner includes a data switch. Malware detection software of the media scanner is used to scan data on the removable storage device via a first data path, the first data path comprising a data line of the removable storage device connected to a data line of the media scanner via a data switch in a first switching state. After the data has been scanned using the malware detection software, the data switch is operated to switch from the first switching state to a second switching state, thereby disconnecting the data line of the removable storage device from the data line of the media scanner and connecting the data line of the removable storage device to a data line of the target machine. Data is transferred from the removable storage device to the target machine via a second data path, the second data path comprising a data line of the removable storage device connected to a data line of the target machine via the data switch in a second switching state. After the device is removed, the data switch is returned to its first switching state.

Description

Technical Field

[0001] The present invention relates to a method of operating a media scanner to protect a target machine from malware on a removable storage device. The present invention also relates to a media scanner configured to perform such a method. Background Art

[0002] Conventional methods for protecting target machines from malware on removable storage devices involve installing malware detection software on the target machine. This may not be possible in industrial environments. Another problem with this conventional approach is that legacy or older target machines may have operating systems that are beyond their supported lifespan and therefore cannot run the latest version of the malware detection software. Summary of the Invention

[0003] According to one aspect of the present invention, a method of operating a media scanner to protect a target machine from malware on a removable storage device is provided, wherein the target machine and the removable storage device each include corresponding data lines, and the media scanner includes a data switch, the method comprising: a) using malware detection software of the media scanner to scan data on the removable storage device via a first data path, the first data path including the data lines of the removable storage device connected to the data lines of the media scanner through the data switch in a first switch state; b) after scanning the data using the malware detection software, operating the data switch to switch from the first switch state to a second switch state, thereby disconnecting the data lines of the removable storage device from the data lines of the media scanner and connecting the data lines of the removable storage device to the data lines of the target machine; c) transferring data from the removable storage device to the target machine via a second data path, the second data path including the data lines of the removable storage device connected to the data lines of the target machine through the data switch in a second switch state; and d) after the removable storage device is removed from the media scanner, returning the data switch to the first switch state of the data switch.

[0004] Another aspect of the present invention provides a media scanner comprising: a data line, a data switch, malware detection software, and a computer configured to operate the media scanner to protect a target machine from malware on a removable storage device by the method of the first aspect.

[0005] During the malware scanning step a), the target machine is isolated from the storage device due to the switch being in its first switch state. This is advantageous because it prevents the target machine from being infected by malware from the removable storage device.

[0006] The malware detection software is installed on the media scanner rather than on the target machine, making the present invention particularly useful in industrial environments where installing malware detection software on the target machine may be difficult or impossible. The media scanner can also run the latest version of the malware detection software, so the media scanner can be used to protect target machines with operating systems that are beyond their supported lifespan.

[0007] Preferably, step b) is performed after the data has been scanned using malware detection software and the storage device has passed muster (eg, no malware, or any malware has been removed or quarantined).

[0008] Preferably, the media scanner is a mobile device that can be physically coupled to a target machine, physically decoupled from the target machine, and then used to protect another target machine from malware. This enables the media scanner to be used to protect many target machines.

[0009] Optionally, the target machine and the removable storage device each include a corresponding power line, and the media scanner includes a power switch, the method further comprising: during the scanning step a), supplying power to the removable storage device via a first power path, the first power path comprising the power line of the removable storage device being connected to the power line of the media scanner through the power switch in a first switching state; after the scanning step a), operating the power switch to switch from the first switching state of the power switch to a second switching state, thereby disconnecting the power line of the removable storage device from the power line of the media scanner and powering off the removable storage device; after the removable storage device is powered off, operating the power switch to switch from the second switching state of the power switch to a third switching state, thereby connecting the power line of the removable storage device to the power line of the target machine, and powering on the removable storage device via the second power path, the second power path comprising the power line of the removable storage device being connected to the power line of the target machine through the power switch in the third switching state; during the data transfer step c), supplying power to the removable storage device via the second power path; and after the removable storage device is removed from the media scanner, returning the power switch to the first switching state of the power switch.

[0010] This switching process ensures that the storage device is powered by the same device it is communicating with. This is particularly advantageous if the storage device is a Universal Serial Bus (USB) device, as power management for any attached USB device is an important part of controlling the device, affecting the connection, operation, and disconnection of the USB device.

[0011] Optionally, the data switches and power switches are integrated into a single switchboard.

[0012] Powering on the removable storage device may enable the removable storage device to perform a handshake process with the target machine via the second data path before the data transmission step c).

[0013] Optionally, the removable storage device is powered on after the switching step b), so that the second data path is created before the removable storage device is powered on.

[0014] The method may further include operating the media scanner to detect removal of the removable storage device from the media scanner, wherein in response to detecting the removal, returning the data switch and / or the power switch to its first switching state. This is advantageous because it prevents undesirable oscillations that may occur if such detection is lost.

[0015] Removal of the removable storage device from the media scanner can be detected by detecting a decrease in the power drawn by the removable storage device via the second power path. Alternatively, removal can be detected in some other manner, such as using a physical switch that senses whether the removable storage device is received in a receptacle of the media scanner.

[0016] A reduction in power can be detected by detecting a decrease in current.

[0017] The reduction in current may be detected by generating an amplified signal indicative of the current and monitoring when the amplified signal exceeds a threshold.

[0018] The method may further include: operating the media scanner to check whether the media scanner is coupled to the target machine; and if the check indicates that the target machine is coupled to the media scanner, operating the data switch in step b) to switch from the first switch state to the second switch state. This is advantageous because it prevents undesirable oscillations that may occur if the media scanner is not coupled to the target machine without such a check.

[0019] Optionally, the media scanner is a mobile device that is physically coupled to the target machine during the data transfer step c), and the method further comprises physically decoupling the media scanner from the target machine after the data transfer step c). For example, such decoupling can be achieved by unplugging a cable.

[0020] The method may further include isolating or removing the malware if the malware detection software detects the malware. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Embodiments of the present invention will now be described with reference to the accompanying drawings, in which:

[0022] Figure 1 is a schematic diagram of a mobile media scanner (MMS);

[0023] Figure 2 yes Figure 1 Schematic diagram of an MMS coupled to a removable storage device and a target machine, wherein both switches are in their first switch state;

[0024] Figure 3 A method is shown in which the data switch is in a first switching state and the memory device is powered off with the power switch in a second switching state. Figure 2 equipment;

[0025] Figure 4 A diagram showing a circuit in which the data switch is in a second switching state and the power switch is in a second switching state Figure 2 equipment;

[0026] Figure 5 A method is shown in which the data switch is in the second switching state and the memory device is powered on with the power switch in the third switching state. Figure 2 equipment; and

[0027] Figure 6 A power sensor is shown. DETAILED DESCRIPTION

[0028] Figure 1 FIGURE 1 shows a mobile media scanner (MMS) 1 according to an embodiment of the present invention. MMS 1 is a mobile, standalone device. MMS 1 includes a universal serial bus (USB) switchboard 2, a single-board computer (SBC) 3, and a touchscreen 4. Switchboard 2 includes a data switch 2a, a power switch 2b, and a PIC (Programmable Intelligent Processor) processor 2c, which controls switches 2a and 2b. Alternatively, processor 2c may be another type of controller, such as a field programmable gate array (FPGA). Switchboard 2 operates with both USB versions 2 and 3.

[0029] A first MMS data line 5a leads from data switch 2a to device data port 6a; a second MMS data line 7a leads from data switch 2a to SBC 3; and a third MMS data line 8a leads from data switch 2a to target machine data port 9a.

[0030] A first MMS power line 5b leads from power switch 2b to device power port 6b; a second MMS power line 7b leads from power switch 2b to SBC 3; and a third MMS power line 8b leads from power switch 2b to target machine power port 9b.

[0031] The MMS 1 is a mobile device that can be physically coupled to a target machine 10, such as Figure 2As shown, the MMS 1 is then decoupled from the target machine 10 when it is no longer needed. For example, this coupling can be performed via USB cable 11. The target machine 10 has: a data line 10a, which is connected to the third MMS data line 8a via USB cable 11 and the target machine data port 9a; and a power line 10b, which is connected to the third MMS power line 8b via USB cable 11 and the target machine power port 9b. USB cable 11 is plugged into one USB port of the target machine, and any other USB ports of the target machine can be disabled.

[0032] The function of the MMS 1 is to protect the target machine 10 from malware on a removable storage device 20 that is inserted into a socket of the MMS 1 so that it Figure 2 Shown connected to the MMS 1. The storage device 20 has a data line 20a connected to the first MMS data line 5a via the device data port 6a and a power line 20b connected to the first MMS power line 5b via the device power port 6b.

[0033] The SBC 3 runs custom software configured to operate the MMS 1 to protect the target machine 10 from malware on the storage device 20 by the method described below.

[0034] By default, the data switch 2a and the power switch 2b are in Figure 2 Therefore, when the storage device 20 is Figure 2 When inserted into the MMS 1, the storage device 20 is inserted into the MMS 1 via Figure 2 The first power path shown is powered on. The first power path comprises a power line 20b of the storage device connected to a power line 7b of the MMS 1 via a power switch 2b in a first switching state.

[0035] The power on of the storage device 20 causes the storage device 20 to be powered on. Figure 2 The first data path shown performs a handshake process with the SBC 3. The first data path includes data line 20a of the storage device 20 connected to data line 7a of the MMS 1 through data switch 2a in a first switching state. The handshake process negotiates communication between the storage device 20 and the SBC 3.

[0036] MMS 1 runs multiple types of malware detection software (virus checkers), such as McAfee (registered trademark) or ClamAV (registered trademark). In this case, there are two types, but there may be three or more. After the handshake process is completed, SBC 3 uses the malware detection software to scan data on storage device 20 via the first data path. During the malware scanning step, storage device 20 continues to be powered via the first power path.

[0037] During the malware scanning step, since the switches 2a, 2b are in their first switch state, the target machine 10 is isolated from the storage device 20. This is advantageous because it prevents the target machine 10 from being infected by malware from the storage device 20.

[0038] If the malware detection software detects malware, the MMS 1 is operated to quarantine the malware or remove it from the storage device 20. Quarantining the malware may involve replacing the malware with an encrypted version of the file, which is stored on the storage device 20 along with an encryption key to enable recovery. This process continues until all data on the storage device 20 has been checked. The process can then terminate, or if some of the data on the storage device 20 is not malware, the process can continue. The progress of the malware scan is displayed to the operator via screen 4.

[0039] After the data has been scanned using malware detection and the storage device 20 passes clean (ie, no malware or any malware removed or quarantined), the SBC 3 then sends an instruction to the PIC processor 2c to switch to the target machine. The PIC processor 2c then manages the timing of the switch.

[0040] PIC processor 2c checks whether MMS 1 is Figure 2 If the MMS 1 is not coupled to the target machine 10, the switches 2a, 2b remain in their default first switching state. If the check indicates that the target machine 10 is coupled to the MMS 1, the PIC processor 2c operates the power switch 2b to switch from the first switching state of the power switch 2b to the default first switching state. Figure 3 The second switch state is shown, thereby disconnecting the power line 20b of the storage device 20 from the power line 7b of the MMS 1 and de-energizing the storage device 20.

[0041] When the power switch 2b is switched to Figure 3 After the storage device 20 is powered off, the data switch 2a is switched from Figure 3 The first switch state is switched to Figure 4The second switch state shown is shown, thereby disconnecting the data line 20a of the storage device from the data line 7a of the MMS 1 and connecting the data line 20a of the removable storage device to the data line 10a of the target machine 10 to form a second data path. The second data path includes the data line 20a of the storage device 20 being connected to the data line 10a of the target machine 10 via the data switch 2a in the second switch state.

[0042] When the data switch 2a is powered off in the storage device 20, it is switched to Figure 4 After the PIC processor 2c operates the power switch 2b to switch from the second switching state of the power switch 2b to the second switching state of the power switch 2b. Figure 5 The third switch state shown in FIG. 1 connects the power line 20b of the storage device to the power line 10b of the target machine 10. This enables the storage device 20 to be connected to the target machine 10 via Figure 5 The second power path shown is powered on again. The second power path comprises the power line 20b of the removable storage device 20 connected to the power line 10b of the target machine 10 via the power switch 2b in the third switching state.

[0043] The power on of the storage device 20 again causes the storage device 20 to perform a handshake process with the target machine 10, similar to the handshake process with the MMS 1 described previously. Figure 5 The second data path shown negotiates communications between the storage device 20 and the target machine 10. Note that the storage device 20 is powered on after the data switch 2a is switched to the second switch state so that the second data path is created before the removable storage device is powered on again.

[0044] As described above, after scanning the data using the malware detection software, PIC processor 2c checks whether MMS 1 is coupled to target machine 10. If MMS 1 is not coupled to target machine 10, switches 2a, 2b remain in their default first switching state. This check prevents undesirable oscillations that would otherwise occur if this check were missing. Such oscillations would occur as follows: storage device 20 is powered off; an attempt is made to power on via target machine 10; no power is available, so the switches return to their first switching state; MMS 1 interprets this as a new intrusion into the storage device and reboots; storage device 20 repeats the handshake and scanning steps with MMS 1, and so on.

[0045] After the handshake is completed, data is transferred from the storage device 20 to the target machine 10 via the second data path. During the handshake step and the data transfer step, the storage device 20 continues to be powered via the second power path.

[0046] When the storage device is connected to the target machine, the SBC continuously checks whether the storage device 20 is removed from the MMS 1. When the SBC 3 detects that the removable storage device is removed from the MMS 1, the data switch 2a and the power switch 2b return to the state as shown in FIG. Figure 1 Likewise, checking whether the storage device 20 is removed from the MMS 1 before returning the switches 2a, 2b to their first switching state prevents undesired oscillations similar to those described above.

[0047] The removal of the storage device 10 from the MMS 1 is detected by a power sensor 7, which is arranged to monitor the power drawn via the first MMS power line 5b. When the power sensor 7 detects a decrease in the power drawn by the storage device 10 via the second power path, the SBC 3 takes this as an indication that the storage device 10 has been removed.

[0048] exist Figure 6 A preferred form of power sensor 7 is shown in FIG. Power sensor 7 measures the voltage across a 0.2 ohm resistor 30 in a 0V line 31. A reduction in power is detected by generating an amplified signal indicative of the current and monitoring when the amplified signal drops below a threshold. While the amplified signal is above the threshold, the device connection signal remains high, and when the amplified signal drops below the threshold, the device connection signal is reset to indicate that the storage device 10 has been removed. This is monitored by PIC processor 2 c, which passes the message to SBC 3. This resetting of the device connection signal notifies SBC 3 that the process is complete, and the control program executed by SBC 3 can reset the system to await the next storage device to be tested.

[0049] As described above, the MMS 1 is a mobile device that is physically coupled to the target machine 10 via the USB cable 11 during the handshake and data transfer steps. After the handshake and data transfer steps, the MMS 1 can be physically decoupled from the target machine 10 by unplugging the USB cable 11.

[0050] Importantly, the power used by storage device 10 is provided by the same device it is communicating with. This is achieved through the handoff process described above. Within the PC / controller, the USB host controller chip controls access to USB devices. The USB host controller chip generates a "port change interrupt" to let the operating system know that a new device is available or that a device has been removed. One mechanism used for detection is power management of USB devices.

[0051] As described above, the target machine 10 is isolated from the storage device 20 during the malware scanning step. At no time is any active component of the MSS 1 (eg, the SBC 3 or the PIC processor 2c) connected to the target machine 10.

[0052] The MMS 1 can be used in industrial environments where USB removable media is used to transfer data between machines and workstations. The MMS 1 is particularly useful in environments where it is not possible to install malware detection software on the target machine (which is often the case in industrial environments).

[0053] When the word "or" appears, this will be interpreted to mean "and / or" such that the referred items are not necessarily mutually exclusive and can be used in any appropriate combination.

[0054] Although the invention has been described above with reference to one or more preferred embodiments, it will be appreciated that various changes or modifications may be made without departing from the scope of the invention as defined in the appended claims.

Claims

1. A method of operating a media scanner to protect a target machine from malware on a removable storage device, wherein: The target machine and the removable storage device each include a corresponding data line, and the media scanner includes a data switch, and the method includes: a) scanning data on the removable storage device using malware detection software of the media scanner via a first data path, the first data path comprising a data line of the removable storage device connected to a data line of the media scanner via the data switch in a first switch state; b) after scanning the data using the malware detection software, operating the data switch to switch from a first switch state to a second switch state, thereby disconnecting the data line of the removable storage device from the data line of the media scanner and connecting the data line of the removable storage device to the data line of the target machine; c) transferring the data from the removable storage device to the target machine via a second data path, the second data path comprising a data line of the removable storage device connected to a data line of the target machine through the data switch in a second switching state; and d) after the removable storage device is removed from the media scanner, returning the data switch to the first switch state of the data switch, Wherein, the target machine and the removable storage device each include a corresponding power line, and the media scanner includes a power switch, and the method further includes: During scanning step a), powering the removable storage device via a first power path, the first power path comprising a power line of the removable storage device connected to a power line of the media scanner through the power switch in a first switching state; After the scanning step a), operating the power switch to switch from a first switching state to a second switching state of the power switch, thereby disconnecting a power line of the removable storage device from a power line of the media scanner and powering off the removable storage device; After the mobile storage device is powered off, operating the power switch to switch from the second switching state of the power switch to a third switching state, thereby connecting the power line of the mobile storage device to the power line of the target machine and powering on the mobile storage device via a second power path, the second power path comprising the power line of the mobile storage device connected to the power line of the target machine through the power switch in the third switching state; During the data transmission step c), the removable storage device is powered via the second power path; and After the removable storage device is removed from the media scanner, the power switch is returned to the first switching state of the power switch.

2. The method according to claim 1, wherein Powering on the removable storage device enables the removable storage device to perform a handshake process with the target machine via the second data path before the data transmission step c).

3. The method according to claim 1, wherein The removable storage device is powered on after the switching step b), so that the second data path is created before the removable storage device is powered on.

4. The method according to claim 1, further comprising: The media scanner is operated to detect removal of the removable storage device from the media scanner, wherein the data switch and / or the power switch is returned to its first switch state in response to detecting the removal.

5. The method according to claim 1, wherein Removal of the removable storage device from the media scanner is detected by detecting a decrease in power drawn by the removable storage device via the second power path.

6. The method according to claim 5, wherein: A reduction in power is detected by sensing a reduction in current.

7. The method according to claim 6, wherein: The reduction in current is detected by generating an amplified signal indicative of the current and monitoring when the amplified signal exceeds a threshold.

8. The method according to any one of claims 1 to 7, further comprising: operating the media scanner to check whether the media scanner is coupled to the target machine; And if the checking indicates that the target machine is coupled to the media scanner, operating the data switch in step b) to switch from the first switch state to the second switch state.

9. The method according to any one of claims 1 to 7, wherein The media scanner is a mobile device that is physically coupled to the target machine during the data transfer step c), and the method further includes physically decoupling the media scanner from the target machine after the data transfer step c).

10. The method according to any one of claims 1 to 7, further comprising: In the event that malware is detected by the malware detection software, the malware is quarantined or removed.

11. A media scanner, comprising: A data line, a data switch, malware detection software, and a computer configured to operate the media scanner to protect a target machine from malware on a removable storage device by the method of any one of claims 1-10.

12. The media scanner of claim 11, wherein: The media scanner is a mobile device capable of being physically coupled to and decoupled from the target machine.

Images