Improving Security of Systems Integrated in Ultrasound Devices
Contract-based method to scope security re-verification when ultrasound software modules update.
Samsung R&D Institute Bangladesh · August 2026 – Present
Overview
Different teams independently develop, test, and release the various software components integrated into an ultrasound machine — imaging, connectivity, authentication, storage. Each team validates its own module in isolation, but an update to one module can silently invalidate a security assumption another module relies on, since patient data across the system needs to stay tightly secured.
Approach
1
Model the contracts
Capture the security-relevant assumptions each module makes about its neighbors — data formats, authentication boundaries, access scope.
2
Detect impact at update time
Build a method to identify, for any given code change, which of those modeled assumptions the change could affect.
3
Scope re-verification
Re-test only the modules genuinely at risk from an update, instead of retesting the entire software stack every time.
Status
Framing the research question and reviewing related work in cross-component security testing, drawing on approaches from medical-device regulatory practice, service-oriented architecture regression testing, and automotive ECU impact analysis.
Tools
CodeQL Semgrep NetworkX pydicom Syft CycloneDX