DICOM Security Andrei Leontiev, M.S. Dynamic Imaging

April 1, 2005DICOM Seminar – Singapore 2005 Security Profiles Secure Transport Connection Secure Transport Connection –DICOM over TLS Secure Media Secure Media –Secured DICOM files on media Secure Use Secure Use –Use of Digital Signatures Confidentiality Confidentiality –De-idedntification and re-identification

Secure Transport DICOM over TLS

April 1, 2005DICOM Seminar – Singapore 2005 Key Use Case How can an application know that: How can an application know that: –Association Request comes from an authorized node? –Data are not tempered with during transfer? –Data were protected from third-party?

April 1, 2005DICOM Seminar – Singapore 2005 Contents Addresses following Security aspects: Addresses following Security aspects: –Entity (node) Authentication –Data Integrity –Privacy Allows to establish secure transport connection between nodes Allows to establish secure transport connection between nodes –Via TLS negotiation –Via ISCL negotiation Three secure transport profiles Three secure transport profiles

April 1, 2005DICOM Seminar – Singapore 2005 TLS Secure Transport Profile Node Authentication Node Authentication –RSA Certificates Data Integrity Data Integrity –SHA Privacy (Encryption) Privacy (Encryption) –3DES CBC - optional

April 1, 2005DICOM Seminar – Singapore 2005 AES Profile Similar to TLS Basic Profile Similar to TLS Basic Profile Requires use of AES Encryption Requires use of AES Encryption Requires requestor tosupport fallback to 3DES Requires requestor tosupport fallback to 3DES

April 1, 2005DICOM Seminar – Singapore 2005 ISCL Secure Transport Profile Node Authentication Node Authentication –Three pass (four-way) authentication (ISO/IEC ) Data Integrity Data Integrity –MD-5 encrypted with DES, or DES-MAC (ISO 8730) Privacy (Encryption) Privacy (Encryption) –DES - optional

Secure Media

April 1, 2005DICOM Seminar – Singapore 2005 Key Use Case How can an application know that information in DICOM file on the media: How can an application know that information in DICOM file on the media: –Has not been tempered with? –Is protected from unauthorized access? –is produced by an authorized source?

April 1, 2005DICOM Seminar – Singapore 2005 Contents Addresses following Security aspects: Addresses following Security aspects: –Source Authentication (optional) –Data Integrity –Privacy Secures each File in DICOM File-Set single DICOM File by encapsulating its content with the Cryptographic Message Syntax as defined in RFC 2630 Secures each File in DICOM File-Set single DICOM File by encapsulating its content with the Cryptographic Message Syntax as defined in RFC 2630 Does not additionally secure File-Set or Media itself Does not additionally secure File-Set or Media itself

April 1, 2005DICOM Seminar – Singapore 2005 Secure Media Profile Source Authentication Source Authentication –RSA Digital Signature Data Integrity Data Integrity –SHA Digest Privacy (Encryption) Privacy (Encryption) –3DES or AES

Secure Use and Digital Signatures

April 1, 2005DICOM Seminar – Singapore 2005 Key Use Case How can an application know that an object it received: How can an application know that an object it received: –Is an Original or a Copy? –Has been authorized and by whom? –Has not been tampered with?

April 1, 2005DICOM Seminar – Singapore 2005 Contents Addresses following Security aspects: Addresses following Security aspects: –Source Authentication –Data Integrity Provides mechanisms to calculate Digital Signature for Object content and include it as part of an Object Provides mechanisms to calculate Digital Signature for Object content and include it as part of an Object Allows explicit distinction of Original and a Copy of a SOP Instance with the same UID Allows explicit distinction of Original and a Copy of a SOP Instance with the same UID

April 1, 2005DICOM Seminar – Singapore 2005 Secure Use Profile Allows AEs to negotiate support of the Secure Use Profile Allows AEs to negotiate support of the Secure Use Profile –Extended Negotiation of Digital Signature Level Sets the management rules of Instance Status attribute Sets the management rules of Instance Status attribute –Original, Authorized Original, Authorized Copy Rules assuring that only one Original of SOP Instance exists in the system Rules assuring that only one Original of SOP Instance exists in the system –MOVE and COPY semantics for Storage Service

April 1, 2005DICOM Seminar – Singapore 2005 Secure Use Profile Three Level of Digital Signature Support Three Level of Digital Signature Support –No preservation –Non-bit preserving –Bit-Preserving Requires Level 2 (Full) Storage Support Requires Level 2 (Full) Storage Support

April 1, 2005DICOM Seminar – Singapore 2005 Secure Use Profile Secure Use Profile Three Level of Digital Signature Support Three Level of Digital Signature Support –No preservation –Non-bit preserving –Bit-Preserving Requires Level 2 (Full) Storage Support Requires Level 2 (Full) Storage Support

Attribute Confidentiality Profile

April 1, 2005DICOM Seminar – Singapore 2005 Key Use Case How can an application know that an object it received: How can an application know that an object it received: –Does not have any personal protected information (identifiers)? –Provides authorized application to restore identifying information?

April 1, 2005DICOM Seminar – Singapore 2005 Contents Addresses following Security aspects: Addresses following Security aspects: –Data Confidentiality Provides mechanisms to de-identify SOP Instance and preserve original data within SOP Instance in protected (encrypted) envelope Provides mechanisms to de-identify SOP Instance and preserve original data within SOP Instance in protected (encrypted) envelope

April 1, 2005DICOM Seminar – Singapore 2005 Attribute Confidentiality Profile Application can comply as Application can comply as –De-identifier –Re-identifier De-identifier De-identifier –Replaces confidential data with “dummy” values preserving validity of the SOP –Optionally encrypts original data and includes encrypted bit-stream as an attribute in the object (3DES or AES) –Profile defines list of attributes to replace

April 1, 2005DICOM Seminar – Singapore 2005 Attribute NameTag Instance Creator UID(0008,0014) SOP Instance UID(0008,0018) Accession Number(0008,0050) Institution Name(0008,0080) Institution Address(0008,0081) Referring Physician’s Name(0008,0090) Referring Physician’s Address(0008,0092) Referring Physician’s Telephone Numbers(0008,0094) Station Name(0008,1010) … MORE ATTRIBUTES ARE DEFINED…

April 1, 2005DICOM Seminar – Singapore 2005 Attribute Confidentiality Profile Re-identifier –If possessing valid keys, de-crypts original values –Restores original values of attributes tht were de-identified –Profile defines list of attributes to replace

Questions?