PS3.15

Table of Contents

Notice and Disclaimer

Foreword

1. Scope and Field of Application

1.1. Security Policies and Mechanisms

1.2. System Management Profiles

2. Normative References

Bibliography

3. Definitions

Glossary

4. Symbols and Abbreviations

5. Conventions

6. Security and System Management Profile Outlines

6.1. Secure Use Profiles

6.2. Secure Transport Connection Profiles

6.3. Digital Signature Profile

6.4. Media Storage Security Profiles

6.5. Network Address Management Profiles

6.6. Time Synchronization Profiles

6.7. Application Configuration Management Profiles

6.8. Audit Trail Profiles

6.9. Attribute Confidentiality Profiles

7. Configuration Profiles

7.1. Actors

7.2. Transactions

A. Secure Use Profiles (Normative)

A.1. Online Electronic Storage Secure Use Profile

A.1.1. SOP Instance Status

A.2. Basic Digital Signatures Secure Use Profile

A.3. Bit-preserving Digital Signatures Secure Use Profile

A.4. Basic SR Digital Signatures Secure Use Profile

A.5. Audit Trail Message Format Profile

A.5.1. DICOM Audit Message Schema

A.5.1.1. Audit Message Schema

A.5.1.2. Codes Used Within The Schema

A.5.1.2.1. Audit Source Type Code

A.5.1.2.2. Participant Object Type Code Role

A.5.1.2.3. Participant Object Data Life Cycle

A.5.1.2.4. Participant Object ID Type Code

A.5.2. General Message Format Conventions

A.5.2.1. UserID

A.5.2.2. AlternativeUserID

A.5.2.3. UserName

A.5.2.4. NetworkAccessPointTypeCode, NetworkAccessPointID

A.5.2.5. EventDateTime

A.5.2.6. ParticipantObjectTypeCodeRole

A.5.3. DICOM Specific Audit Messages

A.5.3.1. Application Activity

A.5.3.2. Audit Log Used

A.5.3.3. Begin Transferring DICOM Instances

A.5.3.4. Data Export

A.5.3.4.1. UserIsRequestor

A.5.3.5. Data Import

A.5.3.6. DICOM Instances Accessed

A.5.3.7. DICOM Instances Transferred

A.5.3.8. DICOM Study Deleted

A.5.3.9. Network Entry

A.5.3.10. Query

A.5.3.11. Security Alert

A.5.3.12. User Authentication

A.5.3.13. Order Record

A.5.3.14. Patient Record

A.5.3.15. Procedure Record

A.6. Audit Trail Message Transmission Profile - SYSLOG-TLS

A.7. Audit Trail Message Transmission Profile - SYSLOG-UDP

B. Secure Transport Connection Profiles (Normative)

B.1. Basic TLS Secure Transport Connection Profile

B.2. ISCL Secure Transport Connection Profile

B.3. AES TLS Secure Transport Connection Profile

B.4. Basic User Identity Association Profile

B.5. User Identity Plus Passcode Association Profile

B.6. Kerberos Identity Negotiation Association Profile

B.7. Generic SAML Assertion Identity Negotiation Association Profile

B.8. Secure Use of Email Transport

B.9. BCP 195 TLS Secure Transport Connection Profile

B.10. Non-Downgrading BCP 195 TLS Secure Transport Connection Profile

B.11. Extended BCP 195 TLS Profile Secure Transport Connection Profile

B.12. BCP 195 RFC 8996, 9325 TLS Secure Transport Connection Profile

B.13. Modified BCP 195 RFC 8996, 9325 TLS Secure Transport Connection Profile

C. Digital Signature Profiles (Normative)

C.1. Base RSA Digital Signature Profile

C.2. Creator RSA Digital Signature Profile

C.3. Authorization RSA Digital Signature Profile

C.4. Structured Report RSA Digital Signature Profile

D. Media Storage Security Profiles (Normative)

D.1. Basic DICOM Media Security Profile

D.1.1. Encapsulation of A DICOM File in a Secure DICOM File

E. Attribute Confidentiality Profiles (Normative)

E.1. Application Level Confidentiality Profile

E.1.1. De-identifier

E.1.2. Re-identifier

E.1.3. Conformance Requirements

E.2. Basic Application Level Confidentiality Profile

E.3. Basic Application Level Confidentiality Options

E.3.1. Clean Pixel Data Option

E.3.2. Clean Recognizable Visual Features Option

E.3.3. Clean Graphics Option

E.3.4. Clean Structured Content Option

E.3.5. Clean Descriptors Option

E.3.6. Retain Longitudinal Temporal Information Options

E.3.7. Retain Patient Characteristics Option

E.3.8. Retain Device Identity Option

E.3.9. Retain UIDs Option

E.3.10. Retain Safe Private Option

E.3.11. Retain Institution Identity Option

F. Network Address Management Profiles

F.1. Basic Network Address Management Profile

F.1.1. Resolve Hostname

F.1.1.1. Scope

F.1.1.2. Use Case Roles

F.1.1.3. Referenced Standards

F.1.1.4. DNS Security Considerations (Informative)

F.1.1.5. DNS Implementation Considerations (Informative)

F.1.1.6. Support For Service Discovery

F.1.2. Configure DHCPserver

F.1.2.1. Scope

F.1.2.2. Use Case Roles

F.1.2.3. Referenced Standards

F.1.3. Find and Use DHCP Server

F.1.3.1. Scope

F.1.3.2. Use Case Roles

F.1.3.3. Referenced Standards

F.1.3.4. Interaction Diagram

F.1.4. Maintain Lease

F.1.4.1. Scope

F.1.4.2. Use Case Roles

F.1.4.3. Referenced Standards

F.1.4.4. Normal Interaction

F.1.5. DDNS Coordination

F.1.5.1. Scope

F.1.5.2. Use Case Roles

F.1.5.3. Referenced Standards

F.1.5.4. Basic Course of Events

F.1.6. DHCP Security Considerations (Informative)

F.1.7. DHCP Implementation Considerations (Informative)

F.1.8. Conformance

G. Time Synchronization Profiles

G.1. Basic Time Synchronization Profile

G.1.1. Find NTP Servers

G.1.1.1. Scope

G.1.1.2. Use Case Roles

G.1.1.3. Referenced Standards

G.1.1.4. Basic Course of Events.

G.1.1.5. Alternative Paths

G.1.1.6. Assumptions

G.1.1.7. Postconditions

G.1.2. Maintain Time

G.1.2.1. Scope

G.1.2.2. Use Case Roles

G.1.2.3. Referenced Standards

G.1.2.4. Basic Course of Events.

G.1.3. NTP Security Considerations (Informative)

G.1.4. NTP Implementation Considerations (Informative)

G.1.5. Conformance

H. Application Configuration Management Profiles

H.1. Application Configuration Management Profile

H.1.1. Data Model Component Objects

H.1.1.1. Device

H.1.1.2. Network Application Entity

H.1.1.3. Network Connection

H.1.1.4. Transfer Capabilities

H.1.1.5. DICOM Configuration Root

H.1.1.6. Devices Root

H.1.1.7. Unique AE Titles Registry Root

H.1.1.8. Unique AE Title

H.1.2. Application Configuration Data Model Hierarchy

H.1.3. LDAP Schema For Objects and Attributes

H.1.4. Transactions

H.1.4.1. Find LDAP Server

H.1.4.1.1. Scope

H.1.4.1.2. Use Case Roles

H.1.4.1.3. Referenced Standards

H.1.4.1.4. Interaction Diagram

H.1.4.1.5. Alternative Paths

H.1.4.2. Query LDAP Server

H.1.4.2.1. Scope

H.1.4.2.2. Use Case Roles

H.1.4.2.3. Referenced Standards

H.1.4.2.4. Interaction Description

H.1.4.3. Update LDAP Server

H.1.4.3.1. Scope

H.1.4.3.2. Use Case Roles

H.1.4.3.3. Referenced Standards

H.1.4.3.4. Interaction Description

H.1.4.3.5. Special Update For Network AE Creation

H.1.4.4. Maintain LDAP Server

H.1.5. LDAP Security Considerations (Informative)

H.1.5.1. Threat Assessment

H.1.5.2. Available LDAP Security Mechanisms

H.1.5.3. Recommendations (Informative)

H.1.6. Implementation Considerations (Informative)

H.1.7. Conformance

H.2. DNS Service Discovery

H.2.1. Scope

H.2.2. Use Case Roles

H.2.3. Referenced Standards

H.2.4. Examples

H.2.5. Conformance