Encrypted Content Attribute
| Tag | (0400,0520) |
|---|---|
| Type | Required (1) |
| Keyword | EncryptedContent |
| Value Multiplicity | 1 |
| Value Representation | Other Byte String (OB) |
Encrypted data. See Section C.12.1.1.4.2.
Section C.12.1.1.4.2
C.12.1.1.4.2 Encrypted Content
Encrypted Content (0400,0520) contains an Enveloped-data content type of the cryptographic message syntax defined in RFC 2630. The encrypted content of the Enveloped-data content type is an instance of the Encrypted Attributes Data Set as shown in Table C.12-7 (i.e., it is a Sequence with a single Item), encoded with the Transfer Syntax specified by the Encrypted Content Transfer Syntax UID (0400,0510) Attribute. Figure C.12-2 shows an example of how the Encrypted Content is encoded. The exact use of this Data Set is defined in the Attribute Confidentiality Profiles in PS3.15.
Since the de-identified SOP Instance is a significantly altered version of the original Data Set, it is a new SOP Instance, with a SOP Instance UID that differs from the original Data Set.
Note
-
Content encryption may require that the content (the DICOM Data Set) be padded to a multiple of some block size. This shall be performed according to the Content-encryption Process defined in RFC-2630.
-
Any Standard or Private Transfer Syntax may be specified in Encrypted Content Transfer Syntax UID (0400,0510) unless encoding is performed in accordance with an Attribute Confidentiality Profile that specifies additional restrictions. In general, an application entity decoding the Encrypted Attributes Sequence may not assume any particular Transfer Syntax or set of Transfer Syntaxes to be used with Encrypted Content Transfer Syntax UID (0400,0510).
-
For certain applications it might be necessary to "blacken" (remove) identifying information that is burned in to the image pixel data. The Encrypted Attributes Data Set does not specify a means of restoring the original image information without the complete image pixel data being encoded inside the Modified Attributes Sequence (0400,0550). If access to the original, unmodified pixel data is required and the image pixel data cannot be replicated inside the Modified Attributes Sequence (0400,0550) due to resource considerations, the SOP Instance UID may be used to locate the original SOP Instance from which the de-identified version was derived.
-
There is no guarantee that the original SOP Instance can be reconstructed from the data in Encrypted Content. If access to the original data is required, the (de-encrypted) UIDs may be used to locate the original SOP Instance from which the de-identified version was derived.
Table C.12-7. Encrypted Attributes Data Set Attributes
|
Attribute Name |
Tag |
Type |
Attribute Description |
|---|---|---|---|
|
Modified Attributes Sequence |
(0400,0550) |
1 |
Sequence of Items containing all Attributes that were removed or replaced by "dummy values" in the top level Data Set during de-identification of the SOP Instance. Upon reversal of the de-identification process, the Attributes are copied back into the top level Data Set, replacing any dummy values that might have been created. Only a single Item shall be included in this Sequence. |
|
> Any Attribute from the top level Data Set that was modified or removed during the de-identification process. |
3 |
|
|
Figure C.12-2. Example of Encoding of Encrypted Attributes Data Set (Informative)