atna_audit_logger.h

Go to the documentation of this file.

 
#ifndef PACS_SECURITY_ATNA_AUDIT_LOGGER_HPP
#define PACS_SECURITY_ATNA_AUDIT_LOGGER_HPP
 
#include <chrono>
#include <cstdint>
#include <string>
#include <vector>
 
namespace kcenon::pacs::security {
 
// =============================================================================
// RFC 3881 Coded Value
// =============================================================================
 
struct atna_coded_value {
    std::string code;
 
    std::string code_system_name;
 
    std::string display_name;
};
 
// =============================================================================
// Event Action Code (RFC 3881 Section 5.1)
// =============================================================================
 
enum class atna_event_action : char {
    create = 'C',
    read = 'R',
    update = 'U',
    delete_action = 'D',
    execute = 'E'
};
 
// =============================================================================
// Event Outcome Indicator (RFC 3881 Section 5.1)
// =============================================================================
 
enum class atna_event_outcome : uint8_t {
    success = 0,
    minor_failure = 4,
    serious_failure = 8,
    major_failure = 12
};
 
// =============================================================================
// Network Access Point Type Code (RFC 3881 Section 5.2)
// =============================================================================
 
enum class atna_network_access_type : uint8_t {
    machine_name = 1,
    ip_address = 2,
    phone_number = 3
};
 
// =============================================================================
// Participant Object Type Code (RFC 3881 Section 5.5)
// =============================================================================
 
enum class atna_object_type : uint8_t {
    person = 1,
    system_object = 2,
    organization = 3,
    other = 4
};
 
enum class atna_object_role : uint8_t {
    patient = 1,
    location = 2,
    report = 3,
    resource = 4,
    master_file = 5,
    user = 6,
    list = 7,
    doctor = 8,
    subscriber = 9,
    guarantor = 10,
    security_user_entity = 11,
    security_user_group = 12,
    security_resource = 13,
    security_granularity_def = 14,
    provider = 15,
    data_destination = 16,
    data_repository = 17,
    schedule = 18,
    customer = 19,
    job = 20,
    job_stream = 21,
    table = 22,
    routing_criteria = 23,
    query = 24
};
 
// =============================================================================
// Active Participant (RFC 3881 Section 5.2)
// =============================================================================
 
struct atna_active_participant {
    std::string user_id;
 
    std::string alternative_user_id;
 
    std::string user_name;
 
    bool user_is_requestor{false};
 
    std::string network_access_point_id;
 
    atna_network_access_type network_access_point_type{
        atna_network_access_type::ip_address};
 
    std::vector<atna_coded_value> role_id_codes;
};
 
// =============================================================================
// Audit Source Identification (RFC 3881 Section 5.4)
// =============================================================================
 
struct atna_audit_source {
    std::string audit_source_id;
 
    std::string audit_enterprise_site_id;
 
    std::vector<uint8_t> audit_source_type_codes;
};
 
// =============================================================================
// Participant Object Detail (RFC 3881 Section 5.5)
// =============================================================================
 
struct atna_object_detail {
    std::string type;
 
    std::string value;
};
 
// =============================================================================
// Participant Object Identification (RFC 3881 Section 5.5)
// =============================================================================
 
struct atna_participant_object {
    atna_object_type object_type{atna_object_type::system_object};
 
    atna_object_role object_role{atna_object_role::resource};
 
    atna_coded_value object_id_type_code;
 
    std::string object_id;
 
    std::string object_name;
 
    std::string object_query;
 
    std::vector<atna_object_detail> object_details;
};
 
// =============================================================================
// Audit Message (RFC 3881 Section 5)
// =============================================================================
 
struct atna_audit_message {
    // -- Event Identification --
 
    atna_coded_value event_id;
 
    std::vector<atna_coded_value> event_type_codes;
 
    atna_event_action event_action{atna_event_action::execute};
 
    std::chrono::system_clock::time_point event_date_time;
 
    atna_event_outcome event_outcome{atna_event_outcome::success};
 
    // -- Participants --
 
    std::vector<atna_active_participant> active_participants;
 
    atna_audit_source audit_source;
 
    std::vector<atna_participant_object> participant_objects;
};
 
// =============================================================================
// Well-Known DCM Event IDs (DICOM PS3.15 A.5.3)
// =============================================================================
 
namespace atna_event_ids {
 
inline const atna_coded_value application_activity{
    "110100", "DCM", "Application Activity"};
 
inline const atna_coded_value audit_log_used{
    "110101", "DCM", "Audit Log Used"};
 
inline const atna_coded_value begin_transferring{
    "110102", "DCM", "Begin Transferring DICOM Instances"};
 
inline const atna_coded_value dicom_instances_accessed{
    "110103", "DCM", "DICOM Instances Accessed"};
 
inline const atna_coded_value dicom_instances_transferred{
    "110104", "DCM", "DICOM Instances Transferred"};
 
inline const atna_coded_value dicom_study_deleted{
    "110105", "DCM", "DICOM Study Deleted"};
 
inline const atna_coded_value data_export{
    "110106", "DCM", "Export"};
 
inline const atna_coded_value data_import{
    "110107", "DCM", "Import"};
 
inline const atna_coded_value network_entry{
    "110108", "DCM", "Network Entry"};
 
inline const atna_coded_value order_record{
    "110109", "DCM", "Order Record"};
 
inline const atna_coded_value patient_record{
    "110110", "DCM", "Patient Record"};
 
inline const atna_coded_value procedure_record{
    "110111", "DCM", "Procedure Record"};
 
inline const atna_coded_value query{
    "110112", "DCM", "Query"};
 
inline const atna_coded_value security_alert{
    "110113", "DCM", "Security Alert"};
 
inline const atna_coded_value user_authentication{
    "110114", "DCM", "User Authentication"};
 
}  // namespace atna_event_ids
 
// =============================================================================
// Well-Known Event Type Codes
// =============================================================================
 
namespace atna_event_types {
 
inline const atna_coded_value application_start{
    "110120", "DCM", "Application Start"};
 
inline const atna_coded_value application_stop{
    "110121", "DCM", "Application Stop"};
 
inline const atna_coded_value login{
    "110122", "DCM", "Login"};
 
inline const atna_coded_value logout{
    "110123", "DCM", "Logout"};
 
}  // namespace atna_event_types
 
// =============================================================================
// Well-Known Role ID Codes
// =============================================================================
 
namespace atna_role_ids {
 
inline const atna_coded_value application{
    "110150", "DCM", "Application"};
 
inline const atna_coded_value application_launcher{
    "110151", "DCM", "Application Launcher"};
 
inline const atna_coded_value destination{
    "110152", "DCM", "Destination Role ID"};
 
inline const atna_coded_value source{
    "110153", "DCM", "Source Role ID"};
 
inline const atna_coded_value destination_media{
    "110154", "DCM", "Destination Media"};
 
inline const atna_coded_value source_media{
    "110155", "DCM", "Source Media"};
 
}  // namespace atna_role_ids
 
// =============================================================================
// Well-Known Participant Object ID Type Codes
// =============================================================================
 
namespace atna_object_id_types {
 
inline const atna_coded_value patient_number{
    "2", "RFC-3881", "Patient Number"};
 
inline const atna_coded_value study_instance_uid{
    "110180", "DCM", "Study Instance UID"};
 
inline const atna_coded_value sop_class_uid{
    "110181", "DCM", "SOP Class UID"};
 
inline const atna_coded_value node_id{
    "110182", "DCM", "Node ID"};
 
}  // namespace atna_object_id_types
 
// =============================================================================
// ATNA Audit Logger
// =============================================================================
 
class atna_audit_logger {
public:
    // =========================================================================
    // XML Generation
    // =========================================================================
 
    [[nodiscard]] static std::string to_xml(const atna_audit_message& message);
 
    // =========================================================================
    // Event Factory Methods
    // =========================================================================
 
    [[nodiscard]] static atna_audit_message build_application_activity(
        const std::string& source_id,
        const std::string& app_name,
        bool is_start,
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_dicom_instances_accessed(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        const std::string& study_uid,
        const std::string& patient_id = "",
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_dicom_instances_transferred(
        const std::string& source_id,
        const std::string& source_ae,
        const std::string& source_ip,
        const std::string& dest_ae,
        const std::string& dest_ip,
        const std::string& study_uid,
        const std::string& patient_id = "",
        bool is_import = true,
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_study_deleted(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        const std::string& study_uid,
        const std::string& patient_id = "",
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_security_alert(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        const std::string& alert_description,
        atna_event_outcome outcome = atna_event_outcome::serious_failure);
 
    [[nodiscard]] static atna_audit_message build_user_authentication(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        bool is_login,
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_query(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        const std::string& query_data,
        const std::string& patient_id = "",
        atna_event_outcome outcome = atna_event_outcome::success);
 
    [[nodiscard]] static atna_audit_message build_export(
        const std::string& source_id,
        const std::string& user_id,
        const std::string& user_ip,
        const std::string& dest_id,
        const std::string& study_uid,
        const std::string& patient_id = "",
        atna_event_outcome outcome = atna_event_outcome::success);
 
private:
    // =========================================================================
    // XML Helpers
    // =========================================================================
 
    [[nodiscard]] static std::string xml_escape(const std::string& str);
 
    [[nodiscard]] static std::string format_datetime(
        std::chrono::system_clock::time_point tp);
 
    [[nodiscard]] static std::string format_coded_value_attrs(
        const atna_coded_value& cv);
};
 
}  // namespace kcenon::pacs::security
 
#endif  // PACS_SECURITY_ATNA_AUDIT_LOGGER_HPP