kcenon::pacs::security::anonymizer Class Reference

#include <anonymizer.h>

Collaboration diagram for kcenon::pacs::security::anonymizer:

Public Member Functions
	anonymizer (anonymization_profile profile=anonymization_profile::basic)
	Construct with a specific profile.
	anonymizer (const anonymizer &other)
	Copy constructor.
	anonymizer (anonymizer &&other) noexcept
	Move constructor.
auto	operator= (const anonymizer &other) -> anonymizer &
	Copy assignment.
auto	operator= (anonymizer &&other) noexcept -> anonymizer &
	Move assignment.
	~anonymizer ()=default
	Default destructor.
auto	anonymize (core::dicom_dataset &dataset) -> kcenon::common::Result< anonymization_report >
	Anonymize a DICOM dataset.
auto	anonymize_with_mapping (core::dicom_dataset &dataset, uid_mapping &mapping) -> kcenon::common::Result< anonymization_report >
	Anonymize with consistent UID mapping.
auto	get_profile () const noexcept -> anonymization_profile
	Get the current profile.
void	set_profile (anonymization_profile profile)
	Set a new profile.
void	set_private_tag_action (private_tag_action action)
	Set the action to take on private tags during anonymization.
auto	get_private_tag_action () const noexcept -> private_tag_action
	Get the current private tag action.
void	add_tag_action (core::dicom_tag tag, tag_action_config config)
	Add or override a tag action.
void	add_tag_actions (const std::map< core::dicom_tag, tag_action_config > &actions)
	Add multiple tag actions.
auto	remove_tag_action (core::dicom_tag tag) -> bool
	Remove a custom tag action (reverts to profile default)
void	clear_custom_actions ()
	Clear all custom tag actions.
auto	get_tag_action (core::dicom_tag tag) const -> tag_action_config
	Get the effective action for a tag.
void	set_date_offset (std::chrono::days offset)
	Set date offset for longitudinal consistency.
auto	get_date_offset () const noexcept -> std::optional< std::chrono::days >
	Get the current date offset.
void	clear_date_offset ()
	Clear the date offset (dates will be zeroed instead)
auto	set_encryption_key (std::span< const std::uint8_t > key) -> kcenon::common::VoidResult
	Set encryption key for encrypt actions.
auto	has_encryption_key () const noexcept -> bool
	Check if encryption is configured.
void	set_hash_salt (std::string salt)
	Set salt for hash operations.
auto	get_hash_salt () const -> std::optional< std::string >
	Get the current hash salt.
void	set_detailed_reporting (bool enable)
	Enable detailed action recording.
auto	is_detailed_reporting () const noexcept -> bool
	Check if detailed reporting is enabled.

Static Public Member Functions
static auto	generate_random_date_offset (std::chrono::days min_days=std::chrono::days{-365}, std::chrono::days max_days=std::chrono::days{365}) -> std::chrono::days
	Generate a random date offset.
static auto	get_profile_actions (anonymization_profile profile) -> std::map< core::dicom_tag, tag_action_config >
	Get tags to process for a given profile.
static auto	get_hipaa_identifier_tags () -> std::vector< core::dicom_tag >
	Get a list of HIPAA Safe Harbor identifier tags.
static auto	get_gdpr_personal_data_tags () -> std::vector< core::dicom_tag >
	Get a list of GDPR personal data tags.

Private Member Functions
auto	apply_action (core::dicom_dataset &dataset, core::dicom_tag tag, const tag_action_config &config, uid_mapping *mapping) -> tag_action_record
auto	shift_date (std::string_view date_string) const -> std::string
auto	hash_value (std::string_view value) const -> std::string
auto	encrypt_value (std::string_view value) const -> kcenon::common::Result< std::string >
void	initialize_profile_actions ()

Private Attributes
anonymization_profile	profile_
	Current anonymization profile.
std::map< core::dicom_tag, tag_action_config >	custom_actions_
	Custom tag actions (override profile defaults)
std::optional< std::chrono::days >	date_offset_
	Date offset for shifting.
std::vector< std::uint8_t >	encryption_key_
	Encryption key (if set)
std::optional< std::string >	hash_salt_
	Hash salt.
private_tag_action	private_tag_action_ {private_tag_action::keep}
	Action for private tags.
bool	detailed_reporting_ {false}
	Whether to include detailed action records in report.

Detailed Description

Definition at line 89 of file anonymizer.h.

Constructor & Destructor Documentation

anonymizer() [1/3]

kcenon::pacs::security::anonymizer::anonymizer ( anonymization_profile profile = anonymization_profile::basic )

explicit

Construct with a specific profile.

Parameters

profile

The anonymization profile to use

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 34 of file anonymizer.cpp.

    : profile_{profile} {
    initialize_profile_actions();
}

References initialize_profile_actions().

Here is the call graph for this function:

anonymizer() [2/3]

kcenon::pacs::security::anonymizer::anonymizer

(

const anonymizer &

other

)

Copy constructor.

Definition at line 39 of file anonymizer.cpp.

    : profile_{other.profile_}
    , custom_actions_{other.custom_actions_}
    , date_offset_{other.date_offset_}
    , encryption_key_{other.encryption_key_}
    , hash_salt_{other.hash_salt_}
    , private_tag_action_{other.private_tag_action_}
    , detailed_reporting_{other.detailed_reporting_} {}

anonymizer() [3/3]

kcenon::pacs::security::anonymizer::anonymizer ( anonymizer && other )

noexcept

Move constructor.

Definition at line 48 of file anonymizer.cpp.

    : profile_{other.profile_}
    , custom_actions_{std::move(other.custom_actions_)}
    , date_offset_{other.date_offset_}
    , encryption_key_{std::move(other.encryption_key_)}
    , hash_salt_{std::move(other.hash_salt_)}
    , private_tag_action_{other.private_tag_action_}
    , detailed_reporting_{other.detailed_reporting_} {}

References kcenon::pacs::security::other.

~anonymizer()

kcenon::pacs::security::anonymizer::~anonymizer ( )

default

Default destructor.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Member Function Documentation

add_tag_action()

void kcenon::pacs::security::anonymizer::add_tag_action	(	core::dicom_tag	tag,
		tag_action_config	config )

Add or override a tag action.

Sets a custom action for a specific tag, overriding the profile default.

Parameters

tag	The DICOM tag
config	The action configuration

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 211 of file anonymizer.cpp.

                                                                       {
    custom_actions_[tag] = std::move(config);
}

References custom_actions_.

add_tag_actions()

void kcenon::pacs::security::anonymizer::add_tag_actions

(

const std::map< core::dicom_tag, tag_action_config > &

actions

)

Add multiple tag actions.

Parameters

actions

Map of tags to action configurations

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 215 of file anonymizer.cpp.

  {
    for (const auto& [tag, config] : actions) {
        custom_actions_[tag] = config;
    }
}

References custom_actions_.

anonymize()

auto kcenon::pacs::security::anonymizer::anonymize ( core::dicom_dataset & dataset ) -> kcenon::common::Result<anonymization_report>

nodiscard

Anonymize a DICOM dataset.

Applies the configured profile and any custom tag actions to de-identify the dataset. The dataset is modified in place.

Parameters

dataset

The dataset to anonymize (modified in place)

Returns

Result containing the anonymization report

Note

UIDs are regenerated with new values (no mapping preserved). Use anonymize_with_mapping() for consistent UID handling.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 83 of file anonymizer.cpp.

                                                {
    uid_mapping temp_mapping;
    return anonymize_with_mapping(dataset, temp_mapping);
}

anonymize_with_mapping()

auto kcenon::pacs::security::anonymizer::anonymize_with_mapping ( core::dicom_dataset & dataset, uid_mapping & mapping ) -> kcenon::common::Result<anonymization_report>

nodiscard

Anonymize with consistent UID mapping.

Applies de-identification while maintaining consistent UID mappings across multiple datasets. This is essential for longitudinal studies and research linkage.

Parameters

dataset	The dataset to anonymize (modified in place)
mapping	UID mapping for consistent transformation

Returns

Result containing the anonymization report

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 89 of file anonymizer.cpp.

                                              {
    anonymization_report report;
    report.profile_name = std::string(to_string(profile_));
    report.date_offset = date_offset_;
    report.timestamp = std::chrono::system_clock::now();
 
    // Get profile actions
    auto profile_actions = get_profile_actions(profile_);
 
    // Merge with custom actions (custom takes precedence)
    for (const auto& [tag, config] : custom_actions_) {
        profile_actions[tag] = config;
    }
 
    // Process each tag in the profile
    for (const auto& [tag, config] : profile_actions) {
        if (!dataset.contains(tag)) {
            continue;
        }
 
        auto record = apply_action(dataset, tag, config, &mapping);
        report.total_tags_processed++;
 
        switch (config.action) {
            case tag_action::remove:
            case tag_action::remove_or_empty:
                if (record.success) {
                    report.tags_removed++;
                }
                break;
            case tag_action::empty:
                if (record.success) {
                    report.tags_emptied++;
                }
                break;
            case tag_action::replace:
                if (record.success) {
                    report.tags_replaced++;
                }
                break;
            case tag_action::replace_uid:
                if (record.success) {
                    report.uids_replaced++;
                }
                break;
            case tag_action::keep:
                report.tags_kept++;
                break;
            case tag_action::shift_date:
                if (record.success) {
                    report.dates_shifted++;
                }
                break;
            case tag_action::hash:
                if (record.success) {
                    report.values_hashed++;
                }
                break;
            case tag_action::encrypt:
                if (record.success) {
                    report.tags_replaced++;
                }
                break;
        }
 
        if (!record.success && !record.error_message.empty()) {
            report.errors.push_back(record.error_message);
        }
 
        if (detailed_reporting_) {
            report.action_records.push_back(std::move(record));
        }
    }
 
    // Remove private tags if configured
    if (private_tag_action_ != private_tag_action::keep) {
        std::vector<dicom_tag> tags_to_remove;
 
        for (auto it = dataset.begin(); it != dataset.end(); ++it) {
            auto tag = it->first;
            if (private_tag_action_ == private_tag_action::remove_all) {
                if (tag.is_private()) {
                    tags_to_remove.push_back(tag);
                }
            } else if (private_tag_action_ == private_tag_action::remove_data) {
                if (tag.is_private_data()) {
                    tags_to_remove.push_back(tag);
                }
            }
        }
 
        for (const auto& tag : tags_to_remove) {
            if (dataset.remove(tag)) {
                report.private_tags_removed++;
            }
        }
    }
 
    return report;
}

References kcenon::pacs::security::empty, kcenon::pacs::security::encrypt, kcenon::pacs::security::hash, kcenon::pacs::security::keep, kcenon::pacs::security::anonymization_report::profile_name, kcenon::pacs::security::remove, kcenon::pacs::security::remove_all, kcenon::pacs::security::remove_data, kcenon::pacs::security::remove_or_empty, kcenon::pacs::security::replace, kcenon::pacs::security::replace_uid, kcenon::pacs::security::report, kcenon::pacs::security::shift_date, and kcenon::pacs::security::to_string().

Here is the call graph for this function:

apply_action()

auto kcenon::pacs::security::anonymizer::apply_action ( core::dicom_dataset & dataset, core::dicom_tag tag, const tag_action_config & config, uid_mapping * mapping ) -> tag_action_record

nodiscardprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 471 of file anonymizer.cpp.

                       {
    tag_action_record record;
    record.tag = tag;
    record.action = config.action;
 
    auto* element = dataset.get(tag);
    if (element == nullptr) {
        record.success = false;
        record.error_message = "Tag not found in dataset";
        return record;
    }
 
    record.original_value = element->as_string().unwrap_or("");
 
    switch (config.action) {
        case tag_action::remove:
        case tag_action::remove_or_empty:
            record.success = dataset.remove(tag);
            break;
 
        case tag_action::empty:
            dataset.set_string(tag, element->vr(), "");
            record.new_value = "";
            record.success = true;
            break;
 
        case tag_action::keep:
            record.new_value = record.original_value;
            record.success = true;
            break;
 
        case tag_action::replace:
            dataset.set_string(tag, element->vr(), config.replacement_value);
            record.new_value = config.replacement_value;
            record.success = true;
            break;
 
        case tag_action::replace_uid:
            if (mapping != nullptr) {
                auto result = mapping->get_or_create(record.original_value);
                if (result.is_ok()) {
                    dataset.set_string(tag, element->vr(), result.value());
                    record.new_value = result.value();
                    record.success = true;
                } else {
                    record.success = false;
                    record.error_message = "Failed to create UID mapping";
                }
            } else {
                // Generate new UID without mapping
                uid_mapping temp;
                auto result = temp.get_or_create(record.original_value);
                if (result.is_ok()) {
                    dataset.set_string(tag, element->vr(), result.value());
                    record.new_value = result.value();
                    record.success = true;
                } else {
                    record.success = false;
                    record.error_message = "Failed to generate new UID";
                }
            }
            break;
 
        case tag_action::hash: {
            auto hashed = hash_value(record.original_value);
            if (hashed.empty()) {
                record.success = false;
                record.error_message = "Hash computation failed";
            } else {
                dataset.set_string(tag, element->vr(), hashed);
                record.new_value = hashed;
                record.success = true;
            }
            break;
        }
 
        case tag_action::encrypt: {
            auto result = encrypt_value(record.original_value);
            if (result.is_ok()) {
                dataset.set_string(tag, element->vr(), result.value());
                record.new_value = result.value();
                record.success = true;
            } else {
                record.success = false;
                record.error_message = result.error().message;
            }
            break;
        }
 
        case tag_action::shift_date: {
            if (date_offset_.has_value()) {
                auto shifted = shift_date(record.original_value);
                dataset.set_string(tag, element->vr(), shifted);
                record.new_value = shifted;
                record.success = true;
            } else {
                // No offset set - empty the date instead
                dataset.set_string(tag, element->vr(), "");
                record.new_value = "";
                record.success = true;
            }
            break;
        }
    }
 
    return record;
}

References kcenon::pacs::security::empty, kcenon::pacs::security::encrypt, kcenon::pacs::security::uid_mapping::get_or_create(), kcenon::pacs::security::hash, kcenon::pacs::security::keep, kcenon::pacs::security::remove, kcenon::pacs::security::remove_or_empty, kcenon::pacs::security::replace, kcenon::pacs::security::replace_uid, and kcenon::pacs::security::shift_date.

Here is the call graph for this function:

clear_custom_actions()

void kcenon::pacs::security::anonymizer::clear_custom_actions

(

)

Clear all custom tag actions.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 227 of file anonymizer.cpp.

                                      {
    custom_actions_.clear();
}

References custom_actions_.

clear_date_offset()

void kcenon::pacs::security::anonymizer::clear_date_offset

(

)

Clear the date offset (dates will be zeroed instead)

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 255 of file anonymizer.cpp.

                                   {
    date_offset_.reset();
}

References date_offset_.

encrypt_value()

auto kcenon::pacs::security::anonymizer::encrypt_value ( std::string_view value ) const -> kcenon::common::Result<std::string>

nodiscardprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 676 of file anonymizer.cpp.

                                     {
    if (encryption_key_.empty()) {
        return kcenon::common::make_error<std::string>(
            1, "No encryption key configured");
    }
 
#ifdef PACS_WITH_DIGITAL_SIGNATURES
    constexpr int iv_length = 12;
    constexpr int tag_length = 16;
 
    // Generate random IV
    std::array<unsigned char, iv_length> iv{};
    if (RAND_bytes(iv.data(), iv_length) != 1) {
        return kcenon::common::make_error<std::string>(
            2, "Failed to generate random IV");
    }
 
    // Create cipher context with RAII
    struct cipher_ctx_deleter {
        void operator()(EVP_CIPHER_CTX* c) const { EVP_CIPHER_CTX_free(c); }
    };
 
    std::unique_ptr<EVP_CIPHER_CTX, cipher_ctx_deleter> ctx(
        EVP_CIPHER_CTX_new());
    if (!ctx) {
        return kcenon::common::make_error<std::string>(
            3, "Failed to create cipher context");
    }
 
    // Initialize AES-256-GCM
    if (EVP_EncryptInit_ex(
            ctx.get(), EVP_aes_256_gcm(), nullptr, nullptr, nullptr)
        != 1) {
        return kcenon::common::make_error<std::string>(
            4, "Failed to initialize AES-256-GCM");
    }
 
    if (EVP_CIPHER_CTX_ctrl(
            ctx.get(), EVP_CTRL_GCM_SET_IVLEN, iv_length, nullptr)
        != 1) {
        return kcenon::common::make_error<std::string>(
            5, "Failed to set IV length");
    }
 
    if (EVP_EncryptInit_ex(ctx.get(), nullptr, nullptr,
                           encryption_key_.data(), iv.data())
        != 1) {
        return kcenon::common::make_error<std::string>(
            6, "Failed to set encryption key and IV");
    }
 
    // Encrypt
    std::vector<unsigned char> ciphertext(value.size() + EVP_MAX_BLOCK_LENGTH);
    int out_len = 0;
    if (EVP_EncryptUpdate(
            ctx.get(), ciphertext.data(), &out_len,
            reinterpret_cast<const unsigned char*>(value.data()),
            static_cast<int>(value.size()))
        != 1) {
        return kcenon::common::make_error<std::string>(
            7, "Encryption failed");
    }
    int ciphertext_len = out_len;
 
    // Finalize
    if (EVP_EncryptFinal_ex(
            ctx.get(), ciphertext.data() + out_len, &out_len)
        != 1) {
        return kcenon::common::make_error<std::string>(
            8, "Encryption finalization failed");
    }
    ciphertext_len += out_len;
 
    // Get authentication tag
    std::array<unsigned char, tag_length> tag{};
    if (EVP_CIPHER_CTX_ctrl(
            ctx.get(), EVP_CTRL_GCM_GET_TAG, tag_length, tag.data())
        != 1) {
        return kcenon::common::make_error<std::string>(
            9, "Failed to get authentication tag");
    }
 
    // Encode as hex: IV || ciphertext || tag
    std::ostringstream oss;
    oss << std::hex << std::setfill('0');
    for (int i = 0; i < iv_length; ++i) {
        oss << std::setw(2) << static_cast<int>(iv[i]);
    }
    for (int i = 0; i < ciphertext_len; ++i) {
        oss << std::setw(2) << static_cast<int>(ciphertext[i]);
    }
    for (int i = 0; i < tag_length; ++i) {
        oss << std::setw(2) << static_cast<int>(tag[i]);
    }
 
    return kcenon::common::Result<std::string>(oss.str());
#else
    (void)value;
    return kcenon::common::make_error<std::string>(
        1, "Encryption requires OpenSSL (build with PACS_WITH_DIGITAL_SIGNATURES)");
#endif
}

generate_random_date_offset()

auto kcenon::pacs::security::anonymizer::generate_random_date_offset ( std::chrono::days min_days = std::chrono::days{-365}, std::chrono::days max_days = std::chrono::days{365} ) -> std::chrono::days

staticnodiscard

Generate a random date offset.

Generates a random offset within the specified range.

Parameters

min_days	Minimum offset (days)
max_days	Maximum offset (days)

Returns

The generated offset

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 259 of file anonymizer.cpp.

                   {
    std::random_device rd;
    std::mt19937 gen(rd());
    std::uniform_int_distribution<int> dist(
        static_cast<int>(min_days.count()),
        static_cast<int>(max_days.count())
    );
    return std::chrono::days{dist(gen)};
}

get_date_offset()

auto kcenon::pacs::security::anonymizer::get_date_offset ( ) const -> std::optional<std::chrono::days>

nodiscardnoexcept

Get the current date offset.

Returns

Optional containing the offset, or nullopt if not set

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 250 of file anonymizer.cpp.

                                  {
    return date_offset_;
}

References date_offset_.

get_gdpr_personal_data_tags()

auto kcenon::pacs::security::anonymizer::get_gdpr_personal_data_tags ( ) -> std::vector<core::dicom_tag>

staticnodiscard

Get a list of GDPR personal data tags.

Returns

Vector of tags containing personal data per GDPR

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 448 of file anonymizer.cpp.

                                                                     {
    std::vector<dicom_tag> tags;
 
    // Direct identifiers
    tags.push_back(tags::patient_name);
    tags.push_back(tags::patient_id);
    tags.push_back(tags::patient_birth_date);
    tags.push_back(tags::patient_address);
 
    // Indirect identifiers
    tags.push_back(tags::study_instance_uid);
    tags.push_back(tags::series_instance_uid);
    tags.push_back(tags::sop_instance_uid);
 
    // Health data (special category under GDPR)
    tags.push_back(tags::patient_sex);
    tags.push_back(tags::patient_age);
    tags.push_back(tags::patient_size);
    tags.push_back(tags::patient_weight);
 
    return tags;
}

References kcenon::pacs::core::tags::patient_address, kcenon::pacs::core::tags::patient_age, kcenon::pacs::core::tags::patient_birth_date, kcenon::pacs::core::tags::patient_id, kcenon::pacs::core::tags::patient_name, kcenon::pacs::core::tags::patient_sex, kcenon::pacs::core::tags::patient_size, kcenon::pacs::core::tags::patient_weight, kcenon::pacs::core::tags::series_instance_uid, kcenon::pacs::core::tags::sop_instance_uid, and kcenon::pacs::core::tags::study_instance_uid.

get_hash_salt()

auto kcenon::pacs::security::anonymizer::get_hash_salt ( ) const -> std::optional<std::string>

nodiscard

Get the current hash salt.

Returns

Optional containing the salt, or nullopt if not set

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 291 of file anonymizer.cpp.

                                                               {
    return hash_salt_;
}

References hash_salt_.

get_hipaa_identifier_tags()

auto kcenon::pacs::security::anonymizer::get_hipaa_identifier_tags ( ) -> std::vector<core::dicom_tag>

staticnodiscard

Get a list of HIPAA Safe Harbor identifier tags.

Returns

Vector of tags that are HIPAA identifiers

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 444 of file anonymizer.cpp.

                                                                   {
    return hipaa_identifiers::get_all_identifier_tags();
}

References kcenon::pacs::security::hipaa_identifiers::get_all_identifier_tags().

Here is the call graph for this function:

get_private_tag_action()

auto kcenon::pacs::security::anonymizer::get_private_tag_action ( ) const -> private_tag_action

nodiscardnoexcept

Get the current private tag action.

Returns

The configured private tag action

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 206 of file anonymizer.cpp.

                          {
    return private_tag_action_;
}

References private_tag_action_.

get_profile()

auto kcenon::pacs::security::anonymizer::get_profile ( ) const -> anonymization_profile

nodiscardnoexcept

Get the current profile.

Returns

The anonymization profile being used

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 193 of file anonymizer.cpp.

                                                                     {
    return profile_;
}

References profile_.

get_profile_actions()

auto kcenon::pacs::security::anonymizer::get_profile_actions ( anonymization_profile profile ) -> std::map<core::dicom_tag, tag_action_config>

staticnodiscard

Get tags to process for a given profile.

Parameters

profile

The anonymization profile

Returns

Map of tags to their default actions

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 303 of file anonymizer.cpp.

                                            {
    std::map<dicom_tag, tag_action_config> actions;
 
    // Common patient identifiers
    auto add_patient_identifiers = [&actions]() {
        actions[tags::patient_name] = tag_action_config::make_replace("ANONYMOUS");
        actions[tags::patient_id] = tag_action_config::make_replace("ANON_ID");
        actions[tags::patient_birth_date] = tag_action_config::make_empty();
        actions[tags::patient_sex] = tag_action_config::make_keep();
        actions[tags::patient_age] = tag_action_config::make_remove();
        actions[tags::patient_address] = tag_action_config::make_remove();
        actions[tags::patient_comments] = tag_action_config::make_remove();
    };
 
    // Institution identifiers
    auto add_institution_identifiers = [&actions]() {
        actions[tags::institution_name] = tag_action_config::make_empty();
        actions[tags::institution_address] = tag_action_config::make_remove();
        actions[tags::station_name] = tag_action_config::make_empty();
    };
 
    // Personnel identifiers
    auto add_personnel_identifiers = [&actions]() {
        actions[tags::referring_physician_name] = tag_action_config::make_empty();
        actions[tags::performing_physician_name] = tag_action_config::make_empty();
        actions[tags::name_of_physicians_reading_study] = tag_action_config::make_empty();
        actions[tags::operators_name] = tag_action_config::make_empty();
        actions[tags::scheduled_performing_physician_name] = tag_action_config::make_empty();
    };
 
    // UID replacements
    auto add_uid_replacements = [&actions]() {
        actions[tags::study_instance_uid] =
            {.action = tag_action::replace_uid};
        actions[tags::series_instance_uid] =
            {.action = tag_action::replace_uid};
        actions[tags::sop_instance_uid] =
            {.action = tag_action::replace_uid};
        actions[tags::frame_of_reference_uid] =
            {.action = tag_action::replace_uid};
    };
 
    // Study identifiers
    auto add_study_identifiers = [&actions]() {
        actions[tags::accession_number] = tag_action_config::make_empty();
        actions[tags::study_id] = tag_action_config::make_replace("ANON_STUDY");
    };
 
    // Dates for shifting
    auto add_date_shifting = [&actions]() {
        actions[tags::study_date] = {.action = tag_action::shift_date};
        actions[tags::series_date] = {.action = tag_action::shift_date};
        actions[tags::acquisition_date] = {.action = tag_action::shift_date};
        actions[tags::content_date] = {.action = tag_action::shift_date};
        actions[tags::instance_creation_date] = {.action = tag_action::shift_date};
        actions[tags::patient_birth_date] = {.action = tag_action::shift_date};
    };
 
    switch (profile) {
        case anonymization_profile::basic:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            break;
 
        case anonymization_profile::clean_pixel:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            // Note: Pixel data cleaning requires image processing
            // which is not implemented in this basic version
            break;
 
        case anonymization_profile::clean_descriptions:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            actions[tags::study_description] = tag_action_config::make_empty();
            actions[tags::series_description] = tag_action_config::make_empty();
            break;
 
        case anonymization_profile::retain_longitudinal:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            add_date_shifting();
            break;
 
        case anonymization_profile::retain_patient_characteristics:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            // Keep demographic data
            actions[tags::patient_sex] = tag_action_config::make_keep();
            actions[tags::patient_age] = tag_action_config::make_keep();
            actions[tags::patient_size] = tag_action_config::make_keep();
            actions[tags::patient_weight] = tag_action_config::make_keep();
            break;
 
        case anonymization_profile::hipaa_safe_harbor:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            // Remove all HIPAA identifiers
            for (const auto& tag : get_hipaa_identifier_tags()) {
                if (actions.find(tag) == actions.end()) {
                    actions[tag] = tag_action_config::make_remove();
                }
            }
            // Dates - keep only year or remove
            actions[tags::patient_birth_date] = tag_action_config::make_remove();
            break;
 
        case anonymization_profile::gdpr_compliant:
            add_patient_identifiers();
            add_institution_identifiers();
            add_personnel_identifiers();
            add_uid_replacements();
            add_study_identifiers();
            // GDPR allows pseudonymization - use hash for linkage
            actions[tags::patient_id] = tag_action_config::make_hash();
            actions[tags::patient_name] = tag_action_config::make_hash();
            break;
    }
 
    return actions;
}

References kcenon::pacs::core::tags::accession_number, kcenon::pacs::core::tags::acquisition_date, kcenon::pacs::security::basic, kcenon::pacs::security::clean_descriptions, kcenon::pacs::security::clean_pixel, kcenon::pacs::core::tags::content_date, kcenon::pacs::core::tags::frame_of_reference_uid, kcenon::pacs::security::gdpr_compliant, kcenon::pacs::security::hipaa_safe_harbor, kcenon::pacs::core::tags::instance_creation_date, kcenon::pacs::core::tags::institution_address, kcenon::pacs::core::tags::institution_name, kcenon::pacs::security::tag_action_config::make_empty(), kcenon::pacs::security::tag_action_config::make_hash(), kcenon::pacs::security::tag_action_config::make_keep(), kcenon::pacs::security::tag_action_config::make_remove(), kcenon::pacs::security::tag_action_config::make_replace(), kcenon::pacs::core::tags::name_of_physicians_reading_study, kcenon::pacs::core::tags::operators_name, kcenon::pacs::core::tags::patient_address, kcenon::pacs::core::tags::patient_age, kcenon::pacs::core::tags::patient_birth_date, kcenon::pacs::core::tags::patient_comments, kcenon::pacs::core::tags::patient_id, kcenon::pacs::core::tags::patient_name, kcenon::pacs::core::tags::patient_sex, kcenon::pacs::core::tags::patient_size, kcenon::pacs::core::tags::patient_weight, kcenon::pacs::core::tags::performing_physician_name, kcenon::pacs::core::tags::referring_physician_name, kcenon::pacs::security::replace_uid, kcenon::pacs::security::retain_longitudinal, kcenon::pacs::security::retain_patient_characteristics, kcenon::pacs::core::tags::scheduled_performing_physician_name, kcenon::pacs::core::tags::series_date, kcenon::pacs::core::tags::series_description, kcenon::pacs::core::tags::series_instance_uid, kcenon::pacs::security::shift_date, kcenon::pacs::core::tags::sop_instance_uid, kcenon::pacs::core::tags::station_name, kcenon::pacs::core::tags::study_date, kcenon::pacs::core::tags::study_description, kcenon::pacs::core::tags::study_id, and kcenon::pacs::core::tags::study_instance_uid.

Here is the call graph for this function:

get_tag_action()

auto kcenon::pacs::security::anonymizer::get_tag_action ( core::dicom_tag tag ) const -> tag_action_config

nodiscard

Get the effective action for a tag.

Returns the custom action if set, otherwise the profile default.

Parameters

tag	The DICOM tag

Returns

The tag action configuration

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 231 of file anonymizer.cpp.

                                                                        {
    auto it = custom_actions_.find(tag);
    if (it != custom_actions_.end()) {
        return it->second;
    }
 
    auto profile_actions = get_profile_actions(profile_);
    auto profile_it = profile_actions.find(tag);
    if (profile_it != profile_actions.end()) {
        return profile_it->second;
    }
 
    return tag_action_config::make_keep();
}

References kcenon::pacs::security::tag_action_config::make_keep().

Here is the call graph for this function:

has_encryption_key()

auto kcenon::pacs::security::anonymizer::has_encryption_key ( ) const -> bool

nodiscardnoexcept

Check if encryption is configured.

Returns

true if an encryption key is set

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 283 of file anonymizer.cpp.

                                                           {
    return !encryption_key_.empty();
}

References encryption_key_.

hash_value()

auto kcenon::pacs::security::anonymizer::hash_value ( std::string_view value ) const -> std::string

nodiscardprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 632 of file anonymizer.cpp.

                                                                   {
    std::string to_hash = std::string(value);
 
    if (hash_salt_.has_value()) {
        to_hash = hash_salt_.value() + to_hash;
    }
 
#ifdef PACS_WITH_DIGITAL_SIGNATURES
    auto* ctx = EVP_MD_CTX_new();
    if (ctx == nullptr) {
        return {};
    }
 
    struct md_ctx_deleter {
        void operator()(EVP_MD_CTX* c) const { EVP_MD_CTX_free(c); }
    };
    std::unique_ptr<EVP_MD_CTX, md_ctx_deleter> ctx_guard(ctx);
 
    if (EVP_DigestInit_ex(ctx, EVP_sha256(), nullptr) != 1
        || EVP_DigestUpdate(ctx, to_hash.data(), to_hash.size()) != 1) {
        return {};
    }
 
    std::array<unsigned char, EVP_MAX_MD_SIZE> digest{};
    unsigned int digest_len = 0;
    if (EVP_DigestFinal_ex(ctx, digest.data(), &digest_len) != 1) {
        return {};
    }
 
    std::ostringstream oss;
    oss << std::hex << std::setfill('0');
    for (unsigned int i = 0; i < digest_len; ++i) {
        oss << std::setw(2) << static_cast<int>(digest[i]);
    }
    return oss.str();
#else
    // Non-cryptographic fallback when OpenSSL is unavailable
    auto hash = std::hash<std::string>{}(to_hash);
    std::ostringstream oss;
    oss << std::hex << std::setfill('0') << std::setw(16) << hash;
    return oss.str();
#endif
}

References kcenon::pacs::security::hash.

initialize_profile_actions()

void kcenon::pacs::security::anonymizer::initialize_profile_actions ( )

private

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 780 of file anonymizer.cpp.

                                            {
    // Profile actions are computed on-demand in get_profile_actions()
    // This method can be used for any initialization if needed
}

Referenced by anonymizer(), and set_profile().

Here is the caller graph for this function:

is_detailed_reporting()

auto kcenon::pacs::security::anonymizer::is_detailed_reporting ( ) const -> bool

nodiscardnoexcept

Check if detailed reporting is enabled.

Returns

true if detailed reporting is enabled

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 299 of file anonymizer.cpp.

                                                              {
    return detailed_reporting_;
}

References detailed_reporting_.

operator=() [1/2]

auto kcenon::pacs::security::anonymizer::operator= ( anonymizer && other ) -> anonymizer&

noexcept

Move assignment.

Definition at line 70 of file anonymizer.cpp.

                                                                     {
    if (this != &other) {
        profile_ = other.profile_;
        custom_actions_ = std::move(other.custom_actions_);
        date_offset_ = other.date_offset_;
        encryption_key_ = std::move(other.encryption_key_);
        hash_salt_ = std::move(other.hash_salt_);
        private_tag_action_ = other.private_tag_action_;
        detailed_reporting_ = other.detailed_reporting_;
    }
    return *this;
}

References kcenon::pacs::security::other.

operator=() [2/2]

auto kcenon::pacs::security::anonymizer::operator=

(

const anonymizer &

other

)

-> anonymizer&

Copy assignment.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 57 of file anonymizer.cpp.

                                                                 {
    if (this != &other) {
        profile_ = other.profile_;
        custom_actions_ = other.custom_actions_;
        date_offset_ = other.date_offset_;
        encryption_key_ = other.encryption_key_;
        hash_salt_ = other.hash_salt_;
        private_tag_action_ = other.private_tag_action_;
        detailed_reporting_ = other.detailed_reporting_;
    }
    return *this;
}

References kcenon::pacs::security::other.

remove_tag_action()

auto kcenon::pacs::security::anonymizer::remove_tag_action

(

core::dicom_tag

tag

)

-> bool

Remove a custom tag action (reverts to profile default)

Parameters

tag	The tag to remove custom action for

Returns

true if an action was removed

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 223 of file anonymizer.cpp.

                                                        {
    return custom_actions_.erase(tag) > 0;
}

set_date_offset()

void kcenon::pacs::security::anonymizer::set_date_offset

(

std::chrono::days

offset

)

Set date offset for longitudinal consistency.

All date/time values will be shifted by this offset, preserving temporal relationships while removing actual dates.

Parameters

offset

The number of days to shift (can be negative)

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 246 of file anonymizer.cpp.

                                                     {
    date_offset_ = offset;
}

References date_offset_.

set_detailed_reporting()

void kcenon::pacs::security::anonymizer::set_detailed_reporting

(

bool

enable

)

Enable detailed action recording.

When enabled, the anonymization report will include detailed records of each action performed.

Parameters

enable

true to enable detailed recording

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 295 of file anonymizer.cpp.

                                                   {
    detailed_reporting_ = enable;
}

References detailed_reporting_.

set_encryption_key()

auto kcenon::pacs::security::anonymizer::set_encryption_key ( std::span< const std::uint8_t > key ) -> kcenon::common::VoidResult

nodiscard

Set encryption key for encrypt actions.

Parameters

key	The encryption key (must be 32 bytes for AES-256)

Returns

Result indicating success or error

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 272 of file anonymizer.cpp.

                              {
    if (key.size() != 32) {
        return kcenon::common::make_error<std::monostate>(
            1, "Encryption key must be 32 bytes for AES-256", "anonymizer"
        );
    }
    encryption_key_.assign(key.begin(), key.end());
    return kcenon::common::ok();
}

set_hash_salt()

void kcenon::pacs::security::anonymizer::set_hash_salt

(

std::string

salt

)

Set salt for hash operations.

The salt is combined with values before hashing to prevent rainbow table attacks.

Parameters

salt	The salt value

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 287 of file anonymizer.cpp.

                                             {
    hash_salt_ = std::move(salt);
}

References hash_salt_.

set_private_tag_action()

void kcenon::pacs::security::anonymizer::set_private_tag_action

(

private_tag_action

action

)

Set the action to take on private tags during anonymization.

DICOM PS3.15 Annex E recommends removing private data elements during de-identification, as they may contain PHI in vendor-specific formats that cannot be reliably inspected.

Parameters

action

The private tag action

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 202 of file anonymizer.cpp.

                                                                 {
    private_tag_action_ = action;
}

References private_tag_action_.

set_profile()

void kcenon::pacs::security::anonymizer::set_profile

(

anonymization_profile

profile

)

Set a new profile.

Changes the anonymization profile. Custom tag actions are preserved.

Parameters

profile

The new profile to use

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 197 of file anonymizer.cpp.

                                                          {
    profile_ = profile;
    initialize_profile_actions();
}

References initialize_profile_actions(), and profile_.

Here is the call graph for this function:

shift_date()

auto kcenon::pacs::security::anonymizer::shift_date ( std::string_view date_string ) const -> std::string

nodiscardprivate

Definition at line 584 of file anonymizer.cpp.

                                                                         {
    if (date_string.empty() || !date_offset_.has_value()) {
        return "";
    }
 
    // Parse DICOM date format (YYYYMMDD)
    if (date_string.length() < 8) {
        return std::string(date_string);
    }
 
    try {
        int year = std::stoi(std::string(date_string.substr(0, 4)));
        int month = std::stoi(std::string(date_string.substr(4, 2)));
        int day = std::stoi(std::string(date_string.substr(6, 2)));
 
        // Create time point from date
        std::tm tm = {};
        tm.tm_year = year - 1900;
        tm.tm_mon = month - 1;
        tm.tm_mday = day;
 
        auto time_point = std::chrono::system_clock::from_time_t(std::mktime(&tm));
 
        // Apply offset
        time_point += date_offset_.value();
 
        // Convert back to date string
        auto shifted_time = std::chrono::system_clock::to_time_t(time_point);
        std::tm shifted_tm{};
#if defined(_WIN32)
        localtime_s(&shifted_tm, &shifted_time);
#else
        localtime_r(&shifted_time, &shifted_tm);
#endif
 
        std::ostringstream oss;
        oss << std::setfill('0')
            << std::setw(4) << (shifted_tm.tm_year + 1900)
            << std::setw(2) << (shifted_tm.tm_mon + 1)
            << std::setw(2) << shifted_tm.tm_mday;
 
        return oss.str();
 
    } catch (const std::exception&) {
        return std::string(date_string);
    }
}

Member Data Documentation

custom_actions_

std::map<core::dicom_tag, tag_action_config> kcenon::pacs::security::anonymizer::custom_actions_

private

Custom tag actions (override profile defaults)

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 377 of file anonymizer.h.

Referenced by add_tag_action(), add_tag_actions(), and clear_custom_actions().

date_offset_

std::optional<std::chrono::days> kcenon::pacs::security::anonymizer::date_offset_

private

Date offset for shifting.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 380 of file anonymizer.h.

Referenced by clear_date_offset(), get_date_offset(), and set_date_offset().

detailed_reporting_

bool kcenon::pacs::security::anonymizer::detailed_reporting_ {false}

private

Whether to include detailed action records in report.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 392 of file anonymizer.h.

{false};

Referenced by is_detailed_reporting(), and set_detailed_reporting().

encryption_key_

std::vector<std::uint8_t> kcenon::pacs::security::anonymizer::encryption_key_

private

Encryption key (if set)

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 383 of file anonymizer.h.

Referenced by has_encryption_key().

hash_salt_

std::optional<std::string> kcenon::pacs::security::anonymizer::hash_salt_

private

Hash salt.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 386 of file anonymizer.h.

Referenced by get_hash_salt(), and set_hash_salt().

private_tag_action_

private_tag_action kcenon::pacs::security::anonymizer::private_tag_action_ {private_tag_action::keep}

private

Action for private tags.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 389 of file anonymizer.h.

{private_tag_action::keep};

Referenced by get_private_tag_action(), and set_private_tag_action().

profile_

anonymization_profile kcenon::pacs::security::anonymizer::profile_

private

Current anonymization profile.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/anonymizer.h.

Definition at line 374 of file anonymizer.h.

Referenced by get_profile(), and set_profile().

---

The documentation for this class was generated from the following files:

• include/kcenon/pacs/security/anonymizer.h
• src/security/anonymizer.cpp