DICOM Basics using Java - Secure Communications (TLS)

Introduction

This is part of my series of articles on the DICOM standard. In this tutorial, we'll explore DICOM secure communications using TLS (Transport Layer Security). Secure communications are essential for HIPAA compliance and protecting Protected Health Information (PHI) during network transmission.

DICOM TLS provides encryption, authentication, and data integrity verification for all DICOM network operations.

Prerequisites

Before you begin, ensure you have the following:

  • Java JDK installed (Java 8 or later)
  • PixelMed Java DICOM Toolkit
  • Understanding of basic DICOM networking concepts
  • You can find all the code demonstrated in this tutorial on GitHub here

“Dwell on the beauty of life. Watch the stars, and see yourself running with them.” ~ Marcus Aurelius

The Theory Behind TLS for Healthcare

Transport Layer Security (TLS) provides a secure channel over an insecure network. Understanding how TLS works helps in troubleshooting connection issues and making informed security decisions.

The TLS Handshake

Before any DICOM data flows, TLS establishes a secure channel through a handshake:

  1. ClientHello: Client sends supported TLS versions and cipher suites
  2. ServerHello: Server selects TLS version and cipher suite
  3. Certificate Exchange: Server (and optionally client) presents X.509 certificate
  4. Key Exchange: Client and server agree on session keys (using RSA or Diffie-Hellman)
  5. Finished: Both sides verify the handshake wasn't tampered with

After the handshake, all data is encrypted with symmetric encryption (AES) using the negotiated session keys.

Certificate Trust Models

TLS security depends on trusting the right certificates. Healthcare environments typically use one of:

  • Public CA Trust: Certificates from well-known CAs (DigiCert, Let's Encrypt). Simplest but less control.
  • Private PKI: Organization operates its own Certificate Authority. More control but more overhead.
  • Mutual TLS (mTLS): Both client and server present certificates. Strongest authentication but most complex.

HIPAA Technical Safeguards

HIPAA's Security Rule (45 CFR 164.312) requires "technical safeguards" for ePHI. While HIPAA is technology-neutral, TLS directly addresses several requirements:

  • §164.312(e)(1) Transmission Security: Protect ePHI during electronic transmission
  • §164.312(e)(2)(i) Integrity Controls: Ensure ePHI isn't improperly modified
  • §164.312(e)(2)(ii) Encryption: Implement encryption mechanism for transmission

Why TLS 1.2+ is Required

Older TLS/SSL versions have known vulnerabilities:

  • SSL 2.0/3.0: Fundamentally broken (POODLE, DROWN attacks)
  • TLS 1.0: BEAST attack, weak cipher suites
  • TLS 1.1: No known critical vulnerabilities but deprecated
  • TLS 1.2: Secure with proper cipher suite selection
  • TLS 1.3: Latest version with improved security and performance

DICOM's BCP 195 profile requires TLS 1.2 minimum with modern cipher suites (AES-GCM, ECDHE key exchange).

Why Use DICOM TLS?

  • HIPAA Compliance: Encrypt PHI in transit
  • Authentication: Verify identity of communication partners
  • Data Integrity: Detect tampering during transmission
  • Privacy: Prevent eavesdropping on medical data

DICOM TLS Ports

PortDescription
2761DICOM ISCL (Integrated Secure Communication Layer - retired)
2762DICOM TLS
CustomSite-specific TLS ports

Certificate Requirements

Server Certificate:

  • X.509 certificate for the DICOM server
  • Should be signed by a trusted CA
  • Common Name should match hostname

Client Certificate (for mutual auth):

  • X.509 certificate for the client
  • Required if server demands client authentication
  • Common Name often set to AE Title

Trust Store:

  • Contains CA certificates to trust
  • May include root CAs and intermediate CAs

TLS Connection Example

package com.saravanansubramanian.dicom.pixelmedtutorial;

import java.io.FileInputStream;
import java.security.KeyStore;
import java.util.LinkedList;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;

import com.pixelmed.dicom.TransferSyntax;
import com.pixelmed.network.Association;
import com.pixelmed.network.AssociationFactory;
import com.pixelmed.network.PresentationContext;

public class DicomTlsConnectionDemo {

    public static void main(String[] args) {

        try {

            System.out.println("=== DICOM TLS Connection Demo ===\n");

            // TLS Configuration
            String keystorePath = "C:\\path\\to\\keystore.jks";
            String keystorePassword = "changeit";
            String truststorePath = "C:\\path\\to\\truststore.jks";
            String truststorePassword = "changeit";

            // Remote server (must support TLS)
            String remoteHost = "localhost";
            int remotePort = 2762; // Common DICOM TLS port
            String remoteAETitle = "SECURE_PACS";
            String localAETitle = "SECURE_CLIENT";

            System.out.println("Setting up TLS context...");

            // Load keystore (contains our private key and certificate)
            KeyStore keyStore = KeyStore.getInstance("JKS");
            try (FileInputStream keyStoreStream = new FileInputStream(keystorePath)) {
                keyStore.load(keyStoreStream, keystorePassword.toCharArray());
            }

            // Load truststore (contains CA certificates we trust)
            KeyStore trustStore = KeyStore.getInstance("JKS");
            try (FileInputStream trustStoreStream = new FileInputStream(truststorePath)) {
                trustStore.load(trustStoreStream, truststorePassword.toCharArray());
            }

            // Initialize key manager
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(
                KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(keyStore, keystorePassword.toCharArray());

            // Initialize trust manager
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(trustStore);

            // Create SSL context
            SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
            sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

            System.out.println("TLS context initialized with TLSv1.2");

            // Build presentation contexts for C-ECHO
            LinkedList<PresentationContext> presentationContexts = new LinkedList<>();
            presentationContexts.add(new PresentationContext(
                (byte) 0x01,
                "1.2.840.10008.1.1", // Verification SOP Class
                TransferSyntax.ImplicitVRLittleEndian
            ));

            // Create secure association
            Association association = AssociationFactory.createNewAssociation(
                remoteHost,
                remotePort,
                remoteAETitle,
                localAETitle,
                presentationContexts,
                null,  // user identity
                true,  // secure = true for TLS
                sslContext,
                0,     // timeout
                0      // pdu timeout
            );

            if (association != null) {
                System.out.println("Secure association established!");
                // Perform DICOM operations...
                association.release();
            }

        } catch (Exception e) {
            e.printStackTrace(System.err);
        }
    }
}

Creating Test Certificates

# Generate a self-signed certificate
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 \
  -validity 365 -keystore keystore.jks -storepass changeit \
  -dname "CN=localhost, OU=Radiology, O=Hospital, L=City, ST=State, C=US"

# Export the certificate
keytool -exportcert -alias mykey -keystore keystore.jks \
  -file mycert.cer -storepass changeit

# Import into trust store
keytool -importcert -alias mykey -file mycert.cer \
  -keystore truststore.jks -storepass changeit

DICOM TLS Connection Profiles

Basic TLS Secure Transport:

  • TLS 1.0 or higher
  • RSA key exchange
  • Originally mandated 3DES (TLS_RSA_WITH_3DES_EDE_CBC_SHA), with AES cipher suites added in subsequent editions of the standard

AES TLS Secure Transport:

  • TLS 1.0 or higher
  • AES-128 or AES-256 encryption
  • Recommended for new implementations

BCP 195 TLS Profile:

  • TLS 1.2 or higher
  • Modern cipher suites
  • ECDHE key exchange preferred
  • AES-GCM encryption

Java TLS Configuration

System Properties:

-Djavax.net.ssl.keyStore=keystore.jks
-Djavax.net.ssl.keyStorePassword=changeit
-Djavax.net.ssl.trustStore=truststore.jks
-Djavax.net.ssl.trustStorePassword=changeit

Enable TLS Debugging:

-Djavax.net.debug=ssl:handshake

Troubleshooting

IssueSolution
Certificate not trustedAdd CA to truststore
Hostname mismatchCN must match server hostname
Cipher suite mismatchEnable compatible cipher suites
Certificate expiredRenew certificate
Protocol version mismatchEnsure TLS versions match

Conclusion

DICOM TLS provides essential security for protecting patient health information during network transmission. Implementing TLS is critical for HIPAA compliance and should be standard practice for any DICOM deployment handling sensitive medical data.

Understanding certificate management, TLS profiles, and Java's SSL/TLS APIs is essential for building secure DICOM applications. In the next tutorial in this series, I will cover DICOM Encapsulated Documents for storing PDFs and other documents in PACS. See you then!