Use of Conquest as an anonymization system

  • Hi,


    this alternating behavior is a bug. I will fix it in 1.4.17d. Also the anonymized query will generate a SOPInstanceUID for a query where it is asked but not passed. This is incorrect behavior as well that blocks image queries this way - to be fixed in 1.4.17d. Also performance is not great for large query result sets. A specialized de-anonymizer without log will help.


    I will update the default scripts against missing items in queries.


    As for the web interface, the third query line in the web interface passes a wildcard, e.g., *name* which cannot be processed by the anonymization. I therefore think only the new lua scripted interface can be used this way if you take out 'wildcarding'.


    With this set of converters (in 1.4.17d), images are disk is anonymous while the data exchange is non-anonymous. However, not all data passes deanonymization so it will not behave totally as a normal PACS.


    ImportConverter0 = c:/dicomserver/lua/anonymize_script.lua
    QueryConverter0 = c:/dicomserver/lua/anonymize_script.lua
    RetrieveConverter0 = c:/dicomserver/lua/anonymize_script.lua
    QueryResultConverter0 = c:/dicomserver/lua/deanonymize_script.lua
    RetrieveResultConverter0 = c:/dicomserver/lua/deanonymize _script.lua


    Note that table UIDMODs keeps all the keys and should be treated confidentially.


    Marcel





    Marcel

  • Marcel


    Thanks for the newer version. It fixed the alternating responses in the GUI.


    I tried with the LUA version web interface but still no luck. It still doesn't respond to the anonymized query. Did you have success on your end?


    Thanks,
    Lucy


    Quote from marcelvanherk

    You can try it out with the preview version.


    Marcel

  • Hi,


    I did not try it, but if you look at the code, wherever it puts * on the search item it will not work, as e.g., *name* will not anonymize the same as "name". Other than that it must just work as the queries are executed by exactly the same code from conquest or the web interface (all processing occurs in the server).


    regards,


    Marcel

  • Hi Marcel


    I still couldn't get the web query by original ID/name work. Here is the link I generated when querying on the web:
    http://xxx.no-ip.biz/cgi-bin/d…entnamematch=MB_IVUS_CT_3


    Here is the log querying by the original ID in the GUI:

    Code
    [CONQUESTSRV1] UPACS THREAD 10447: STARTED AT: Thu May 29 17:51:19 2014[CONQUESTSRV1] A-ASSOCIATE-RQ Packet Dump[CONQUESTSRV1] Calling Application Title : "CONQUESTSRV1 "[CONQUESTSRV1] Called Application Title : "CONQUESTSRV1 "[CONQUESTSRV1] Application Context : "1.2.840.10008.3.1.1.1", PDU length: 16384[CONQUESTSRV1] Number of Proposed Presentation Contexts: 4[CONQUESTSRV1] Presentation Context 0 "1.2.840.10008.5.1.4.1.2.1.1" 1[CONQUESTSRV1] Presentation Context 1 "1.2.840.10008.5.1.4.1.2.2.1" 1[CONQUESTSRV1] Presentation Context 2 "1.2.840.10008.5.1.4.1.2.3.1" 1[CONQUESTSRV1] Presentation Context 3 "1.2.840.10008.5.1.4.31" 1[CONQUESTSRV1] Server Command := 0020[CONQUESTSRV1] Message ID := 0003[CONQUESTSRV1] 0000,0002 28 UI AffectedSOPClassUID "1.2.840.10008.5.1.4.1.2.1.1" [CONQUESTSRV1] 0000,0100 2 US CommandField 32 [CONQUESTSRV1] 0000,0110 2 US MessageID 3 [CONQUESTSRV1] 0000,0700 2 US Priority 0 [CONQUESTSRV1] 0000,0800 2 US DataSetType 258 [CONQUESTSRV1] 0002,0010 17 UI TransferSyntaxUID "1.2.840.10008.1.2" [CONQUESTSRV1] Importconverter0.0: dofile('c:/dicomserver/lua/anonymize_script.lua')[CONQUESTSRV1] Importconverter-1.0: mkdir DicomAnonymized_Log\MB_IVUS_CT_3\[CONQUESTSRV1] Importconverter-1.0 executes: newuids[CONQUESTSRV1] Importconverter-1.0 executes: set PatientBirthDate to "00000000"[CONQUESTSRV1] OldUID = MB_IVUS_CT_3, NewUID = PAT2833002889[CONQUESTSRV1] Importconverter-1.0 executes: set PatientID to "PAT2833002889"[CONQUESTSRV1] Importconverter-1.0 executes: set PatientBirthDate to ""[CONQUESTSRV1] OldUID = 2833002889.2771014250.bd.00000000, NewUID = 2833002889.2771014250.bd.[CONQUESTSRV1] Importconverter-1.0 executes: set PatientSex to ""[CONQUESTSRV1] OldUID = 2833002889.2771014250.ps.UN, NewUID = 2833002889.2771014250.ps.[CONQUESTSRV1] Importconverter-1.0 executes: set AccessionNumber to ""[CONQUESTSRV1] Importconverter-1.0 executes: set InstitutionName to ""[CONQUESTSRV1] Importconverter-1.0 executes: set ReferringPhysicianName to ""[CONQUESTSRV1] Importconverter-1.0 executes: set PerformingPhysicianName to ""[CONQUESTSRV1] Importconverter-1.0 executes: set StudyID to ""[CONQUESTSRV1] (PatientRootQuery) search level: PATIENT [CONQUESTSRV1] Query On Patient[CONQUESTSRV1] Queried item 0008 0050 is not in the database[CONQUESTSRV1] Queried item 0008 0080 is not in the database[CONQUESTSRV1] Queried item 0008 0090 is not in the database[CONQUESTSRV1] Queried item 0008 1050 is not in the database[CONQUESTSRV1] Queried item 0020 0010 is not in the database[CONQUESTSRV1] Issue Query on Columns: DICOMPatients.PatientNam, DICOMPatients.PatientID, DICOMPatients.PatientBir, DICOMPatients.PatientSex[CONQUESTSRV1] Values: DICOMPatients.PatientID = 'PAT2833002889'[CONQUESTSRV1] Tables: DICOMPatients[CONQUESTSRV1] Sorting (DICOMPatients.PatientNam) DoSort := 1[CONQUESTSRV1] Records = 1[CONQUESTSRV1] Importconverter0.0: dofile('c:/dicomserver/lua/deanonymize_script.lua')[CONQUESTSRV1] OldUID = MB_IVUS_CT_3, NewUID = PAT2833002889[CONQUESTSRV1] Importconverter-1.0: mkdir DicomAnonymized_Log\MB_IVUS_CT_3\[CONQUESTSRV1] Importconverter-1.0 executes: olduids[CONQUESTSRV1] OldUID = MB_IVUS_CT_3, NewUID = PAT2833002889[CONQUESTSRV1] Importconverter-1.0 executes: set PatientID to "MB_IVUS_CT_3"[CONQUESTSRV1] OldUID = MB_IVUS_CT_3, NewUID = PAT2833002889[CONQUESTSRV1] Importconverter-1.0 executes: set PatientName to "MB_IVUS_CT_3"[CONQUESTSRV1] C-Find (PatientRoot) located 1 records[CONQUESTSRV1] UPACS THREAD 10447: ENDED AT: Thu May 29 17:51:20 2014[CONQUESTSRV1] UPACS THREAD 10447: TOTAL RUNNING TIME: 1 SECONDS


    And here is the log querying on the web:


    It looks like the new UID generated are different.
    Thanks!
    Lucy


  • Hi,


    if you compare, the input data in the nh_ code is:


    ldUID = *MB_IVUS_CT_3*, NewUID = 1344572448.2771014250


    While for the GUI it is:


    ID = MB_IVUS_CT_3, NewUID = PAT2833002889


    without **. You will need to modify the nh_querypatients lua script that generates this page to exclude the **.


    For anonymization, *MB_IVUS_CT_3* is not the same as MB_IVUS_CT_3. In other words, if anonymization is ON, wildcard queries are not possible.


    Marcel

  • Thanks, Marcel.
    It solved my problem in querying the patient/study/series by removing "*" in all LUA files. However, now the thumbnails, wado and weasis display stopped working. When I click on each image, the server returned internal error as this:

    Code
    [CONQUESTSRV1] Importconverter0.0: dofile('c:/dicomserver/lua/anonymize_script.lua')
    [CONQUESTSRV1] *** lua run error c:/dicomserver/lua/anonymize_script.lua:61: bad argument #1 to 'gsub' (string expected, got nil) in 'dofile('c:/dicomserver/lua/anonymize_script.lua')'
    [CONQUESTSRV1] (QualifyOn) (mapped) IP:127.0.0.1, PORT:5678


    On the other hand to make things easy, can I just do the query on the real patient ID on the querypatient page and use anonymized on all other queries? How do I configure that?


    Thanks again for help!
    Lucy


  • Hi Lucy,


    look for line 61 in lua/anonymize_script.lua, it is:


    local pid = string.gsub(Data.PatientID, '[\\/:*?"<>|]', '_')


    change it with:


    local pid = string.gsub(Data.PatientID or 'unknown', '[\\/:*?"<>|]', '_')


    This might help. Added to bug list.


    Marcel

  • Hi Marcel


    Sorry it didn't solve the problem and keeps crushing the server?


    Thanks,
    Lucy


  • Hello,


    I have been using Conquest as a pseudonymization gateway between two PACS systems. The configuration works fine and I have pseudonymized copies of patients in a reserach PACS and if I push data from the research PACS to the main PACS, pseudonymization is removed and data is linked to the right patient. The problem is slowness of the "newuid"-process. Without pseudonymization data (a whole CT series) is tranferred very fast (in seconds), but with pseudonymization it takes 1-2s for each file.


    Is there anyting I could do to speed up the anonymization (newuids) process?


    Regerds,

    jsh

  • Hi,


    you can add joint indices to the uidmods table as follows:


    CREATE INDEX mods_joint ON UIDMODS (OldUID, Stage);

    CREATE INDEX mods_back ON UIDMODS (NewUID, Stage);


    this can be done from your sql server or from lua with the sql("") statement. This should accelerate the process significantly.


    Marcel

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!