DICOM Conformance Statement¶
This statement describes the DICOM capabilities of the Unomed Cloud Connector. It follows the intent of PS3.2 but is deliberately condensed. The Cloud Connector is a network SCP that accepts DIMSE associations from on-site equipment and bridges them to the Unomed cloud.
Network Services¶
| Service | SOP Class | Role |
|---|---|---|
| Verification | Verification | SCP |
| Storage | 212 standard Storage SOP Classes | SCP |
| Query/Retrieve — Find | Study / Patient / Patient-Study Root | SCP |
| Query/Retrieve — Get | Study / Patient / Patient-Study Root | SCP (+ Storage SCP for sub-operations) |
| Query/Retrieve — Move | Study / Patient / Patient-Study Root | SCP (+ Storage SCU for sub-operations) |
| Modality Worklist | Modality Worklist Information Model — Find | SCP |
| Modality Performed Procedure Step | MPPS | SCP |
| Unified Procedure Step | UPS Push / Pull / Watch | SCP |
Association Establishment¶
| Parameter | Behaviour |
|---|---|
| Responding AE Title | The connector's configured AE title (assigned per deployment). Configure this as the destination AE title on the modality. |
| Calling AE Title | Validated by the Unomed cloud. The calling AE title must be registered and enabled for the tenant, and must hold the permission for the requested service (Storage, Worklist query, or MPPS). An unregistered, disabled, or unauthorized AE title is rejected and the association fails. |
| Maximum PDU size (receive) | 64 MiB by default. The requesting SCU's advertised maximum is honoured for transmitted PDUs. |
| Concurrent associations | Not limited by the application; each connection is handled independently. |
| User Identity Negotiation | Not supported. DIMSE associations carry no username/passcode. |
| Asynchronous operations | Not negotiated (single outstanding operation per association). |
Calling AE Title provisioning
Each modality's calling AE title must be provisioned by Unomed with the permissions it needs (store, query worklist, report procedure steps) before the modality is commissioned. An AE title that is not registered, is disabled, or lacks the required permission is rejected by the cloud and the association fails.
Only the abstract syntaxes listed below are accepted — the connector does not accept unproposed/unknown presentation contexts.
SCU/SCP Role Selection¶
The connector honours SCP/SCU role-selection negotiation, echoing the roles proposed by the requestor. This is required for C-GET: an SCU that proposes Storage SOP Classes with the connector as Storage SCP will have that role confirmed so retrieved instances can be returned over the same association.
Presentation Contexts¶
Abstract Syntaxes (SOP Classes)¶
| SOP Class | UID |
|---|---|
| Verification | 1.2.840.10008.1.1 |
| Study Root Query/Retrieve — FIND | 1.2.840.10008.5.1.4.1.2.2.1 |
| Study Root Query/Retrieve — GET | 1.2.840.10008.5.1.4.1.2.2.3 |
| Study Root Query/Retrieve — MOVE | 1.2.840.10008.5.1.4.1.2.2.2 |
| Patient Root Query/Retrieve — FIND / GET / MOVE | 1.2.840.10008.5.1.4.1.2.1.{1,3,2} |
| Patient/Study Only Query/Retrieve — FIND / GET / MOVE | 1.2.840.10008.5.1.4.1.2.3.{1,3,2} |
| Modality Worklist Information Model — FIND | 1.2.840.10008.5.1.4.31 |
| Modality Performed Procedure Step | 1.2.840.10008.3.1.2.3.3 |
| Unified Procedure Step — Push | 1.2.840.10008.5.1.4.34.6.1 |
| Unified Procedure Step — Pull | 1.2.840.10008.5.1.4.34.6.3 |
| Unified Procedure Step — Watch | 1.2.840.10008.5.1.4.34.6.2 |
| Storage | 212 standard Storage SOP Classes (CT, MR, US, XA, RF, NM, PT, RT, SR, Encapsulated PDF/CDA, Segmentation, Whole-Slide Microscopy, Waveform, …) |
Storage is an explicit allow-list
The connector accepts an explicit list of 212 standard Storage SOP Classes — not a universal "any Storage SOP Class" acceptance. A modality proposing a Storage SOP Class outside this list will have that presentation context rejected at association negotiation. Retired UPS Push/Pull Trial classes are also accepted for backward compatibility.
Transfer Syntaxes¶
By default the connector offers every transfer syntax supported by its DICOM library, including:
- Implicit VR Little Endian —
1.2.840.10008.1.2 - Explicit VR Little Endian —
1.2.840.10008.1.2.1 - Explicit VR Big Endian (retired)
- JPEG Baseline / Lossless
- JPEG 2000 (lossy and lossless)
- RLE Lossless
Command sets are always exchanged as Implicit VR Little Endian. When the deployment enables uncompressed-only mode, the offered set is restricted to Implicit and Explicit VR Little Endian only.
Security (DICOM-over-TLS)¶
TLS is opt-in and disabled by default (plaintext DIMSE). When enabled by the deployment configuration:
| Direction | Behaviour |
|---|---|
| Inbound (SCP listener) | Presents the connector's server certificate. If a client-CA is configured, client certificates are required and verified (mutual TLS); otherwise server-authenticated TLS only. |
| Outbound (SCU sub-operations, e.g. C-MOVE) | Verifies the remote server against the configured trust anchor and, for mutual TLS, presents the connector's own client identity. A partial identity (certificate without key, or vice-versa) is rejected rather than silently downgraded. |
- Protocol versions / ciphers: negotiated from the TLS library's safe defaults (effectively TLS 1.2 and 1.3). There is no CRL/OCSP revocation checking.
- Fail-closed: a configured-but-invalid TLS setup fails startup rather than falling back to plaintext.
Service Details¶
Verification — C-ECHO¶
Answered directly with status Success (0x0000).
Storage — C-STORE¶
Each received instance is preserved in its negotiated transfer syntax and stored in the Unomed cloud, where routing and forwarding rules are applied.
| Outcome | DICOM status |
|---|---|
| Stored successfully | 0x0000 Success |
| Not authorized (AE title / permissions) | 0x0124 Not authorized |
| Rejected as invalid | 0xC000 Cannot understand |
| Temporary failure | 0xA700 Out of resources |
Query — C-FIND¶
Routed by abstract syntax:
- Q/R Find — patient/study/series/instance matching against the cloud archive.
- Modality Worklist Find — scheduled procedure steps from the cloud worklist.
- UPS Find — Unified Procedure Step workitems.
Matching results are returned as Pending (0xFF00) responses followed by a final Success (0x0000).
Non-standard worklist filtering
For modality isolation, when a Modality Worklist query does not specify Scheduled Station AE Title (0040,0001), the connector defaults it to the calling AE title so a modality only sees its own scheduled work. Use * to explicitly match all. This differs from PS3.4, where an empty value is a universal match.
| Outcome | DICOM status |
|---|---|
| Success | 0x0000 Success |
| Not authorized | 0xA702 Unable to perform sub-operations |
| Query invalid | 0xA900 Identifier does not match SOP Class |
| Temporary failure | 0xA701 Out of resources |
Retrieve — C-GET¶
Instances are retrieved from the cloud, transcoded to the negotiated presentation-context transfer syntax, and sent back to the requesting SCU as C-STORE sub-operations over the same association, with Pending sub-operation counts and a final response.
| Outcome | DICOM status |
|---|---|
| Success | 0x0000 Success |
| Not authorized | 0xA702 Unable to perform sub-operations |
| Not found | 0xA702 Unable to perform sub-operations |
| Query invalid | 0xA900 Identifier does not match SOP Class |
| Temporary failure | 0xA701 Out of resources |
Retrieve — C-MOVE¶
The Move Destination AE Title is resolved from the tenant's registered AE titles. Instances are retrieved from the cloud and forwarded to the destination by opening a new outbound C-STORE association to that node, with Pending / Success / Failure move responses. If the destination AE title cannot be resolved, the operation fails.
Modality Performed Procedure Step (MPPS)¶
| DIMSE | Behaviour |
|---|---|
| N-CREATE | Creates a procedure step. For MPPS, the matching scheduled workitem is transitioned to IN PROGRESS with the initial performed data. |
| N-SET | Updates the procedure step: IN PROGRESS progress update; COMPLETED; or DISCONTINUED. |
| N-GET | Returns the current procedure-step state. |
Missing required UIDs return 0x0110 Processing failure; an unsupported SOP Class returns 0x0112. Success is 0x0000.
Unified Procedure Step (UPS) — N-ACTION¶
| Action Type | Behaviour |
|---|---|
| 1 — Request Cancellation | Supported. |
| 2 — Subscribe | Not implemented (returns 0x0110). |
| 3 — Unsubscribe | Not implemented (returns 0x0110). |
| 4 — Suspend Global Subscription | Not implemented (returns 0x0110). |
Character Sets¶
The Cloud Connector preserves Specific Character Set (0008,0005) and all string values exactly as received — it performs no character-set conversion of its own. The Unomed cloud honors (0008,0005) when decoding text, so values in the declared character set are interpreted correctly, including extended Latin (e.g. ISO_IR 100) and Unicode UTF-8 (ISO_IR 192). Text returned in query responses is encoded as UTF-8.
Modalities should set (0008,0005) to match the encoding of the text they send, so that names and other text are stored and returned correctly.
Not Supported¶
The following are intentionally not implemented and return a Processing failure (0x0110) or are absent from negotiation:
- N-EVENT-REPORT (UPS subscription push notifications)
- N-DELETE
- UPS N-ACTION subscription operations (Subscribe / Unsubscribe / Suspend)
- DICOM User Identity Negotiation (username/passcode)
- Asynchronous operations window negotiation