When a medical modality or a DICOM software client connects to a (PACS) server, communication begins between the systems. Typically, this communication is unsecured, meaning any third party with access to that network segment, could potentially see what data is being exchanged. The Butterfly DICOM Connector creates a secure, encrypted connection between Butterfly Cloud and Osirix using DICOM-TLS. This enables secure transmission of ultrasound studies captured with Butterfly iQ, via the Butterfly Cloud, to an instance of Osirix DICOM Viewer.
The Butterfly DICOM Connector utilizes DICOM-TLS (Transport Layer Security, v 1.2) to facilitate point-to-point encrypted communication without the drawbacks and setup challenges associated with a VPN tunnel.
Osirix has native support for DICOM-TLS, which allows for a straightforward process to establish connectivity.
-
A fully functioning installation of Osirix DICOM Viewer on a Mac.
-
Admin access to the Mac computer that is hosting the software.
-
Ensure that you have access to Butterfly Cloud (cloud.butterflynetwork.com) so that you can configure the PACS connection. The PACS configuration screen will provide you with the digital certificate-key pair that will need to be imported into the Mac Keychain Access utility.
-
On your network firewall or router - NAT or port forward the port that you wish to receive the encrypted DICOM-TLS data from Butterfly Cloud to the TLS listener port of Osirix.
- If on a Mac, access to terminal with sudo.
-
Log in to Butterfly Cloud using your Browser - ensure that your user role in Butterfly Cloud is that of Administrator.
-
Navigate to the DICOM Configuration menu. Click your username in the upper right of the window and select Organization Settings.
-
Select the Connectivity tab and click the ‘+ Add’ option next to Connections to create a new TLS end-point that will be used with your DICOM integration.
-
Proceed to enter all of the necessary DICOM connection parameters.
-
Name = Friendly name for the Connection.
-
In the 'Security' section - set TLS to 'Active' and select the 'Generate' option.
-
Select PFX as the download format, and ensure that you copy/save the Secret password for later use
-
You will be prompted to download the Butterfly_SCP_key_pair.pfx file which contains the Digital Certificate
-
-
In the 'SCP' section - Enter the Host information, DNS name or IP of your TLS end-point.
-
Please note that the IP address must be a public IP that can be accessible from Butterfly Cloud to your network. This will typically be the IP address of your network firewall, router, or TLS termination device. Non-routable/private IP addresses are not valid.
-
-
-
Click Save, then click on the Connectivity tab to create the DICOM Integration.
-
After clicking on the Connectivity tab, click the ‘+ Add’ option next to Integrations and select PACS/VNA.
-
Give your PACS/VNA a friendly Name, and select to associate it with the TLS Connection created in Setup Connection from Butterfly Cloud and Download Digital Certificate.
-
Proceed to enter all of the necessary DICOM integration parameters.
-
SCU - Calling AET = The source AE Title of Butterfly Cloud (typically ‘BUTTERFLY’).
-
SCP - AET = the AE Title of your DICOM destination.
-
Enter a Port that you will need to forward from your firewall or router to the computer hosting the Citrix ADC software.
-
Enter a Port that you will need to forward from your firewall or router to your Mac computer hosting Osirix. (This is typically port 11113).
-
-
Please note that the port that is entered here is the public-facing port that is exposed by your TLS termination point.
-
-
Set the Compression level of the DICOM Images and Cine Loop as required or preferred. The settings above are typical. Select ‘Save Configuration’ to complete the setup.
- Open a Terminal session.
- Identify the file path to the .pfx file that you previously downloaded from Butterfly Cloud.
- Run the following command to install openssl:
brew install openssl
- Run the following command, replacing the first brackets with the location of your pfx file and the second brackets with your secret key from Butterfly Cloud:
-
sudo openssl pkcs12 -in [file path to PFX file] -legacy -out temp.pem -nodes -password pass:[Secret Key from Butterfly Cloud]
-
- Run the following command:
-
sudo security import temp.pem -k ~/Library/Keychains/login.keychain-db -t agg -f pemseq -Verify that the certificate and key import
-
- Verify the Certificate and Key Import: # - Open the Keychain Access app. # - Select the login keychain. # - Select the Certificates category. # - Verify that the certificate and key are present in the list.
-
Open Keychain Access application by using the Finder menu. Once you've opened the Keychain Access app, then select the Certificates category in the Login keychain category.
-
Congrats you have just imported the Butterfly Cloud SSL/TLS Certificate pfx file.
Referenced from Osiris Security Guide: https://www.osirix-viewer.com/osirix/osirix-user-manual/
-
Open OsiriX.
-
Open Preferences (in the OsiriX Menu).
-
Select the Listener preferences.
-
The last option of this group of settings, you will find the DICOM TLS Listener. Click on the TLS Settings button.
-
In the TLS Settings, click on the Activate DICOM TLS Listener check box, and choose an AETitle and a Port number (it must be different from the default DICOM Listener port - use the Default port 11113). Then click on the Choose button to select the certificate to use for TLS communications.
-
The list of available certificates will appear. Select the recently imported ‘Butterfly Network’ Certificate, and click the Choose button.
-
Select your preferred Cipher Suites - we recommend using AES-256 based CIpher Suites.
-
The chosen AETitle and Port will be displayed on the Listener Preferences window.
-
You can now receive encrypted DICOM communications on the chosen Port.
-
Switch back to Butterfly Cloud in the Browser.
-
Navigate to the integrations menu. Click your username in the upper right of the window and select Organization Settings.
-
Select the Connectivity tab and click the ‘...’ next to the newly created DICOM integration. Select the Echo option to perform a DICOM C-ECHO from Butterfly Cloud.
-
Click Echo, then Click on ‘Echo’ again in the upper right of the pop-up menu. This triggers a new DICOM C-ECHO; please verify the output is similar to below.
-
Congratulations - you have setup an encrypted DICOM-TLS connection to your DICOM destination.
-
To automatically send any studies saved to a Butterfly Cloud folder to your DICOM end-point, you can associate it with an Archive.
-
Select the Archive folder that you would like to associate with the DICOM connection. Select Archive Settings.
-
Choose the DICOM Storage location to associate with the Archive folder.
-
Now any study saved to this folder (using the Butterfly iQ App) will automatically forward to the chosen DICOM destination.