Multi-layer DICOM image encryption with metadata protection and integrity verification for edge healthcare applications

Medical images containing sensitive patient data demand robust encryption during storage and transmission across clinical networks. Existing chaos-based and Deoxyribonucleic Acid (DNA) encoded schemes are constrained by floating-point arithmetic, plaintext-dependent key generation, insufficient Digital Imaging and Communications in Medicine (DICOM) metadata protection, and absent integrity verification. This paper presents a multi-layer DICOM encryption framework integrating a DICOM-Aware Layered Hash Chain (DALHC) for plaintext-independent key derivation, a four-dimensional Fixed-Point Pseudo-random Heterogeneous Sequence Generator (FPHSG) ensuring bit-identical reproducibility, and a multi-stage pipeline comprising XOR confusion, dual-pass Carry-based Fibonacci Diffusion (CFD), DNA substitution, Cryptographic Permutation Sequence (CPS), and whitening stages. A Linear Feedback Shift Register (LFSR) chained integrity tag enables tamper detection prior to decryption, while selective encryption of twelve Patient Health Information (PHI) metadata fields preserves full Picture Archiving and Communication System (PACS) compatibility. Security analysis confirms entropy exceeding 15.85, NPCR above 99.99%, and robust resistance to cryptanalytic attacks across all test images. Edge evaluation across three heterogeneous platforms demonstrates practical hardware efficiency, with Jetson Orin Nano achieving 314.69 ms DICOM encryption for resource-constrained clinical deployment.