iMAGE cloud: medical image processing as a service for regional healthcare in a hybrid cloud environment

To handle the emergence of the regional healthcare ecosystem, physicians and surgeons in various departments and healthcare institutions must process medical images securely, conveniently, and efficiently, and must integrate them with electronic medical records (EMRs). In this manuscript, we propose a software as a service (SaaS) cloud called the iMAGE cloud. A three-layer hybrid cloud was created to provide medical image processing services in the smart city of Wuxi, China, in April 2015. In the first step, medical images and EMR data were received and integrated via the hybrid regional healthcare network. Then, traditional and advanced image processing functions were proposed and computed in a unified manner in the high-performance cloud units. Finally, the image processing results were delivered to regional users using the virtual desktop infrastructure (VDI) technology. Security infrastructure was also taken into consideration. Integrated information query and many advanced medical image processing functions—such as coronary extraction, pulmonary reconstruction, vascular extraction, intelligent detection of pulmonary nodules, image fusion, and 3D printing—were available to local physicians and surgeons in various departments and healthcare institutions. Implementation results indicate that the iMAGE cloud can provide convenient, efficient, compatible, and secure medical image processing services in regional healthcare networks. The iMAGE cloud has been proven to be valuable in applications in the regional healthcare system, and it could have a promising future in the healthcare system worldwide.


Introduction
Medical image processing, a source of core innovation in medical imaging, has developed rapidly owing to the integration of applications in diagnostics [1], treatment planning [2], and clinical study [3]. To handle the emergence of the regional healthcare ecosystem [4], physicians and surgeons in various departments and healthcare institutions must process medical images securely, conveniently, and efficiently, and must share electronic medical records (EMRs) of patients with each other. Traditionally, medical images are downloaded and processed at local high-performance workstations. However, the deployment of a large number of high-performance workstations will greatly increase the cost of a regional medical information system. The frequent transmission of medical images becomes the bottleneck in a regional healthcare network. Additionally, with the popularity of 3G and 4G mobile networks, clinicians are eager to access and manipulate images from the Internet using mobile devices; this objective cannot be achieved via the traditional workstation mode.
In recent times, cloud computing in medical imaging has provided potential solutions for high-capacity storage, sharing, and computationally intensive processing tasks [5,6]. When compared with the traditional mode, cloud computing can provide more extensive, easily accessible, and reconfigurable resources at a relatively lower cost [7]. Based on these services, cloud computing platforms in radiology are of three types: infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) [8]. For example, the web-based image processing and planning evaluation platform (WIPPEP) is a prototype of an IaaS cloud for image processing and radiotherapy plan evaluation [9], whereas SparkMed serves as a PaaS cloud that supports distributed medical image sharing [10,11].
Unlike IaaS and PaaS, the SaaS cloud provides relatively powerful services including installation, management, and operation of software applications. Medical image processing has several examples of SaaS. For example, Veritas, a public web application tool, was used to facilitate radiotherapy research and innovation [12]. The Biotronics3D cloud provided online volume rendering of medical images [13]. The m3DICOM cloud was designed for storage, analysis, and processing of digital imaging and communications in medicine (DICOM) images [14]. The cloud-based image processing toolbox is implemented on the Australian national infrastructure. Studies are permitted to create new algorithms using toolbox functions connected together in a workflow [15]. However, these clouds were constructed on public clouds in which service providers supply resources to the general public over the Internet. Public clouds are vulnerable to security risks in regional healthcare. A hybrid cloud combining the dedicated private and public clouds delivers enhanced security, better performance, and lower cost for businesses handling large quantities of data [16]. Medical image processing in a hybrid cloud with integrated EMRs of local hospitals will leverage the benefits of cloud integration while utilizing the existing infrastructures of regional institutions.
In 2014, from a list of hundreds of candidates, Wuxi in China was selected as one of the IEEE smart city participants. Since then, a municipal regional healthcare network for data exchange and sharing among medical institutions has been constructed. According to statistics, more than 1 million EMRs, 2 million electrocardiograph (ECG) records, and 2.9 million health records of residents have been stored, thus providing good data support for regional healthcare services.
In this study, the iMAGE cloud was set up in the smart city, Wuxi, to provide medical image processing integrated with EMRs for regional healthcare. From the architectural perspective, the iMAGE cloud was a hybrid network that enabled EMR sharing via mobile Internet. Images were processed on the cloud platform with high-performance computing, and virtual applications were delivered securely, conveniently, and efficiently. The designation and implementation of the iMAGE cloud in Wuxi was reported in this paper.

Method
System architecture of the three-layer hybrid cloud The iMAGE cloud consists of an infrastructure layer, a platform layer, and a software application layer. These three layers virtualize the usage of hardware and software. Figure 1 shows the conceptual system architecture of the iMAGE cloud.

Infrastructure layer
The infrastructure layer consists of data storage, server clusters, and network infrastructure. Medical images and EMRs were centralized and stored in a data center. The core functions of computing, reconstruction, and analysis of medical images were processed on server clusters, which included image computing clusters, storage management clusters, and application visualization clusters. Each cluster was built from multiple nodes, and each node consisted of multi-core central processing units (CPUs) and memory. Node states, load balance, disaster recovery, and fault handling were controlled by the cluster management software. Nodes could be added flexibly according to the medical image processing requirements and the scale of the application users.

Platform layer
The platform layer consisted of four core modules to support medical image processing for regional healthcare. These four core modules were: data reception, data integration, unified image computing, and application delivery.

Software application layer
The software application layer provided integrated information query, two-dimensional image processing, threedimensional image processing, and advanced functions.
This layer was designed to enable clinicians to access the images with the EMR of a given patient. The two-dimensional image processing provided conventional processing methods including chord processing, dynamic subtraction angiography, and intensity projection.
Data reception in the hybrid regional healthcare network The hybrid cloud combined the private and public systems to provide more convenient and secure services [16]. The regional healthcare network is illustrated in Fig. 2. Medical institutions such as municipal hospitals, district hospitals, communities, and community centers were connected.
Medical images could be received from radiology devices using one of two methods. As shown in the illustration, data could be detected from radiology devices in a municipal hospital and could be sent to local picture archiving and communication systems (PACSs); then, the data could be transferred to the data center in the cloud. In the second method, data detected from radiology devices were sent to the cloud directly if a PACS did not exist in the district hospital. Further, data were transferred automatically to the cloud at a given time to avoid rush hour in the network. Based on exchange standards, EMR data were integrated with clinical information systems, such as a radiology information system, a hospital information system, and a laboratory information system.

Image processing methods executing on unified image computing units
The image computing units and the data center were connected by a high-speed stable network to ensure efficient image processing. Users operating from remote terminals generated a series of computing instructions. The image computing units were responsible for high-performance image processing and calculations based on the instructions. Then, the results were transmitted to the terminals for display purposes.
In the cloud, numerous methods for advanced medical image processing were used. The coronary extraction algorithm combined the local threshold and the three-dimensional growth method. Thresholds and growth conditions were applied for major blood vessels and peripheries. Various types of thresholds-such as shape, contrast, and brightness-were used. The initial values of these thresholds were set according to historical data. The algorithm for pulmonary reconstruction focused on ensuring accurate segmentation of the lung parenchyma. The dual threshold method could ensure the most suitable segmentation threshold, and a lung parenchyma repairing algorithm was used to improve lung nodule detection near lung edges. The algorithm for intelligent vascular extraction utilized the dual-source computed tomography (CT) imaging principle. The mathematical calculation and 3D region growing method yielded a satisfactory effect. Positron emission computed tomography (PET-CT) image fusion could be achieved by mapping the PET image to the color space of the CT image. The detailed steps in the intelligent detection of pulmonary nodules are as follows: in the first step, i.e., preprocessing, two-dimensional CT sequence images were smoothly filtered; further, lung parenchyma were segmented to suppress the interference of background noise, such as blood vessels and trachea. Second, an average intensity projection (AIP) was performed on the preprocessed images. Owing to the characteristic of the lung nodule in three-dimensional space, the data were sparse; the outline of the nodule was extracted. In the third step, nodular contours were extracted based on the Otsu threshold segmentation method [17] and the morphology method. According to the approximate circular characteristic of the lung nodules, the translational Gauss model [18] was established to solve the problem of the precise segmentation of the lung nodule from the large area of the vessels and the multiple nodules of the vascular adhesion. In the fourth step, the false positive was removed by multiple-position detection. In the three-dimensional space, pulmonary nodules were circular whereas blood vessels were bar-shaped. However, in the cross-section, both appeared to be circular. Further, their gray distribution characteristics were very similar; therefore, it was difficult to distinguish between blood vessels and nodules in a single-view observation. For better utilization of nodule Fig. 2 Illustration of the regional healthcare network (The method section) characteristics in cross-sectional, coronal, and sagittal space, a three-dimensional image detection method was proposed; this method successfully distinguished between nodules and blood vessels.

Application delivery with virtual desktop infrastructure (VDI)
Virtual application delivery provided a secure and efficient desktop application environment for service functions in the software application layer. Currently, two main delivery methods exist: WebGL and virtual desktop infrastructure (VDI) technology. WebGL is a 3D drawing standard; it can replace the special rendering plug-in to provide hardware-accelerated 3D-rendering for HTML5. However, WebGL is not supported by all types of browsers. For example, Internet Explorer browser versions prior to version 11 cannot support WebGL. VDI is a server-based computing method to deploy desktops and applications in the cloud platform [19,20]. In the cloud, VDI technology was used to permit users to access computing environments without limitations of time and place, thus enabling the rapid establishment of an application environment. With VDI, applications ran only on cloud servers. Data downloading or data saving to a local client device was strictly prohibited to ensure the security of medical image data, documents, and other data. The approach of placing the high-performance computing at the back-end and transmitting the results to the terminals not only decreased the performance requirements of the terminal hardware, but also reduced the network load.

Security setting
Cloud computing raises critical security problems because the control over data in the cloud is transferred from the medical institution to the service provider for the cloud platform. The focus on the security policy in the cloud implementation has increased. The iMAGE cloud consists of three main security schemas: access and privacy protection of applications, operation monitoring of platform, and implementation of the virtual desktop infrastructure for application delivery.
The privacy protection of applications consists of identity authentication, digital signature, privilege and authorization, and key data security. The identity authentication was based on user and password. The digital signature was used to solve problems such as denial, forgery, tampering, and posing. The applications were asymmetric encryption and symmetric encryption.
For the protection of critical data, each record in the key data tables was encrypted in combination with time-stamp technology to prevent tampering, repudiation, and eavesdropping of data.

Results
Medical images and EMR data were generated at all eight municipal hospitals and uploaded to the data center of the cloud. More than 3000 physicians and surgeons were authorized to access medical image processing services. In their daily work, they could share medical images integrated with EMR views and perform processing with twodimensional or three-dimensional operations.

Performance analysis
The performance analysis was to test the processing speed of the iMAGE cloud platform for the typical image service functions. The performance test was performed using a Dell R730 server (2-way E5-2603 v3, 1.6 GHz, 6-core, 48 GB RAM). The terminals were personal computers (Dell 3020, dual-core 3.5 GHz, 4 GB RAM), Androidbased tablet computers (Samsung Note 8), smartphones with iOS (iPhone 6), and iOS-based tablet computers (iPad mini 2). The network bandwidth was set to 7 Mbps to simulate low bandwidth in the regional network.
The experimental results showed no significant difference among different terminals. The average time for the client login and completion of a list of electronic medical records was 3.1 s. The time required to display a twodimensional image was 2.2 s, to transform fuzzy two-dimensional images into high-definition diagnosable images was 2.5 s, and to render three-dimensional CT images was 3.5 s. The average overheads for three-dimensional imaging for coronary segmentation and pulmonary extraction were 2.5 s and 3.5 s, respectively.

Integrated EMR query
Medical records of the same patient in regional medical institutions were integrated by entering the identification information. Imaging information included ultrasound, endoscopy, CT, magnetic resonance imaging (MRI), PET, digital radiography (DR), computer radiography (CR), digital subtraction angiography (DSA), and pathology results. Other clinical information included EMRs, biochemical examinations, hospital records, medical records, and the daily course of disease. Advanced functions of medical image processing in the cloud Advanced functions of medical image processing-such as coronary extraction, pulmonary reconstruction, intelligent vascular extraction, intelligent detection of pulmonary nodules, PET-CT image fusion, and 3D printing-were available in the iMAGE cloud in Wuxi. Use cases of functions were described as follows.
For instance, the complete coronary artery extraction time was approximately 1 s under single-core conditions (depending on the volume size). Figure 3 illustrates a use case with four views of coronary extraction. These four views can function together, and the extraction results can be observed by adjusting the view layout. The pulmonary reconstruction function in the cloud was mainly used to rebuild lung CT image segmentation and to remove impurities to obtain clear lung parenchyma areas. In the case of a single machine, the operating time of the pulmonary reconstruction function was less than 1 s (depending on the volume size). Users were able to set a customized resistance and rendering color. Figure 4 shows a use case with four views of pulmonary reconstruction. In the case of a single machine, the operating time of the intelligent vascular extraction was less than 1 s (depending on the volume size). Figure 5 shows a use case of intelligent vascular extraction.
The function provided by the cloud for intelligent detection of pulmonary nodules was based on the segmentation of the lung parenchyma. Figure 6 shows a use case of intelligent detection of pulmonary nodules. Figure 7 shows a use case of PET-CT image fusion service. The cloud provided functionality to support 3D printing of Standard Template Library (STL) files. We added an interface to transform the 3D images for display to a format-such as STL-that the 3D printer can support. Then, the images can be printed using a 3D printer. Figure 8 shows an instance of 3D printing of teeth ridge and spine.

Discussion
The hybrid iMAGE cloud was designed and implemented in the smart city of Wuxi, China. In combination with the local private healthcare network and public Internet, our hybrid iMAGE cloud delivered enhanced security, better performance, and more economical services for regional healthcare. Using the integrated EMR query interface, physicians and surgeons could share the medical records of a patient; these records were completely integrated with all types of medical images.
The iMAGE cloud provided powerful image processing services to regional authorized clinicians. With widely used applications of the cloud system, the cloud connected many The iMAGE cloud deployed applications using the VDI technology. The advantages of this approach were: (1) Desktops and applications ran only on the cloud platform, and data download was prohibited to improve the security of the regional healthcare services. (2) Quick updates and maintenance of the cloud services were easy. (3) Terminal systems were compatible with Windows, Android, and other operating systems. (4) The service scale of medical processing was completely extensible.
Security is the most critical issue in cloud-based systems [6]. Access and privacy protection, operation monitoring of the platform, and application delivery with VDI are  adopted to improve the security of the iMAGE cloud. The iMAGE cloud has proven to be valuable for the Wuxi regional healthcare system and may have a promising future in the healthcare system worldwide.
Implementation results demonstrated that the iMAGE cloud provided convenient, efficient, compatible, and secure services. As an increasing number of healthcare institutions are integrated into the platform, more  In our future work, a detailed analysis of the performance and usage of the iMAGE cloud in each regional institution will be performed. The system architecture, security, and medical processing functions will be continuously improved and extended. We will use a large number of medical images and EMRs to investigate novel methods of image processing to support medical decisions.