Privacy Protection with Pseudonymization and Anonymization In a Health IoT System: Results from OCARIoT

This paper presents the implementation of a users' privacy protection approach in a health Internet of Things (IoT) system. It is composed of a set of security layers based on cryptography, pseudonymization and anonymization techniques applied to processed (Data-In-Use, DIU), stored (Data-At-Rest, DAR) and transmitted (Data-In-Motion, DIM) data. Regarding security and privacy in IoT systems, especially in digital health systems, it is necessary to guarantee that the user rights are respected. This requires a security-in-depth strategy established based on risk-based results, every interconnecting actors, their security and privacy requirements and the specific aspects of the entire ecosystem, including the applications and platform. The presented privacy protection approach was developed and applied in a digital health platform, OCARIoT.