A review of security issues and solutions for precision health in Internet-of-Medical-Things systems

Precision medicine provides a holistic perspective of an individual’s health, including genetic, environmental, and lifestyle aspects to realize individualized therapy. The development of the internet of things (IoT) devices, the widespread emergence of electronic medical records (EMR), and the rapid progress of cloud computing and artiﬁcial intelligence provide an opportunity to collect healthcare big data throughout the lifespan and analyze the disease risk at all stages of life. Thus, the focus of precision medicine is shifting from treatment toward prediction and prevention, i.e. , precision health. To this end, various types of data such as omics, imaging, EMR, continuous physiological monitoring, lifestyle, and environmental information, need to be collected, tracked, managed and shared. Thus, internet-of-medical things (IoMT) is crucial for assimilating the health systems, applications, services, and devices that can improve the speed and accuracy of diagnosis and treatments along with real-time monitoring and modiﬁcation of patient behavior as well as health status. However, security has emerged as a growing concern owing to the proliferation of IoMT devices. The increasing interconnectivity of IoMT-enabled devices with health data reception, transmission, and processing signiﬁcantly increases the number of potential vulnerabilities within a system. To address the security issues of precision health in IoMT systems, this study reviews the state-of-the-art techniques and schemes from the perspective of a hierarchical system architecture. We present an IoMT system model comprising three layers: the sensing layer, network layer, and cloud infrastructure layer. In particular, we discuss the vulnerabilities and threats to security in each layer and review the existing security techniques and schemes corresponding to the system components along with their functionalities. Owing to the unique nature of biometric features in medical and health services, we highlight the biometrics-based technologies applied in IoMT systems, which contribute toward a considerable diﬀerence between the security solutions of existing IoT systems. Furthermore, we summarize the challenges and future research directions of IoMT systems to ensure an improved and more secure future of precision health.


Introduction
In 2015, the President of the United States, Barack Obama proposed the "Precision Medicine Initiative" in his address to the State of the Union, which aims to revolutionize the approach to improving health and treating diseases [1].Precision medicine primarily relies on the genetic, imaging, biochemical, and other data obtained in a hospital to formulate individualized diagnoses and treatment plans for patients.However, as the development of diseases and the occurrence of symptoms entail a dynamic process, an early diagnosis and comprehensive assessment of the disease cannot be achieved by relying only on the static data measured in the hospital.Therefore, disease prevention and early diagnosis require multidimensional dynamic monitoring data outside the hospital.To promote the development of precision medicine, developed countries such as the United States have successively launched precision health research programs since 2018.As such, precision health research primarily emphasizes the crucial role of prevention in maintaining health throughout the lifespan [2].Similarly, the Chinese government has proposed the concept of prevention-oriented health management in its plan for Healthy China 2030.In this paradigm, an individual's disease risk assessment is based on their genetic profile and family history, even including prenatal health monitoring information [3].Precision health aims to increase the accessibility of healthcare contact by integrating monitoring and diagnostics into everyday life.This requires multiple types of sensors and devices to continuously monitor physiological signals (e.g., blood pressure (BP), electrocardiogram (ECG), photoplethysmography (PPG), among others), biochemical indicators (e.g., blood sugar, biomarkers), behaviors, and other health data collected outside the hospital (Figure 1).Owing to the recent development of internet of things (IoT) technology, the long-term monitoring of human health-related data can be performed using human sensor networks and medical equipment [4][5][6][7][8].As such, IoT has assisted healthcare providers to develop new methods of assistance and has been integral in monitoring and curing diseases.The adoption of IoT has revolutionized the healthcare industry by enabling providers to remotely monitor patients' health through medical and wearable devices connected via the internet of medical things (IoMT) [9].
IoMT technology is transforming the face of healthcare and promises the potential to significantly improve patient access and system efficiencies.Specifically, in the COVID-19 pandemic since 2020, the urgent and widespread need for care, coupled with the challenge of physical distancing, has accelerated the creation and adoption of new digital technologies, including new processes to support their adoption and implementation across healthcare modalities [10][11][12].The potential benefits of IoMT can be justified within a hospital setting, where monitoring COVID-19 patients is expensive in terms of time and personal protective equipment consumption [13].IoMT technologies enable medical devices to transmit data to medical practitioners, who can monitor a patient's condition without reading the bedside records.The same technologies can enable the safe monitoring of patients who do not require hospitalization and can be treated at home or in a community setting.
The IoMT connects health systems, applications, services, and devices over the cloud via multiple transmission methods, e.g., Bluetooth, 5G, and NB-IoT.It has revolutionized the approach to patient assessment and healthcare data management [14][15][16].Existing medical devices can be modified to IoMT devices for real-time acquisition and storage of data in a centralized or distributed location.In particular, alarms and notifications can be set according to various rules and defined thresholds, which can be applied to the collected data to detect and predict deviations [17].In addition to discovering trends in a patient's specific disease or health condition [18], IoMT-enabled devices can facilitate health guidance by monitoring systems for diet, physical activity, and quality of life [19][20][21].Innovative devices such as wearable devices, implantable chips, and embedded systems in biomedical devices continuously acquire data on patients' activities and related vital changes [8,22].Moreover, advanced sensors, convertors, and firmware at the device level enable users to analyze and correlate various vital signs with their health conditions [23].In summary, IoMT can increase access from either the patients/caregivers or the healthcare practitioners and serve as a support manifold for medical services to enhance the quality of services.Considering that IoMT system-assisted precision health is applied in diverse scenarios, IoMT services can be classified into the following categories: (1) Real-time control service.In this case, a fast and accurate response is vital; otherwise, the outcome could be fatal.Therefore, the quality of services such as packet loss rate, latency, and jitter must be strictly conformed.Typical application scenarios include remote diagnosis, ambulance vehicular first-aid, remote surgery, and remote biomedical monitoring in the intensive care unit (ICU).(2) Information exchange service.This modality involves forwarding a massive amount of medicalrelated data to remote data centers.Although extremely high network throughput is required in general, the demands for packet loss rate and latency are not restricted.Typical application scenarios include 24-h health data uploading and remote health education video display.(3) Periodic monitoring service.This is a common service modality in e-health and occupies a considerable proportion of the overall network traffic.This kind of service exhibits strong regularity and involves low requirements for minimizing delay.Typical application scenarios include remote ward rounds, in-home chronic disease management, and community rehabilitation therapy.(4) Event-driven service.This service is characterized by sudden, emergent, and unpredictable scenarios under the most stringent real-time constraint, such that the medical staff or caregiver can  [36] Security and privacy in Healthcare 4.0 [37] Attack-aspect and corresponding defense [38] Security for medical devices Security in hierarchical IoMT systems • and • represent yes and no, respectively.
rapidly reach on-site and timely provide the necessary assistance.Typical application scenarios include health monitoring alarms, elders falling alarms, and other emergency events.
In the IoMT system, modern technologies such as wearable devices, bio-information sensors, and medical big data have undoubtedly improved the overall quality of medical care and strengthened the interaction between patients and medical practitioners [15].However, a new report by Cynerio (2022) discovered [24] that "more than half of connected medical devices and other IoT devices contain critical vulnerabilities."If exploited, these vulnerabilities could be detrimental to the patient's safety and privacy [25,26].In addition to the medical devices connected to home networks, public Wi-Fi, or cellular networks, the increasing amount of valuable data from healthcare applications and platforms stored in the cloud is susceptible to hacking, which renders them prime targets [27][28][29][30][31][32].With catastrophic consequences, any security concerns related to the healthcare system should be proactively addressed.In this case, security is one of the most critical issues in the IoMT systems as well as the healthcare industry.
Recent literature includes surveys reporting various taxonomies of potential threats and attacks, corresponding security and privacy issues, and proposed techniques and solutions across multiple research areas.As summarized in Table 1, the most recent studies review the security of IoMT systems from various aspects.Yaqoob et al. [38] discussed the security risks encountered by medical devices along with solutions.Koutras et al. [34] summarized the communication protocols applicable of IoMT systems and compared their scope of application.Specifically, from the aspect of cryptography, Ghubaish et al. [33] studied numerous cryptographic techniques.More recently, Newaz et al. [37] classified the potential attacks in various types to IoMT systems.In addition, studies have focused on an aspect of analysis, such as the application scenario in Healthcare 4.0 [36] and circular economy [35].Compared to previously reported surveys, the present research is novel as it completely covers the entire process of health data in IoMT systems.This review discusses an integrated system incorporating medical devices, network connections, and cloud platforms.The attacks possible in the data processing stages as well as the corresponding security solutions are reviewed based on the collection, aggregation, communication, and analysis of data.In particular, this study focuses on the entire system architecture, covering the security risks and technologies in multiple functional layers.To this end, the aspects of network service and system architecture have been thoroughly reviewed in this paper.
In addition, the issue of functional safety cannot be neglected for the IoMT system.Functional safety is a component of overall safety and relies on the appropriate response of a system or device to its inputs.The safety objectives are achieved by implementing each specific safety function and satisfying the required level of performance for each safety function [39].Although the utilization of central processing units (CPUs) and software has improved traditional functional safety, it has inevitably introduced network security issues.With the continuous development of human-machine-material integration, network security and functional safety have become an inseparably integrated security issue, and their connotation and extension will continue to expand in depth and breadth [40,41].
With the recent advancements in security technologies that aim to address the attacks and potential risks targeting IoMT systems, this paper reviews the state-of-the-art techniques and schemes for IoMT systems from the perspective of a hierarchical system architecture.The major contributions can be summarized as follows: • We construct a hierarchical IoMT system architecture comprising three layers: sensing layer, network layer, and cloud infrastructure layer.The connected devices, communication technologies, and the provided resources are briefly introduced in each layer.To emphasize the distinct features of the IoMT systems in comparison with the general IoT systems, the specific security requirements are summarized from the aspect of service demands in IoMT for precision health.• We discuss the security vulnerabilities and threats related to each layer and review the existing security techniques and schemes corresponding to the system components and their functionalities.
A comprehensive taxonomy of the state-of-the-art solutions has been provided in tabular form.• We focus on the biometrics-based technologies applied in IoMT systems owing to the unique nature of biometric features in medical and health services.Although existing studies primarily focus on the security issues related to authentication and key management, they provide insights regarding the utilization of biometrics for security purposes, which are promising for extensive application.
A brief overview of the security issues in the IoMT system is described in the following section.Initially, we construct a three-layer IoMT system, and thereafter, introduce the fundamental components and applied technologies in each layer to perform various functions.
2 Overview of security in IoMT system

System architecture
To comprehend the communication structure followed by patients and devices to interact with the physicians, hospital management systems, and data analytics systems, the IoMT system architecture is illustrated in Figure 2, which comprises three layers: sensing layer, network layer, and cloud infrastructure layer.These layers include all stages of data acquisition and processing, starting from an individual's biometric collection stage to data storage and the subsequent processing and analysis.

Sensing layer
The sensing layer is composed of wireless medical devices integrating a set of intelligent, small-sized, and resource-constrained wireless on-body and in-body sensors to store, process, and monitor various psychological parameters required for diagnosis.In addition, it includes all the medical equipment in the hospital, e.g., radiology and ICU equipment, ventilators, and dialysis machines, used in treatments.The devices include various types of sensors, classified into the following categories.
• Wearables devices are integrated into wearable objects or directly placed on the body to monitor health and/or provide clinically relevant data for care.Based on requirement and usage, these devices are further segmented into consumer wearables, clinical wearables, implantable devices, and ambient devices.
-Consumer wearables are generally used for real-time monitoring of physiological signals (BP, ECG, PPG) and behavioral data (gait, acceleration) from the body surface.-Implantable device is a type of medical device that is placed inside a patient's body during a medical procedure such as surgery.Certain examples of state-of-the-art implantable devices include pacemakers and smart pills (also known as smart drugs or digital pills).Existing ingestible pills, e.g., capsule endoscopy can record a patient's gastrointestinal information over a longer period outside the hospital, and various sensors can be incorporated to acquire additional information.-Ambient devices include a series of sensors such as motion detectors, contact switches, break-beam sensors, and pressure mats used for detecting environmental information/ambient variations in a specific environment (e.g., home and workplace).• Medical equipment fundamentally includes medical imaging, biochemistry analyzers, and bedside monitors for disease screening in hospitals.
-Medical imaging equipment refers to detection instruments that acquire information regarding the human body structure through medical imaging technology, e.g., magnetic resonance imaging (MRI), computed tomography, and ultrasonography (USG).The medical image data exhibits the characteristics of large data size and low real-time requirements.-Biochemistry analyzer is mainly used to detect various biochemical markers in the human body, and the detected data exhibit characteristics of small data volumes and low real-time requirements.-Bedside monitor is used for real-time monitoring of all types of physiological parameters of the patients in the ward, and it relies strongly on real-time data transmission to timely alert the occurrence of dangerous events.

Network layer
The network layer transmits the data recorded by the sensing devices or medical equipment to a local gateway and a remote platform via wired or wireless communication protocols.Health providers can access the sensed patient information through the gateway.To perform health-related tasks, several gateways are distributed geographically through edge/fog computing.The gateway can bridge the internet/local switches and wireless sensor networks (WSNs) as it supports multiple protocols.Networked medical devices require both wireless short-range standards and wired technologies to efficiently perform their respective tasks.Personal area network (PAN) comprising short-distance technologies such as ZigBee, Bluetooth, and ultrawideband (UWB) or local area network, ethernet, and Wi-Fi connection.This is used to transfer the sensed information to the gateway.Wide area network (WAN) such as the global system for mobile communication (GSM) do not require connectivity but employ backend servers/applications and WSNs, which are capable of accommodating numerous sensor nodes.This feature can be utilized in certain sensors requiring low-power connectivity.The data are communicated through various technologies described below and the comparison is listed in Table 2.
• Radio-Frequency Identification (RFID)-is a short-range communication tag that does not require any external power source but is highly insecure.• Near Field Communications (NFC)-operates in two modes: in active mode, the radio frequency and data transmission are simultaneously produced without pairing, whereas in the passive mode, the radio frequency is generated by only one device.• Bluetooth and Bluetooth Low Energy (BLE)-Bluetooth can establish an authenticated, encrypted, and low-interference connection for protected data transmission [42].However, it is still vulnerable to viruses, man-in-the-middle, tracking, and sniffing [43].Owing to its low power consumption, BLE is appropriate for sensor-based medical devices.• ZigBee-is used by most sensor-based devices for interconnected, uninterrupted connections between medical devices.Its low-power consumption renders it an ideal choice for healthcare applications, assisted by its sleep mode feature.Advanced encryption standard (AES) algorithm along with a 128-bit key is used to provide security in this standard, which is vulnerable to energy depletion attacks, replay attacks, and sniffing [44].Moreover, AES is unsuitable for resource-constrained sensory devices.• Wi-Fi-all devices, laptops, tablets, and smartphones are Wi-Fi integrated, and its high-energy consumption emerges as a considerable limitation.• Cellular Networks-The security solutions have been adequately regulated and applied.The evolution of 5G cellular networks provides immense technical support such as software-defined networks and network slicing to ensure a more reliable communication system.

Cloud infrastructure layer
The cloud infrastructure layer represents the infrastructure providing physical/virtual resources to support the operation of the applications at the sensing layer [45].The data acquired at the sensing layer can be transmitted from the network layer, and thereafter, stored in the cloud infrastructure layer.The typical resources that can be provisioned are stated as follows: • Processing capability-During the cloud deployment of applications, the cloud infrastructure can provision computation resources and memory to process the data.For instance, the collected medical data are required to the analyzed by complicated data computation models.In particular, adequate computation resources should be assigned to execute the computation-intensive tasks and ensure the quality of the supported services.• Storage capability-Medical data can be stored in the cloud to relieve the bottleneck in local storage.
Generally, cloud storage offers efficient data storage and access methods to support the execution of applications.The hardware of the cloud storage is provided by the manufacturers and can be managed by a cloud manager to ensure data security.cloud storage should be reliable, consistent, and fault-tolerant.• Virtualized resources-By leveraging virtualization technology, the physical resources can be transformed into virtualized resources and shared by multiple users more efficiently, i.e., a single physical machine can be virtualized into eight virtual machines in Amazon.The virtualized resources can be instantiated using virtual machines (VMs) or microservice-based containers.In addition to directly accessing the physical resources, the users can hire VMs to implement their applications.

Security metrics based on the IoMT service demands
Compared to conventional IoT systems, the IoMT system closely caters to the service demand.According to the IoMT service categories listed in Section 1, the performance demands can be classified as follows.
(1) Timeliness.Health care requires prompt delivery for the benefit of patients as well as health care providers, especially when IoMT enables remote monitoring and treatment.Nonetheless, the time required for decision-making and the feedback delay of IoMT applications varies for each case of application.For instance, a patient's condition is tracked regularly during chronic disease monitoring, and doctors are required to perform accurate and timely diagnoses in clinical decision support systems.
(2) Diversity.The IoMT system incorporates medical devices with mobile applications, multisource data, processes (monitoring and care delivery), and individuals (patients, providers, professionals).Thus, the IoMT system is expected to generate and consolidate measurable information from various sources to improve the treatment speed and accuracy of an individual's service requirement.(3) Accuracy.Accuracy should be consistent for every component of IoMT, because accurate information delivery is life-critical across all stages-from data acquirement, transmission, and storage to analysis and decision-making for treatment.(4) Reliability.A reliable IoMT system must achieve its functional goals in all cases, implying that it should not be prone to unexpected failure under normal operating conditions.The potential diagnostic nature of IoMT-based systems mandates the reliability of every system component to ensure the correctness of the delivered information and services.(5) Scalability.To manage the exponential growth of various kinds of medical services, IoMT applications must be able to support an increasing number of connected devices (including the types stated in Section 2.1), users (with various service requirements), application features, and analytics capabilities, without any degradation in the quality of service.Thus, IoMT applications should be scalable to monitor, secure, and manage an increasing number of devices by proportionately increasing the resources.
However, to satisfy all the demands of the aforementioned services, the IoMT currently suffers from a major limitation of weak security.As such, any exploited vulnerability in the IoMT enables cybercriminals to enact a multitude of malicious actions, such as seizing control of the medical device; stealing sensitive patient health, personal, and insurance data; stealing proprietary clinical records; obfuscating network traffic; disrupting healthcare delivery processes; and ransoming the device to yield a profit.Furthermore, IoMT demands stronger security, because, unlike other industries, a security breach in a healthcare network can practically result in loss of lives [46].Thus, the security requirements of the IoMT systems are more rigorous than that of typical IoT-based infrastructures [47][48][49].Based on these service demands, the security of IoMT systems is predominantly focused on the following metrics.
• Confidentiality/Privacy.This refers to the ability to maintain the privacy of the data during its acquirement, transmission, or storage.In addition, they should be accessible only to authorized users.Specifically, the collection and storage of patient health data must conform to legal and ethical privacy regulations, e.g., General Data Protection Regulation and Health Insurance Portability and Accountability Act of 1996 (HIPAA) [50], states that only authorized individuals can access such data.To prevent data security breaches, adequate measures must be adopted to ensure the confidentiality of the health data associated with individual patients.The significance of such measures cannot be overemphasized, as the data stolen by cyber criminals could be traded in illegal markets, thereby causing the patients to suffer from privacy violations as well as possible financial and reputational damages.• Integrity.This relates to the capability of protecting the data from any unauthorized tampering during the stages of collection, transmission, and storage.For IoMT systems, data integrity aims to ensure that the data received at the intended destination are completely uncompromised during wireless transmission [51].Attackers could gain access to and modify the patient data by leveraging the broadcast characteristic of the wireless network, which can cause severe implications in lifethreatening cases.To ensure data integrity, the capacity to detect potential unauthorized distortions or manipulations of the data is critical.Therefore, appropriate mechanisms of data integrity must be implemented to prevent any alteration of the transferred data by malicious attacks.Moreover, the integrity of the data stored in the medical servers needs to be ensured by validating that the data cannot be tampered with.• Availability.Services and data must be accessible to the relevant users on demand.These services and data, provided by medical servers and devices, will be rendered inaccessible in case of denial of service (DoS) attacks.Any inaccessible data or services can aggravate life-threatening incidents such as with no prompt alerts in case of a heart attack.Therefore, to accommodate the possibility of availability loss, healthcare applications must be functional round-the-clock to ensure data availability to the users and emergency services [52].• Authenticity.This refers to the ability to validate the identity of a user accessing the system.Overall, mutual authentication is the most secure form in which both the server and client authenticate each other prior to any secure data/key exchange.As patients' data are often stored and aggregated at the personal server level before being forwarded to the medical servers in the IoMT systems, the data should be strongly protected during its storage on the personal servers.Generally, security and privacy the personal server level can be ensured with the deployment of two types of authentication schemes, namely, device authentication and user authentication.Personal servers (e.g., smartphones) shall perform authentication before accepting the data transmitted from the medical devices and sensors.As such, device authentication must be implemented in every IoMT system, because false information on patients' physical conditions from malicious devices can pose severe negative impacts on clinical diagnosis and care decisions [53].The data stored either temporarily or permanently on the personal servers should be accessed only by the patients and medical staff such as caregivers, which necessitates the requirement of effective user authentication schemes [54].
A popular solution to user authentication in and personal server level utilizes biometrics, which is applicable in the IoMT systems, because most biometrics data can be conveniently sourced from wearable and implanted devices.• Anonymity.The capability of concealing the identities of patients/physicians from unauthorized users during their interaction with the system.Patient-sensitive data can be classified into three categories: explicit identifiers, quasi-identifiers, and privacy attributes.Explicit identifiers uniquely indicate a patient using an ID number with the patient's name and cell phone number.A combination of quasi-identifiers can uniquely indicate a patient in terms of age, birth date, and address.Privacy information refers to sensitive attributes of a patient, such as illness and income.In the data publication process, the individual attributes of the new dataset are adequately processed, considering the distribution characteristics of the original data to protect patient privacy.Presently, random perturbation technology and data anonymity technologies are employed to resolve these issues [55].
The realization of comprehensive and integrated end-to-end solutions for the IoMT systems is key for both academia and industry.Thus, we comparatively review the state-of-the-art security strategies based on the three layers of the IoMT system architecture discussed thus far.The remainder of this article is organized as follows.In Sections 3-5, we elaborate on the potential risks and the corresponding state-ofthe-art security strategies in the sensing layer, network layer, and cloud infrastructure layer, respectively.Specifically, we discuss biometrics-based technologies for authentication and key management to highlight their significance and uniqueness for IoMT systems.The challenges and potential research directions on existing problems are summarized in Section 6.Finally, the conclusions of this review are presented in Section 7.

State-of-the-art security strategies in IoMT sensing layer
The sensing layer is responsible for acquiring and compiling data from physical devices and is closely related to the medical devices in an IoMT environment.According to an estimate reported by the World Health Organization [56], two million distinct types of medical devices are available across the global market, categorized into more than 7000 generic device groups of various forms and sizes: from home-monitoring gadgets to enormous on-site devices.This wide variety of physical devices complicates the IoMT ecosystem for prioritizing security and ensuring optimal performance throughout its lifecycle in terms of development, configuration, and updates.Therefore, the device-level threats and solutions focusing on the hardware and onboard software/system security are discussed herein.The taxonomy is displayed in Figure 3.

Hardware-based security
Hardware security ensures the vulnerability protection that is emergent in physical devices, machines, and peripherals.A hardware attack is an exploitable weakness in the hardware of the device that can be leveraged to gain physical or remote access to the device for executing malicious activities.

Electron microprobe
Electronic microprobes are used in techniques that enable an attacker to directly observe a portion or all the sensitive information such as plaintext or encryption keys.Using modern techniques of integratedcircuit (IC) editing, attackers can remove the protective layer and expose the internal chip to the air.Thereafter, using a fine-tip probe, they can analyze and extract the electrical properties, signals, and data from the interest area.ICs designed for safety-critical applications such as microcontrollers and security tokens in mobile devices are among the most common victims of such attacks [57][58][59].Electronic microprobe is classified as an invasive attack along with fault injection and reverse engineering, as they require complete encapsulation removal as well as circuit wiring exposure.Currently, the most commonly used and powerful electron probe tool is the focused ion beam technology [60,61], using which attackers can achieve submicron or even nano-level precision [62].In particular, defending against such microprobing attacks is challenging because traditional processes of IC design do not place any material under the silicon substrate.Moreover, the passive nature of both invasion methods renders them difficult to detect.However, both methods involve the detection of photon emissions, which enforces a limitation based on the wavelength of the emitted photons.

Reverse engineering
Invasive attacks require direct access to the inner components of the device.Reverse engineering is an analysis process that provides a complete understanding of the design of a device by extracting the information or knowledge of its inner structure [63].The attacker can understand the internal design structure of the chip using an electron microscope and can directly analyze the data in the corresponding storage area of the chip using laser scanning.For instance, several IoT devices operate on older OS or firmware versions that are currently outdated or patched in case the vulnerabilities in the later versions are discovered or fixed.Utilizing these synergies or firmware, the attacks can directly target these unpatched vulnerabilities [64].In this regard, a beneficial method [65] is to provide anti-reverse engineering by executing encrypted code in the hypervisor and protecting the decryption keys.

Fault injection
A fault injection attack is an external physical attack, wherein circuit faults can be artificially generated and introduced into the target system by establishing a specific fault model and adopting relevant strategies and methods.In addition, the data acquired through failure analysis techniques such as differential failure analysis, crash failure analysis, and invalid failure analysis can be compiled and analyzed to gain valuable information.
Hardware-based fault injection is a typical mainstream attack method involving voltage glitch, clock glitch, electromagnetic, and laser fault injection.A practical method against voltage glitch attacks is to use on-chip voltage regulators.In [66], the authors analyzed the influence of the capacitor size and voltage regulator phase number on the resilience of cryptographic circuits against fault injection attacks.The effectiveness of the proposed method against voltage glitch attacks is demonstrated through extensive simulations of the S-box of the advanced encryption standard (AES) [67] cipher algorithm.

Hardware trojan
Through malicious modifications to the original circuitry, attackers exploit the hardware or use hardware mechanisms to access the data or software operating on a chip [68].Hardware trojan (HT) can infect any IC, e.g., application-specific ICs (ASICs), system on chips, field programmable grid arrays (FPGAs), and digital signal processors, cause catastrophic damage to the device at the hardware level.
For instance, an attacker proficient in internal hardware architecture can insert an HT during the chip manufacturing process to destroy data, which causes severe harm to medical devices [69].HTs have emerged as a significant security risk for ICs, as most ICs are manufactured in outsourced manufacturing facilities.Third-party vendors can use uncertified intelligence cores such as Trojans to perform malicious activities, including information leakage from medical devices.The common hardware security issues are explained in the following subsections.

Software-based security
In this type of security issue, any inherent vulnerability in the device software can be exploited to perform a range of attacks.The attack taxonomy primarily includes malware, brute-force cracking, and buffer overflow attacks.

Malware
Upon deploying a piece of malicious code (e.g., Mirai), attackers can intercept the data stored inside a device system and presume control over the victim's system or damage it.In general, attackers fake firmware updates, drivers, or security patches to distribute malware, which results in attacks on confidentiality, integrity, authenticity, and the availability of data and other system resources.Under such attacks, the sensitive data of IoMT may be disclosed, altered, or may not be even available to authorized users.Therefore, the IoMT environment essentially requires protection from malware attacks.Recent research has shifted interest from static or dynamic analysis-based approaches [70,71] to malware detection for extracting valid semantics at the application programming interface (API) level.For instance, in [72], authors proposed a scalable and event-aware Android malware detection system (EveDroid), which exploits the behavioral patterns of various events to effectively detect new malware based on the insight that events can reflect all the operation activities possible in software applications.

Brute force
In this type of attack, the attacker will try to predict the authentication credentials of the intelligent device and will systematically review all possible passwords and passphrases until the correct password is derived.For instance, certain devices (e.g., IP cameras and routers) are manufactured with default user credentials, which could easily gain access to the device by referring to the default password lists available on the internet.Although traditional cryptography methods are effective against this attack, it is not yet demonstrated as lightweight and rapid for IoT device authentication.Therefore, a hardware-based security method, referred to as physically unclonable functions (PUFs) [73], has recently been developed to fulfill the security demand of IoT devices.In principle, this method is based on the characteristic that PUF leverages the randomness of the manufacturing process to create a physically unclonable unique identifier.For instance, certain authors [74] proposed a PUF-based identity-preserving protocol for IoT device authentication (PUF-IPA) to prevent an adversary from brute-forcing the PUF of the device to acquire challenge-response pairs, thereby locking out the device from generating unauthorized models.

Buffer overflow
By sending a crafted input, attackers can influence the application to execute an arbitrary code that causes the program or process to attempt writing more data into a fixed-length buffer block, and consequently, produces a buffer overflow.For decades, buffer overflows remain a major security threat plaguing cyberspace owing to the ubiquity of the software vulnerabilities it exploits and the low complexity of their launch.For instance, the first buffer overflow attack "Morris worm" occurred two decades ago, and it crashed more than 6000 web servers worldwide.To date, most research regarding this aspect focuses on software.Wang et al. [75] proposed polymorphic stack-smashing protection (P-SSP), with a core idea to re-randomize the canaries for a new process/thread or a new function call.Alternatively, hardwarebased approaches are gradually starting to solve the buffer overflow issues.In [76], authors developed a security hardware design with an architecture comprising program offline behavior analysis and real-time hardware behavior monitoring (HRTBM) to detect buffer overflow attacks.Their experimental results demonstrated that it can detect a wide variety of buffer overflow attacks with simple hardware design and reasonable overhead penalties.

Firmware security
Firmware attacks typically execute arbitrary malicious code on embedded devices by exploiting dynamic memory regions via inappropriate input validation or weak physical security vulnerabilities.Specifically, firmware attacks can be either static or dynamic [77].
• Static Firmware Attack -focuses on modifying the firmware code in the memory region or during runtime as part of the firmware update or patching process.Firmware update is a ubiquitous feature of modern embedded devices.However, prior research has demonstrated that the firmware update feature of numerous embedded devices is not adequately protected by proper user authentication [78][79][80].Several devices involving certification to enable firmware updates are vulnerable to bypass attacks targeting simple management interfaces [81].A firmware modification attack is one of the most dangerous attacks, as it can occur on various embedded systems such as telecommunication infrastructure, SCADA and PLC systems, laptop battery controllers, medical devices, network interface cards, and automated teller machines [82].Ling et al. [83] injected a malicious code into a smart plug to preside over its control.The compromised firmware opens a reverse loop backchannel to the attacker's server and generates a reverse shell, thereby providing remote access to the plug for further attacks.• Dynamic Firmware Attack -exploits the dynamic memory regions (stack and heap) to circumvent secure boot and attestation, e.g., code injection [84] and code reuse attacks [85].An attacker achieves malicious intent by diverting the control flow of the firmware to malicious code and executing it [86].Several solutions for defense against such attacks include control-flow integrity [87] and methods based on randomization [88] and enforcement [89].

Side channel security
Side-channel attack (SCA) specifically refers to a nonintrusive attack on the cryptographic algorithm, which is cracked through the leakage of side-channel information during the operation of the encrypted electronic device.Owing to various attack sources, SCAs can be classified into the following categories (but not limited to): timing SCA, cache SCA, power-monitoring SCA, electromagnetic SCA, acoustic cryptanalysis, and optical SCA.

Timing SCA
For this type of SCA, the attacker attempts to compromise a cryptosystem by analyzing the time required to execute cryptographic algorithms.Therefore, defenses against such attacks usually require software optimizations and hardware redesigns to prevent threats from timing vulnerabilities.In [90], authors believe that devices such as GPUs can be exposed based on the timing information of the data, which attackers can exploit to recover the encryption keys.Therefore, they propose a hierarchical miss status handling register design and a software-based approach to permute the organization of critical data structures and address the vulnerabilities caused by GPU coalescing units.

Cache SCA
The cache attacks are based on the attacker's ability to monitor the cache accesses made by the victim in a shared physical system.For instance, an L1 cache-based attack learns the AES and asymmetric cryptography algorithm keys by analyzing the time variance of the cache usage.Recent research reported that CPU caches, including last-level cache, are vulnerable to attack.Cache randomization has recently been revived as a promising defense technique against conflict-based cache SCAs related to the stated issues.In [91], the authors determined experimentally that an attacker can easily detect a usable eviction set within the chosen remap period of CEASER-S [92] and increase the number of partitions without dynamic remapping such as ScatterCache [93], which cannot eliminate the threat.However, the issues can be fixed within the current performance budget, and the randomized set-associative caches can be adequately strengthened and possessed.

Power-monitoring SCA
Power-monitoring SCA is a common SCA in which the attacker measures the power consumption [94] of the encryption device under test, and subsequently, performs simple (SPA) or differential power analysis (DPA) of the obtained traces to decipher the secret key.For instance, attackers can target FPGAbased convolutional neural network accelerators by monitoring the power and managing the recovery of input images from the collected power traces, without knowing the detailed parameters in the neural network [95].This type of SCA poses a devastating impact on the data security of online medical image analysis.In this regard, a feasible solution uses noise insertion in power consumption measurements to defend against power SCAs.In [94], the author demonstrated that noise injection in the AS domain achieves SCA immunity with extremely high efficiency.Others solutions involve balancing the power consumption of the fluctuating transitions and isolating the supply from the encryption engine.In [96], authors analyze the DPA resilience of the FinFET cryptocircuits and design a 4-bit substitution box (Sbox-4) of the PRIDE algorithm to use new devices in low-power applications.Moreover, in [97], the authors present a security countermeasure based on switching DC-DC regulators.

Electromagnetic SCA
Modern digital computer systems contain several components, especially the CPU and RAM, relying on electrical impulses to operate according to a clock signal in a coordinated sequential manner.Deduced from Maxwell's equations, the time-varying current could generate a corresponding electromagnetic field, containing a wealth of side-channel information related to software execution and data processing.Electromagnetic SCAs are based on leaked electromagnetic radiation and can be employed to infer cryptographic keys using techniques equivalent to those in power analysis or noncryptographic attacks, e.g., radiation monitoring attacks.To avoid such attacks, certain researchers have studied the protection of associated encrypted currents.In [98], the authors utilize signature attenuation hardware that locally encapsulates the crypto core within the lower metal layers, which significantly attenuates the critically correlated crypto-current signature before passing through the higher metal layers to connect to the external pin.

Acoustic cryptanalysis
Acoustic SCA exploits the sound signals produced during computation, generally segmented into active and passive types.For instance, similar to radar and sonar systems, the system speakers can emit sound

Confidentiality
Hardware redesigns [101] waves that are inaudible to the human ear, using which attackers can obtain access to the equipment by tracking the movements of the human body, arms, hands, and even fingers [99].Upon exploiting the sound emanating from the pressed key, attackers can easily derive the password [100].

Optical SCA
Optical emissions from semiconductors can leak important information on embedded devices, which poses a major threat to their security.Attackers can extract sensitive information from a circuit by detecting the light emitted from a switching transistor in the form of several photons within a short period.Reference [101] describes the first attack utilizing the photonic side channel against a public-key crypto-system in a "real-world" programming environment.The authors evaluated an optical SCA with three common implementations of Rivesta-Shamira-Adleman (RSA) [102] modular exponentiation and determined that the key length poses a marginal impact on its resilience to attack.To eliminate attacks such as laser logic-state imaging (LLSI), the authors proposed low-cost, circuit-based self-timed sensors to detect the critical steps implemented by attackers while performing LLSI attacks on two attack surfaces, i.e., system clock (freezing) and supply voltage (modulation).This section primarily focused on IoMT devices and peripherals security issues.A clear summary of the security issues in the sensing layer has been provided in  from external sources as well as the device itself.The state-of-the-art method continuously updates the hardware and software design to adapt to emerging security threats.

State-of-the-art security strategies in network layer
With the recent innovations in electronics including wired and wireless communications, diverse communication technologies, and network structures have been introduced in IoMT systems that may assist IoMT systems to achieve optimum performance.As discussed earlier, sensors require connectivity to the gateways and the platforms established via networks to communicate and store information either locally or centrally.The communication occurs over a wired and wireless medium and can be either short-range or long-range.Furthermore, various protocols have been employed for communications.Considering that communication fundamentally relies on backbone networks and infrastructures, the network security technologies at this level generally apply to all usage scenarios.A major component of IoMT systems is formed by WSNs, comprising numerous sensors connected via wireless communication technology that can collaborate to collect information on the covered area and enable legitimate external users to access real-time data.The sensing data are mostly transmitted over public network connections, and the sensors are often deployed in an unattended or hostile environment, which imparts vulnerability to WSNs against attacks.Therefore, for the specific application scope of IoMT systems, we discuss the major security threats and countermeasures pertaining to sensor-based networks and connections via a wireless medium.The taxonomy is presented in Figure 4.

Authentication
In IoMT systems, the security problem of data protection can be resolved by authenticating the data source through the identification of malicious users and devices.Authentication refers to the identification of the individual or group identity of users or devices by certain techniques.Generally, one-factor authentication uses an authentication technique to protect the system.In IoMT systems requiring highlevel security, multifactor authentication employs a greater number of factors to protect the system.This technique promotes the resilience of the system against cyber breaks in case a factor is compromised.(3) biometrics-based authentication based on "what you are."Considering that biometric signals can be of specific availability and accessibility in IoMT systems, the biometrics-based authentication methods play a unique and vital role in user authentication which will be emphatically introduced herein.
• Password-based authentication: Static passwords [103,104] can remain unchanged and be reused by users for a long duration.In principle, static passwords are advantageous because of their high availability, ease of use, wide application range, and simple deployment.Nonetheless, static passwords do not contain any inherent attributes of users and need to be remembered, stored, and transmitted, which may cause severe security risks.• Physical property-based authentication: Physical property-based authentication is implemented through the authorized hardware and software tokens and the information carried by them, such as smart cards [105], dynamic password [106,107], and digital signature [108].Instead, of remembering the passwords, users need to personally carry the relevant hardware and software tokens.However, various companies manufacture their own devices, which prevented the scalability of tokens.In addition, carrying multiple tokens in all cases while ensuring their safety is highly inconvenient.Smart card relies on physical keys that are utilized as a second factor in multifactor authentication methods, with elliptic-curve cryptography (ECC) keys serving as the first factor of authentication [109].In IoMT settings, the medical staff must enter a key and use their smart cards to access the system.Generally, the digital signature is used to verify the authenticity of the data/command following the user's private and public keys for signature and verification, respectively.In IoMT systems, digital signatures can be integrated within the sensor's firmware with an add-on software shim, which intercepts and validates the wireless communications of the sensors [110].Furthermore, the x-auth-token field in the hypertext transfer protocol (HTTP) header can be used as a software token embedded in the user's web browsers [111].Similarly, RFID can be used as a hardware token to secure the logistic management of sensors in a hospital information system [112].• Biometrics-based authentication: Biometrics-based authentication is a typical authentication technology in IoMT that utilizes the user's unique biometric characteristics to prove their identity.Common biometrics primarily include physiological and behavioral characteristics.Physiological features are related to the user's physical shape such as fingerprints [113,114], facial features [115,116], and geometric features of hands and iris.Behavioral characteristics are related to user behavior habits such as signature (handwriting), speaking mode, gait, and touch-screen habit [117][118][119].The biometrics-based authentication technology does not require users to remember or store specific identity information and can establish a one-to-one correspondence between individuals and identities.Compared with other technologies, biometrics-based authentication is more secure, convenient, and available.A brief comparison of several kinds of biometric features used in authentication is depicted in Figure 5.
In medical care scenarios, professionals and/or patients are permitted to access medical records by using only their biometrics.The most commonly used biometric factors include fingerprint, face recognition, electrocardiogram (ECG), and electroencephalogram (EEG) which are beneficial in case of emergencies.The performance of the fingerprint-based sensors relies on the employed extraction algorithm [120].Compared to face recognition, fingerprint authentication offers greater credibility and a substantially longer history, where systems can authenticate users by scanning their faces.Although ECG/EEG-based authentication has been developed in recent years, it increases the computational overhead during transmission compared to fingerprint-based technology [121].ECG/EEG signals remain the primary physiological signals collected by the body sensor network [122,123].Although signals should be acquired from the living body, which is difficult to be simulated by other devices, time-series signals are easy to process.Authentication depends primarily on the selection of the utilized feature(s).In past studies, numerous features such as temporal (locations and intervals among waves), amplitude (peak height of waves) and morphological variations (shapes, proportions, slopes, and angles) have been proposed to recognize individuals, which require accurate detection of fiducial markers and the results depend on the recognition procedure.In principle, fiducial-based approaches benefit from well-established normalization algorithms to compensate for the variations in ECG signal caused by heart rate variability [124,125], but they are affected by the performance of the fiducials detection algorithms.To overcome the problem, non-fiducial-based approaches offer a promising alternative to reduce the  error rate and computational effort.Accordingly, new approaches that do not require fiducial recognition include autocorrelation-based features, phase pace analysis, and frequency-based features.They do not require the identification of ECG waves and are advantageous because of considering fine features that could be lost in the case of using fiducials.To derive a deeper understanding of non-fiducial authentication, certain representative studies based on various biometric features are detailed herein.In [126], researchers proposed a multiscale power spectrum feature extraction method based on wavelet transform and artificial recognition model (Figure 6).Using a one-to-one random forest classifier combination, a more accurate identity authentication can be implemented.Moreover, a typical behavioral characteristic-gait-has been widely used for authentication.However, the gait recognition performance deteriorates dramatically if the walking speed varies.To address this issue, the speed-adaptive gait-cycle segmentation method and individualized matching threshold generation method have been proposed [127].Moreover, as intrasubject gait fluctuation is more significant in older individuals than in young individuals owing to age-related variations, gait-based identity recognition of the aged is more challenging.In [128], a gait template synthesis method has been proposed to reduce intrasubject gait fluctuations among the elderly, and an arbitration-based score-level fusion method has been defined to improve recognition accuracy.Two matching algorithms were used to derive the preliminary decisions; in case of inconsistencies in the preliminary decisions, the third matching algorithm is applied to provide the final decision.• Multifactor authentication: Recently, an increasing number of enterprises and researchers [129,130] consider the user's biometric characteristics as a factor in multifactor authentication technology.

Iris
The research relevant to this area focuses on effective and rapid extraction, measurement, and comparison of unique components of the biometrics, which are treated as a special identity of the user.For instance, in the case of using shared keys as a first factor, face recognition can be the second factor in continuous role-based authentication [131].By continuously scanning the user's face, this technique retains the connection between the sensor and the medical controller to secure the gateway layer.This can prevent the junior medical staff from accessing the patient data in absence of a senior medical staff who has authenticated oneself but has not logged out from the system.However, owing to the limited and unmodifiable properties of biometric characteristics, the security threat caused by biometric data leakage is irreversible.Consequently, an increasing number of users are skeptical of uploading their biometric data to remote servers that could be maliciously stolen.

Device authentication
For device-wise authentication, the device characteristics are commonly considered.
• Digital fingerprints: The device fingerprint is used as a label to confirm the identity in device authentication.Similar to the concept of the human fingerprint, device fingerprint refers to the device identification composed of feature information.Based on the information source, device fingerprints can be classified into software and hardware fingerprints.The feature information of the software fingerprint is sourced from the device ID, browser information, and device software environment [132][133][134].Hardware fingerprint emerges from the hardware structure [135], RF device [136,137], accelerometer [138], gyroscope [139], microphone [140], speaker [141], camera [142], Bluetooth [143], or the combination of the stated devices [144,145].PUF is the most common physical attribute of a device, which is a physical aspect naturally acquired from the production process and cannot be cloned.In addition, external attackers cannot easily predict the PUF of a device.Therefore, PUF is used as the "digital fingerprint" of the device and combined with cryptography technology to ensure device security.Certain studies [146,147] consider PUFs as one of the authentication factors and propose a multifactor authentication scheme for privacy protection of IoT devices or other applications.• Context awareness: Context awareness-based authentication can establish secure communication between devices as well as between devices and networks by verifying physical proximity.It can be classified into validation using the inherent properties of the device [148][149][150] and validation using human behavior [151][152][153].Certain researchers [154,155] proposed that certain behavioral characteristics of users can be considered for user authentication.In these studies, the authors used smart devices (e.g., Wi-Fi, smart TV, monitoring equipment) to obtain the physiological and behavioral characteristics of users in their daily use of devices and extracted representative behavioral characteristics from them.

Cloud authentication
Cloud authentication can provide identity authentication that verifies the pairing relationship between an IoMT device and human users.A strong user authentication method can firmly restrict illegal access to the cloud provider and forms the key aspect of ensuring cloud security by allowing only permitted users to access the resources and services.
• Unauthorized User : Cloud computing provides resources and services that are open for public use.If patients migrate their medical data to the public cloud, they will forego their restricted control over the data.Consequently, unauthorized users can deliberately access cloud data to obtain sensitive information for various reasons.For instance, the cloud service provider can predict the user's illness by obtaining information on the medical products accessed by the user.Therefore, access permission should be carefully provided to specific users managing the cloud [156].To this end, Sethi et al. [157] proposed a deep reinforcement learning-based adaptive approach to prevent unauthorized users along with their attacks.The benefit of this approach is that it can overcome the limitations of transitional intrusion detection systems that cannot handle novel attacks.• Eavesdropping: The malicious user can employ network eavesdropping in an attempt to access privileged and unauthorized access to medical data managed in the cloud.The attacker can intentionally infer users' private data without authorization.More importantly, the data can be revised with incorrect information or made entirely unavailable.Chhabra et al. [158] presented a security approach to prevent eavesdropping attacks on the cloud based on ECC, which can secure the services deployed in the cloud.The widely used access control approaches can be utilized to avoid this security issue in the browser [159].• Insecure APIs: Cloud can allow open access to multiple APIs to enable the addition of new components that enhance their functions.However, insecure APIs can expose the environment to malicious threats.For instance, Alibaba's identity APIs support users to access the website via their AliPay account, wherein users can interact with the website using their login information, after which APIs authorize and fetch the account information.Moreover, poorly coded APIs may grant unnecessary access to sensitive data.To prevent this issue, the APIs for cloud resources should be carefully designed to review possible vulnerabilities and timely updates should be packed [160,161].

Key management
Key management is the core component of system security based on cryptography, which is essential for securing IoMT systems.Symmetric cryptography includes a cryptographic algorithm based on a secret/shared key, whereas asymmetric cryptography uses both public and private keys-one for encryption/validation and another for decryption/signature, respectively.Symmetric cryptography has emerged as a focused research area of key management owing to its short key length and relatively small cost of communication and computation.However, a certain amount of resources are required to implement asymmetric cryptographic algorithms such as Diffe-Hellman algorithm.Therefore, in IoMT systems containing several resource-constrained sensors, specific schemes should be developed for exploiting the unique characteristic of medical applications.This subsection is segmented into three categories: (1) cryptographic algorithms; (2) biometrics-based key generation; (3) lightweight encryption and key management.

Cryptographic algorithms
Cryptographic hash function (CHF) is a one-way mathematical function that converts an arbitrary size data to a fixed size.In particular, the exclusive OR (XOR) can be used to inspect the variations in one of its operands.After the application of XOR and hashing, the initial parameters (i.e., sensor ID and shared key) are shared from the key generation server to the sensor and gateway nodes.Thereafter, these nodes can generate their keys using these parameters.The communications in IoMT systems can be secured by combining the CHF with a symmetric key and the XOR operator using the key agreement protocols proposed in [162,163].To resolve the problem of insecure key sharing in symmetric cryptographic algorithms, the CHF function including the ECC keys can be considered a secure certificateless channel between patients and physicians [164].This concept enables secure key sharing between the key generation server in the cloud layer and the nodes in the IoMT sensor as well as the network layers.The ECC public key and initial parameters are hashed using CHF before transmission to the nodes generating the asymmetric keys.This technique can overcome the overhead in certificate management for data storage and share in the cloud [165].Upon segmenting the patient's data into subsets and converting them with ECC keys and CHF, they can be securely shared among the system entities.The average energy consumption in this technique is approximately 30% less than in similar techniques.More recently, the popularity of ECC has been growing owing to its smaller key size and ability to maintain security.To satisfy the confidentiality and integrity requirements of medical applications, a novel enhanced secure sensor association and key management protocol has been designed based on ECC and hash chains [166].In addition to satisfying the privacy demand of the patients on the medical systems, the proposed protocol can be easily implemented with higher efficiency.

Biometrics-based key management
Biometric sensors are used to identify the physical characteristics of users and are the most common technique employed in providing security to IoMT systems.Based on the randomness and high similarity of synchronously detected time-varying physiological signals acquired by biometric sensors, the dynamic physiological features can be extracted to realize secure key management, including key generation and key distribution.
The bio-cryptographic technique can efficiently generate cryptographic keys as it does not require a key pre-distribution mechanism or proper network setup for key generation.In addition, this approach provides an opportunity to automatically re-keying.Generally, bio-cryptographic key generation schemes are based on physiological features that are random, unique, and optimal for cryptographic keys [167].Several researchers used this metric to generate keys, as discussed below.In [168], a bio-cryptographic key management protocol has been proposed to secure the communication of implantable and wearable medical devices.To generate secure cryptographic keys, physiological parameters such as BP, ECG, and PPG tracked by sensors have been utilized.More specifically, two recently developed approaches of physiological parameter generation include time-domain generation to derive interpulse interval (IPI) and frequency-domain generation to obtain cross-power spectral density.Both are promising candidates for generating cryptographic keys owing to their randomness and temporal variance characteristics.Similarly, heartbeat-based random binary sequences (RBSs) [169] are another approach to secure communication of sensory medical devices.This research used a finite monotonically increasing sequence generation mechanism and Hamming distance metric to excerpt entropic bits based on the IPI derived from ECG.Based on each signal, 16 random bits could be excerpted, and to authenticate users, 128-bit RBSs are generated by concatenating eight consecutive IPIs.Gait-based technique considers the human walking pattern to generate unique symmetric keys.Sun and Lo proposed a system that can generate a symmetric key within ten gait cycles using a set of IoMT sensors attached to the individual's body.They claimed that their system can generate three times the number of bits per gait cycle than those generated by similar state-of-the-art techniques [170].By definition, the gait cycle is one cycle of movement between two repetitive events during walking.This system employs an artificial neural network model to generate 13 bits per gait cycle, which will generate a 128-bit key in ten gait cycles, which can be used to secure the communication between the IoMT sensors and the access point or mobile devices in the gateway layer.It outperforms finger-based systems by generating binary keys at various intervals, which induces randomness to the keys without direct user interaction with the system.In addition to key generation, the bio-cryptographic technique ensures key sharing between nodes in case of contact with the body.These schemes assure security without necessitating any human interference by eradicating the prospect of overlooking secret keys.
For the sensor-based networks mostly applied in IoMT systems, especially for those attached to or implanted inside the human body, the nodes are expected to be interconnected, and the body itself can form an inherently secure communication pathway that is unavailable to all other kinds of wireless networks.Researchers have explored the use of this conduit in the security mechanism of body-area sensor networks (BSNs), i.e., using a biometrics-based approach that uses an intrinsic characteristic of the human body as the authentication identity or the means of securing the distribution of a cipher key to secure inter-BSN communications [171].The technique is developed based on a symmetric cryptosystem, which assumes the availability of a robust and secured key distribution scheme.In this respect, random numbers produced from physiological signals are used for encrypting and decrypting the symmetric key for secured distribution.In Figure 7, at the transmission terminal, the biometric trait was used to commit the key.At the receiving terminal, the other biosensor would record its own copy of the trait and use it to decommit the key.If the selected characteristic uniquely represents an individual, the encryption key can be recovered only using the trait obtained from the same individual.Researchers developed a specific symmetric bio-cryptosystem for BSN, considering the generation of the encryption key from physiological signals and its randomness evaluation.This biometric solution is suitable for securing BSN in IoMT, because it achieves a higher level of security with less computation and memory requirement.In addition to securing the transmission of the encryption key within the nodes of a BSN, the biometric trait can be used as an identity for entity authentication in a BSN (i.e., node-to-node authentication).Furthermore, a possible two-session communication protocol has been discussed, wherein the server initiates the communication by transmitting the biometric trait along with a nonce to the client for comparison.If the trait and nonce matche, the client responds by transmitting the nonce along with the variant biometric trait.A communication pathway would be established only if both the and client verified the correspondence of the received copy with that in hand.
Another key-sharing scheme is based on fuzzy pattern recognition, primarily including a vault for secure key distribution that is suitable for features from disordered or irregular physiological signals [172,173].A shared symmetric key is used to enable communication and require one entity to project the security attributes calculated from the physiological signals on a polynomial and transfer the attribute points along the chaff points to the other side recreating the polynomial centered on certain common attributes.This scheme enhances security by minimizing the rate of data exchange during the key management process, and therefore, increases the lifespan and energy efficiency of the network [174].However, owing to the small size of the attributes, the security of this scheme is entirely dependent on the weak vault size [175,176], which indicates that an adversary can estimate the appropriate points in the vault.

Lightweight encryption and key management
In the IoMT application environment, some terminal nodes have limited resources, including computing resources, storage, and communication resources.Traditional symmetric encryption methods, such as Data Encryption Standard (DES) [177] and AES, can ensure the encryption and decryption rate of stored data, but their key management is complicated for constrained nodes.Moreover, traditional asymmetric encryption methods, such as RSA cryptographic algorithm, are not suitable for dealing with the everincreasing data from a large number of users and devices, although their keys are easy to manage.In this case, lightweight encryption and key management is required, especially in sensor-based networks.For IoMT systems containing a large number of wireless sensors and mobile devices, researchers [178] designed a key management and authentication protocol based on symmetric cryptography using only hash functions excluding the public key-based ECC, in which sensors with limited capabilities only need to perform lightweight symmetric encryption schemes.
References [179] and [180] presented a vibration-based lightweight key exchange protocol and ultralow battery resilient mechanism between external and wearable devices.The external device produces a key and modifies it into a vibration signal.On the other side, the wearable receives and transforms signals into bit string using the two-feature On-Off Keying demodulation mechanism to encrypt further communications.However, the vibration-based scheme has a defect, i.e., an adversary would be capable of extracting keys from vibration signals since they are acoustic and electromagnetic waves that can be captured.In [181], an optical secure communication channel between an implantable medical devices and an Biometric features, as one significant characteristic of IoMT systems, can be exploited to support lightweight key management as well.Reference [182] proposed a lightweight noise-based group key generation method exploiting gait features (as shown in Figure 8), which utilizes the noise signals imposed on the raw acceleration signals to generate an M-bit key with high randomness and bit generation rate.Moreover, a signed sliding window coding (SSWC)-based common feature extraction method was designed to extract the common feature for sharing the generated M-bit key among devices worn on different body parts.Finally, a fuzzy vault-based group key distribution system was implemented and evaluated using a public dataset.
In a biometrics-based security solution, entity identifiers (EIs) of each node in a BSN were generated for securing the distribution of keying materials.Due to slight differences in the biometric traits collected from different parts of the same subject, fuzzy schemes, such as fuzzy commitment and fuzzy vault, were used to protect the transmission of keying materials using generated EIs.One example of generating EIs is to use the IPI calculated from ECG and PPG signals, about the 30s of ECG/PPG signals are required to generate 128-bit EIs in such solutions [183].Authors in [173] proposed lightweight and resource-efficient biometrics-based security solutions, especially aiming at the energy-constrained BSNs.In this study, an improved key distribution solution with the energy distribution information of physiological signals (EDPSs)-based EIs was proposed.Only 5s of ECG/PPG signals are required in the proposed solution, enabling rapid EI generation and key distribution.User-dependent fuzzy vault was proposed to secure key distribution with a high recognition rate.The performance of time-varying randomness and identification rate are evaluated to examine EIs' feasibility in securing the transmission of keying materials.
Considering that the IoMT systems need to accommodate various end users including a mass of sensor-based devices, hierarchical network structures such as fog computing and edge computing are employed to improve the network capacity and efficiency.To cope with the security challenges after introducing fog computing, a new security architecture for fog computing which protects privacy and supports device-to-device (D2D) communication is designed [184].On this basis, three corresponding two-factor anonymous authentication protocols are proposed, which adopt a one-way function, XOR operation, and other lightweight methods, all suitable for edge devices with limited computing capacity.In another multi-factor authentication method, a pattern-based technique uses a tab pattern generated to be performed by the patient to control the sensor [185].This technique can keep the sensor communication turned off until a specific pattern is performed, preserving the sensor's battery power.After successfully passing the first factor with the medical controller in the gateway layer, the controller sends a random tab pattern as a second factor to the user before executing a sensitive command.

Physical layer security
The data transmission in an IoMT environment occurs via wireless networks, especially in WSNs.However, the wireless network is vulnerable to eavesdropping, interference, forgery, and other threats.Traditional network security mechanisms require complex interaction protocol design and additional bandwidth resources.In this case, a new mechanism to realize communication security emerges using physical layer signals of a wireless network.The physical layer security mechanism utilizes the characteristics of physical channels, such as time variability and mutuality, and offers the advantages of low energy consumption, high security, and low computational complexity.
Currently, with 5G communications, technologies such as multiple-input multiple-output and orthogonal frequency division multiplexing are conducive to constructing a physical layer security scheme [186].The physical layer security is derived from information theory security, and this research focuses on identity authentication, channel coding, shared keys, and multiparty computation, among other related aspects.Wyner [187] first reported that secure message transmission can be realized by designing appropriate codes in insecure channels, which was the first proposal of the concept of secure coding.Against unauthorized users, a cooperative strategy is proposed in [188] with the interaction of a helper based on the wiretap channel capacity.Thereafter, Maurer [189] first proposed the use of channels to achieve key generation and distribution.In [190], the information theory method is used to generate and distribute secure keys, which were extracted and generated from communication channels.The random character of the wireless channel is used to independently generate a secure key through multipath [191,192].
Wireless signal characteristics are utilized to secure the IoMT systems by generating keys without prior connections.Radio signal strength (RSS) is one of these characteristics that measure the received signal power, which varies with its transmission medium.Implantable medical devices can be excellent candidates for this technique, specifically, because the RSS value variation inside the human body varies from that outside the body [193].The proposed technique utilizes the randomness in RSS values to generate a shared key that can be used to secure the communication between a headless cardiac pacemaker and a subcutaneous (under-the-skin) implant without knowing the keys.In this technique, two bits can be extracted from a single cardiac cycle (a beat) using a 128-bit key in 60 s, considering the average human heart rate of 64 beats per minute (bpm).

Access control and data authorization
By restricting access to key resources, unauthorized users can be prevented from intruding or damaging the access to systems and data.Accordingly, network resources can be legally used.A role-based access control strategy has been proposed in which various roles are endowed with distinct access control permissions.From the perspective of the spatial-temporal relevance of data, Ray et al. [194] introduced the policy of location information grounding on role-based access control (RBAC).Herein, the user location determines whether it has the right to data access.The scale-based space-time RBAC model proposed by Zhang et al. [195] enhances the expressiveness of access control policies as well as the security of the model.In addition, attribute-based access control (ABAC) [196] sets access permissions by comprehensively considering various attributes such as users, resources, and environments.In contrast to the user-centric approach in RBAC, ABAC considers all dimensional attributes to achieve fine-grained access control.Based on ciphertext attribute encryption, researchers in [197] proposed a method that formalizes public and private keys into permissions and implements access control by designing these keys.Ruj et al. [198] proposed an access control framework that can realize privacy protection and authentication for big data stored in the cloud.Specifically, hierarchical access control has been employed to facilitate hierarchical access to privacy-sensitive data of patients.A representative approach utilizes a hierarchical role-based model to provide authorization based on the user's role [199].For instance, all authenticated nurses can administer medicines but only personnel authenticated as a doctor can prescribe a new medication.The model supports a relatively low complex hierarchical security scheme that encrypts the patients' data and decrypts only the part of the data that are under the user's authority.
According to the system, architecture explained in Section 2, the data from sensor-based end-user networks are mostly uploaded to cloud servers through gateway nodes (e.g., mobile phones, and tablets).In [200], authors reported that data security and privacy cannot be easily ensured for mobile networks and cloud computing.Homomorphic encryption (HE) preserves data confidentiality and permits limited mathematical operations on encrypted data.This technique protects the patient's data privacy and stores them as ciphertext in the cloud layer for mathematical operations such as those for ensuring data integrity.However, it differs from other techniques that allow only the patient to review their own data but not the professionals, except in emergency scenarios.Thus, this is the application for certain IoMT sensors such as a smartwatch that allows the encryption of data at all instances and is only observed by the patient, except in case of emergency, during which the patient's data can be forwarded to professionals for diagnosis.Overall, HE can be conducted through three distinct schemes: (1) partial HE (PHE); (2) somewhat HE (SHE); (3) fully HE (FHE).In particular, PHE supports only one mathematical operation for an unlimited number of times, whereas SHE supports only a limited number of operations.In contrast, FHE supports an unlimited number of operations, and therefore, is suitable for the rapid aggregation of data without compromising data confidentiality [201].Thus, FHE is ideal for healthcare monitoring systems in hospitals.Optimal HE is a modification of the FHE, and it differs from FHE as it is based on the step-size firefly optimization algorithm, which selects the key with the maximum breaking time [202].This technique reduces the computation period and increases the breaking time by 2%-8% compared to other HE and non-HE techniques.

Privacy protection
During communications via IoMT networks, especially via wireless networks, each interaction of the users inevitably generates a considerable amount of personal data, which can be easily attacked by malicious attackers during the data-sharing process, thereby posing a severe threat to privacy.From the aspect of data communication, this technology is classified into two categories, as described below.
• Data transmission-based: Data distortion technology [203] realizes privacy protection by perturbation of the original data.The distorted data should satisfy the following requirements: first, the attacker cannot discover the original data, i.e., attackers cannot reconstruct the original data from the published distorted data.Second, the distorted data still maintains certain original properties, i.e., the information derived from the distorted data is equivalent to that obtained from the original data, which ensures the feasibility of certain applications based on the distorted data.Presently, privacy protection technologies based on data distortion include randomization, blocking, information exchange, and condensation.• Network structure-based: In IoMT systems, the heterogeneous network comprises distributed structures.Secure multiparty computation (SMC) [204] is extensively applied in distributed environments.Typically, privacy protection can be described as the SMC problem in absence of a trusted third party [205,206], i.e., each of the two or more sites is aware of only its own input and the computation output for all data and does not disclose any information.Distributed clustering uses encryption technology to secure data transmission.The fundamental principle of this method is to ensure the security of distance calculation between the data points.
To conclude this section, a brief summary of network tier security is listed in Table 4.We predominantly focused on the connectivity between the sensing tier and the cloud infrastructure tier, where widespread technologies of authenticated visiting, encrypted data sharing, and reliable system maintenance were explained from the perspective of IoMT applications to provide a comprehensive understanding.In general, the majority of security solutions for existing network systems are applicable to IoMT systems as well.Although the application scenarios should not involve excessive alterations to the devices/servers of IoMT systems, novel technologies are required to adapt to specific IoMT applications.For authentication and key generation at the personal server level, biometrics can be applied in IoMT systems, because biometrics data can be easily sourced from medical and healthcare devices attached to or implanted in the human body.Combined with the unique strength of biometrics, these technologies can offer significant advantages to IoMT systems.Moreover, secure yet lightweight schemes should be designed to produce a diverse range of devices with restricted access.However, the limited capabilities of existing solutions compromise their security performance.Access control and data authorization [27,[194][195][196][197][198][199][200][201] Interruption Privacy protection [203][204][205][206] 5 State-of-the-art cloud security for IoMT applications Cloud refers to the infrastructure of the cloud-based IoT system, comprising the computation and storage resources to process and store the data collected by sensors.The cloud is designed as scalable, geographically independent, and transparent to users with on-demand provisioned resources.Because of these attractive features, the cloud has been applied as the prevalent platform for numerous IoT devices, including IoMT devices targeted for the medical area.The Cloud can serve the following functions: (1) identity authentication that verifies the pairing relationship between an IoMT device and human users, (2) data storage that stores the data acquired by the IoMT devices along with their operational data such as log data and runtime data, (3) data analysis that processes the fetched data or outputs the analyzed data with visualized results.Based on the investigation, we classified the cloud security for IoMT applications as hardware security, cloud storage security, and virtualized platform security.The taxonomy based on the classification is portrayed in Figure 9.

Hardware security
The hardware-related security issues that support the physical environment of the Cloud are discussed herein along with the potential solutions.

Natural disasters
A natural disaster occurs due to geographical location and seasonal climate.The hardware in cloud data centers can be exposed to disasters (extreme weather), e.g., thunderstorms, floods, and earthquakes, all of which can influence the availability of the cloud infrastructure and the services operating on it.In 2016, Amazon's cloud data center located in Sydney experienced a power outage, rendering various bank cards of numerous users temporarily useless1 .The eHealth system that manages the medical data can encounter this problem in the occurrence of a disaster.Therefore, the locations of cloud data centers should be carefully selected to avoid the natural influence [207], and accordingly, disaster recovery solutions should be formulated [208].them inaccessible [209,210].The US cloud storage supplier, Swissdisk, suffered from an unplanned and unpredictable catastrophic hardware failure that disavowed users from accessing their data.Thereafter, the company decided to invest considerable resources to enhance a state-of-the-art platform.Resource replication and erasure coding are prevalent approaches that ensure hardware availability [211].However, these approaches involve certain trade-offs in terms of durability, network bandwidth, energy consumption, and recovery performance.To avoid the issues of hardware functional safety, the hardware development process should be adapted to the requirements of certain standards such as ISO 26262 for functional safety of electrical or electronic systems.

Infrastructure data leakage
This kind of issue represents the leakage of key administration information to malicious users, which can result in the misuse of cloud resources.Digital currency mining, email spam, and phishing attempts are certain representative examples.Unfavorably, cloud providers bear an immense loss if the attacker can directly access hardware resources.For instance, an attacker exploits the leaked data to obtain all privileges of the cloud resources and launches a set of power VMs to execute currency mining tasks, which consume considerable resources and electric power.Kiara et al. [212] proposed an authentication methodology and multifactor user authentication (e.g., special keyboard and server-side authentication code to prevent infrastructure data leakage by unauthorized access.Chen et al. [213] presented an infrastructure framework for community medical IoT, which includes transmission protection, storage protection, and access control based on various encryption schemes.

Inadequate infrastructure design
This issue is caused if the cloud provider fails to notice the potential surges in the number of users, which causes insufficient provisioning of resources for the applications.For instance, enormous traffic arrives at a single point of the critical physical node, resulting in unacceptable delays and SLA violations.The Sina Weibo application can fulfill the surge in requests caused by trending topics [214], which can occur in IoMT applications as well if numerous users are accessing the same application.To address this issue, property resource scheduling policies should be designed, such as autoscaling approaches that can dynamically add/remove resources in cloud data centers [215] and accurate workload prediction algorithms that can forecast future trends [216].

Cloud storage security
The security issues related to cloud storage and the promising solutions addressing the corresponding issues are discussed herein.

Data loss and leakage
Intrusion action or disk corruption can cause data loss and leakage in cloud storage without redundancy.This serious security issue can significantly impact privacy and trust in addition to affecting the servicelevel agreements negotiated with cloud users.The data leakage can affect the normal maintenance of IoMT applications, e.g., the administration password is leaked, where the malicious users can leverage the permission to operate the data stored in the cloud.Kaur et al. [217] have discussed certain existing approaches to protect against data leakage, which include techniques such as local scanning of data and remote scanning.The agents installed on the devices will conduct the regular examination to avoid data loss and leakage.

Data manipulation and integrity
A malicious attacker with privileged access to cloud infrastructure can employ a variety of techniques to achieve their objectives.To manipulate the data in cloud storage, an attacker with complete control over the data blocks can read, insert, modify, and even corrupt the data in cloud storage.Full control over storage enables an attacker to injure the confidentiality, integrity, and availability of customer data.Consequently, this type of attack has become the mainstream to hurt cloud storage security.Huang et al. [218] designed an attribute-based proxy re-encryption algorithm to avoid data manipulation for the eHealth system based on blockchain.Considering the advantages of traceable and tamper-resistant features of blockchain, any entity with an illegal manipulation of data will be held accountable for the evidence.Manipulation can hurt data integrity which refers to the integrity of customer data.However, in the cloud computing environment, users can access their data stored in the cloud in a distributed manner, which can suffer from the consistency issue under the security property.Although cloud applications rely on the assurance of cloud service providers to a certain extent, the vulnerabilities can be secured by incomplete security examinations such as the errors caused by the global clock.Pandey et al.

Encryption
Cloud environments should ensure the secrecy of sensitive data while providing normal utilization of data.In this regard, encryption is the essential mechanism that ensures data confidentiality through protection, communication, and certain activities against malicious users aiming to disrupt the normal operation of the cloud.A significant amount of work has been investigated to achieve confidentiality while targeting other properties such as integrity, availability, authenticity, and privacy [222].Cryptographic techniques based on attribute-based encryption aim to provide privacy and fine-grained access control, including proxy re-encryption, revocation mechanism, and hierarchical attribute-based encryption [223][224][225][226].

Malware
Malware refers to malicious programs injected into cloud storage, which can join the host into a zombie network and continuously add new hosts to the network.The hosts can be either physical machines or VMs in the cloud environment.As reported, half of the downloaded malware can disable local security in one minute.As such, threats combining new techniques with traditional evasive attacks can damage security, which is referred to as malware-as-a-service.A significant amount of effort has been devoted to efficiently detecting malware [227].For instance, Watson et al. [228] proposed an online anomaly detection approach based on a support vector machine with high detection accuracy.This approach can detect new malware without prior knowledge of functionalities.Yadav et al. [229] presented a consolidated weighted fuzzy k-means clustering method to identify malware with high precision.

Data inference
In addition to data manipulation, a malicious attacker can observe and analyze the access pattern of users to predict the user data stored in the cloud, which is called data monitoring and inference.The standard encryption approach fails to appropriately conceal the access pattern.Therefore, with this kind of attack, the attackers can compromise the confidentiality of the cloud customers' data.Inference represents the data mining approach to explore the data hidden behind common users.In a cloud storage scenario, data inference indicts the database system technique to injure the databases.The attackers aim to infer sensitive data from the databases with a high-level perspective that can compromise the entire database.If inference problems are not addressed, the sensitive information may be exposed to external users.To ensure efficient and fine-grained access to electronic health records, Zhang et al. [230] proposed a multiphase access policy to achieve an inference attack-resistant system.Each data attribute in records is individually encrypted, and the Cloud will execute the computation-intensive data without prior knowledge of the sensitive data.Ma et al. [231] proposed an inference-aware mechanism in multitask learning, which can resist the inference attack through immediate results.Deznabi et al. [232] analyzed genomic data based on the Markov decision process and provided a message-passing algorithm to avoid inference attacks on genomic privacy.

Virtualized platform security
The security issues related to the virtualized platform that provides physical or virtual resources to support the execution of IoMT applications are discussed herein, including the corresponding solutions.

Data migration
In a traditional cloud computing environment, VM live migration is a significant feature that shifts a VM from one place to another to optimize resource usage.The cloud-native applications that shift the monolithic applications into lightweight applications can migrate/reschedule containers developed via microservice architecture from one physical host to another.However, security problems can be triggered during the migration process.For instance, the data is not completely transferred and yields consistency problems, which can be attacked by malicious users to conduct useless migration and consume resources that diminish system performance.Shakya et al. [233] proposed a framework for security analysis and security protection during data migration.Sighom et al. [234] discussed a set of encryption approaches to investigate the elements that can affect system performance.Subsequently, they proposed an enhanced model based on the existing protocols with demonstrated security assessments.

Data separation
The Cloud supports multitenant scenarios by sharing resources for multiple users.To utilize the benefits of the cloud, users need to migrate their data to the cloud.However, certain users avoid migrating sensitive data to public cloud networks, which necessitates data separation [235].In principle, data separation aims to ensure that the data are well-partitioned, i.e., the user can access the data in his/her own domain but not in other domains.However, during the data separation process, sensitive information can be leaked, which poses high risks.If the data is separated in physical devices, the data can have loss or disclosure because the data is not completely formatted or used by other tenants, which can increase the costs.Moreover, the complexity of managing the security of data separation increases because of the geolocation feature of data.A significant amount of recent research has contributed to the area of mobile edge/cloud computing area, which can efficiently address this issue.For instance, Wu et al. [236,237] proposed data separation approaches based on neural networks to transfer data between cloud and mobile devices.In this manner, sensitive data can be locally managed.

Operating system security
Owing to the heterogeneous nature of cloud computing, various kinds of OSs working together can create a set of security issues.For instance, vulnerabilities exist widely in preventing the normal functioning of OSs such as Windows, Linux, and iOS.These operating systems need to frequently update or packed to solve security problems.In the desktop OS, the remote code execution vulnerability bug permits the unauthenticated remote attacker to execute codes by sending network packets and presuming control over the OS.In the mobile OS, the increasing popularity of smartphones can attract more attacks, and the common issues include insecure data storage and broken cryptography.In 2015, the iPhone OS reported a severity issue that allowed the attacker to execute codes in the privilege mode or cause DoS attacks2 .Xu et al. [238] proposed a virtualized education platform that provides an environment to perform private experiments.The proposed platform is based on a software-defined network to secure access via OpenVPN.In practice, most vulnerabilities are solved by commercial enterprises and open-source communities.

Virtualized software functional safety
Cloud services enable users to publish and share the image of virtualized instances that implement software functions and contain program codes such as VM images and container images (e.g., Docker image published in Docker Repository) [240], as depicted in Figure 10.However, the threat is that the shared image can be used to trick victims by using malicious functions to harvest the sensitive data stored in the images (e.g., default user names and passwords stored in property files) [241].Therefore, this kind of attack can influence both integrity and confidentiality.To address this security issue, Wei et al. [242] proposed an image management system to control access to VM images and track the provenance of VM images.To ensure the security of a container image, Fotis et al. [243] introduced a mechanism to protect the Docker container images via the enforcement of access policies.Kwon et al. [244] proposed a vulnerability diagnostic system for Docker images by analyzing and detecting anomalous behaviors.

Compromised hypervisor
The compromised hypervisor represents the threat in which the attacker aims to control the hypervisor isolating the cloud users and the virtualized environment [245], such as VMs or containers.These types of security issues can significantly impact system security by stealing the visibility permission of users' data and resources and even manipulating the users' data.By controlling the hypervisor, the attacker can cause severe damage by leveraging the capability of VMs and containers.Therefore, confidentiality, integrity, and availability can be undermined after gaining partial or complete control of the hypervisor.Lin et al. [246] proposed a VM protection approach for compromised hypervisors based on privilege level execution, which can create effective VM isolation and data-driven VM monitoring to reveal the user-sensitive information stored in VMs.This approach is advantageous because it is independent of platforms and can be widely applied to multiple cloud providers.Li et al. proposed Hypes [247] to retrofit a commodity hypervisor by leveraging the microkernel principles that protect the confidentiality and integrity of VMs, which partitions the hypervisor into an untrusted host that is only responsible to perform the functionalities without handling sensitive data.Although sensitive data can be accessed by trusted cores, this approach is limited because of the additional costs required in its implementation.Based on the partitioning approach, Liu et al. [248] introduced another approach that can separate the fundamental and crucial privilege into the trusted environment to monitor the hypervisor.This approach is advantageous because it does not depend on a higher privilege than the hypervisor.The container-based security of the hypervisor has garnered scholarly attention, following the trend to shift the virtualized environment based on VMs into containers.Khalimov et al. [249] have explored the use of container-based environments as an alternative to the hypervisor-based sandbox for security analysis.
In conclusion, the cloud security of IoMT systems has attracted scholarly attention from a wide range of perspectives.To elucidate, the Cloud security issues, compromised features, mitigation, and corresponding solutions are summarized in Table 5.Note that the security approaches for hardware, cloud storage, and virtualized platforms have been standardized across the cloud layer comprising well-known security techniques such as resource replication, masked authenticated messaging, admission control, and transmission protections applied to common scenarios.Furthermore, we determined a set of security mechanisms for new threats unique to cloud security, such as malicious VM images and cloud-side encryption for authorization, authentication, and confidentiality methods, which indicates future research directions.In addition, we highlight the emerging problems unresolved by current solutions, such as identification and management of malicious container images for IoMT services in a cloud-native environment.

Challenges and research directions
Although this review explored the security issues in IoMT applications, supported networks, and cloud infrastructure from a diverse perspective, the research gaps and challenges have only been partially addressed.These challenges are summarized below.
• Identification of Malicious Container Images.The cloud-native environment has been regarded as the new generation of cloud computing and has shifted monolithic applications into lightweight and self-contained microservice-based applications.The applications including IoMT services can be deployed on VM or container images, which may be attacked by malicious users.However, limited research has been conducted regarding the security issues in the container-based environment, and the identification of malicious container images is still a challenge for the cloud-based scenario that supports IoMT services.
• Regulations and Licensing.With the integration of IoMT devices into comprehensive medical facilities, adherence to compliance regulations, and security of licensing approvals are mandatory.The majority of devices aimed at acquiring, transmitting, or analyzing information are subjected to compliance regulations and licensing approvals.Although manufacturing these devices is a time-consuming process, it is not the only challenge experienced by healthcare service providers employing IoMT.Regulatory compliance is a considerable hurdle that must be successfully addressed, and in the future, neglecting this challenge can increase the overall risks and legal costs.• Tradeoff between Interoperability and Data Security.A crucial challenge is caused by the dearth of systems that collate and utilize the massive amounts of data collected from medical devices.In healthcare, various departments often operate in silos and may not efficiently communicate with each other.To garner critical insights from the generated data, the installed systems should interact with each other.The integration of IoMT systems can yield extensive medical interoperability among crucial devices in the systems.However, the data related to patient health and information contain inpatient databases such as credit card details, addresses, and email IDs, which are highly demanded by hackers.Thus, IoMT devices are fundamentally designed from a utilitarian perspective and frequently employ legacy software that is not equipped with in-built data security features.Consequently, with the extension of data interoperability, certain vulnerabilities prevail in the devices and across various healthcare departments in the hospital.• Long-term and System-wide Comprehensive Security.From the system perspective, integrated security involves multiple elements, agents, levels, and links, with significant complexity (including high dimensionality, multiscale, nonlinear, openness, integrity, interaction, coupling, interactivity, and dynamics).Integrated security has emerged as one of the key research directions and tasks in the field of safety science, which constitutes one of the major challenges of safety science in the 21st century.To mitigate the security challenges caused by integrated security problems, security researchers should update their research concepts, develop research ideas, focus on strengthening the scientific research on complex security, and conduct long-term and system-wide comprehensive security research on complex giant systems (including human beings and human activities).
The opportunities and future directions of research are presented as follows: • Firmware Upgrades.IoMT devices must be regularly monitored and patched with critical firmware upgrades that optimize the performance of the firmware or device drivers to potentially improve the performance of processors and related device hardware.These updates eliminate existing glitches, bugs, or new security vulnerabilities.• Security-by-design Device.The security-by-design approach provides application protection through sophisticated data, function, and control-flow transformations, anti-debug, whitebox cryptography, and active integrity verification.The integration of this security technology with an enterprise security information and event management solution provides an advance warning of threat actor activity before the device or software is impacted.The real-time health checks of device software, correlation, and forensic analysis of all security data and event feed aid in preventing attacks and automating incident response playbooks.• Segmenting Security.The vast majority of device-to-device communications are superfluous.Overall, security through segmentation forms one of the best practices.Upon creating a separation between patient data and the remainder of the IT network, cyber security experts can understand network traffic and improve anomaly detection.Consequently, deeper insights can be obtained into atypical traffic patterns or movements implying the presence of an intruder or a cyber infection.• Blockchain-based Techniques.The current approaches to security assurance preventing the data manipulation of cloud services and cloud storage (e.g., medical data) are based on traditional encryption algorithms.The promotion of blockchain technology has provided an option for traceable and tamper-resistant data, which can prevent the illegal modification of sensitive data.Moreover, the data in the IoMT scenarios can be secured with further developments in blockchain technology.• Microservice-based Applications.Although a significant amount of effort has been devoted to ensuring the security of traditional applications, an increasing number of applications have been shifted from monolithic applications into microservice-based applications.The security issues in the virtualized environment of the microservice platform, such as container image security and data isolation between containers, have not been comprehensively investigated, and thus, require focused attention.• Data Management with Federated Learning.The data management between the user's local device and remote cloud servers is a challenging task because partitioning the data to ensure user privacy and data processing efficiency is difficult.Federated learning is regarded as a promising paradigm that locally retains the sensitive data and outsources the insensitive data to the cloud, e.g., the personal data of patients can be processed using local devices and general information can be trained by the AI models in the cloud.The distributed data can coordinate to fulfill the requirements of medical-oriented tasks.• Research Direction of Integrated Security.The integration security problem can be resolved by performing certain frontier-specific research such as (1) integration security methodology; (2) the interrelation, function, response, and feedback mechanism of various risk factors in integrated security; (3) integrated security collaborative governance; (4) prediction, response, and response of local and overall security modifications of the system; (5) prevention and resolution of systemic security risks; (6) emergence of system security risks.

Conclusion
IoMT is essential for precision health as it improves the timeliness and quality of care while reducing the complexities and costs of patient care, especially in the management of a pandemic crisis.As data security and prediction accuracy have been the primary concerns in this area, the related security issues should be treated with concern, thereby highlighting their significance to develop and implement successful security strategies in IoMT systems.This paper presents a comprehensive review of research on IoMT systems, focusing on the corresponding security and privacy problems.This paper projects an overview of IoMT systems from the aspect of hierarchical system architecture and details the assessment of the security metrics conducted based on the performance demands of network services.The state-of-the-art security techniques relevant to this research domain have been discussed with respect to the potential security risks.The security issues and solutions for the sensing layer, network layer, and cloud infrastructure layer in IoMT systems were explained and analyzed to ensure their compliance with the system architecture and performance demands of various network services.Specifically, the significance and uniqueness of biometrics-based technologies are potentially the most beneficial approach for the authentication and key management of IoMT systems, which were detailed including the future research directions for further improvement.The current challenges and future research directions revealed the immense potential of extensive uses by the employment of emerging technologies for security.

Figure 1 .
Figure 1.Multiple physiological data monitoring outside hospital.(a) Wearable devices for multi-physiological monitoring; (b) devices installed in home or automobile can passively monitor various physiological data such as biological fluids, human behavior, and physiological signals

Figure 3 .
Figure 3. Classification of sensing layer security for IoMT systems

Figure 4 .
Figure 4. Classification of network security for IoMT systems

4. 1 . 1
User authentication For user-wise authentication, typically three types of information are employed: (1) password-based authentication based on "what you know"; (2) physical-based authentication based on "what you have";

Figure 5 .
Figure 5.Comparison of several typical biometric features

Figure 6 .
Figure 6.Flow chart of multiscale power spectrum feature extraction and identification in[126]

Figure
Figure Application of biometrics-based approach to secure interbody[171]

Figure 8 .
Figure 8. Overview of lightweight noise-based group key generation method using gait features in [182].(a) Overview of proposed wearable sensor network; (b) overview of network access process

Figure 9 .
Figure 9. Classification of cloud security for IoMT applications

Jikui
Liu received a B.S. degree in biomedical engineering from the Shandong First Medical University, Taian, China, in 2010, the M.S. degrees from Changchun University of Science and Technology, Changchun, China, in 2013, and a Ph.D. degree in computer applications technology from the University of Chinese Academy of Sciences, Shenzhen, China.His research interests include biomedical signal processing, medical image processing, biometrics, machine learning, the internet of medical things (IoMT) and wearable intelligent monitoring of cardiovascular disease.He has co-authored 15+ peer-reviewed papers published in international journals and conferences, such as IEEE IoT, IEEE JBHI, Information Fusion.Shudi Bao received a B.S. degree from Ningbo University, Ningbo, China, in 1999, and the M.S. and Ph.D. degrees from Southeast University, Nanjing, China, in 2003 and 2007, respectively, all in communications and information systems.She was a Research Assistant at the Joint Research Centre for Biomedical Engineering, Chinese University of Hong Kong, a Research Associate at Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences, and a visiting scholar at Imperial College London.She is currently a Professor at Ningbo University of Technology and also the dean of the School of Computer Science and Technology.Her research interests included information security, private computing, and Internet-of-Things in healthcare.Ye Li received the B.S. and M.S. degree from the University of Electronic Science and Technology of China, Chengdu, China, in 1999 and 2002, respectively, and the Ph.D. degree from Arizona State University, AZ, U.S. in 2006, all in electrical engineering.Since 2008, he has been the Director of the Research Center for Biomedical Information Technology, Shenzhen Institute of Advanced Technology, where he is currently a full Professor with the Chinese Academy of Sciences.His current research interests include wireless body sensor networks, wearable sensors, mobile health, and medical signal processing and analysis using artificial intelligence.Jianzhong Li is a chair professor at the Shenzhen Institute of Advanced Technology and a professor at Harbin Institute of Technology, China.His current research interests include big data computation and wireless sensor networks.He has published more than 400 papers in refereed journals and conference proceedings, such as VLDB Journal, IEEE Transactions on Knowledge and Data Engineering, IEEE Transactions on Parallel and Distributed Systems, SIGMOD, VLDB, ICDE, and INFOCOM.His papers have been cited more than 20000 times and His H-index is 65.He has been involved in the program committees of major computer science and technology conferences, including SIGMOD, VLDB, ICDE, and INFOCOM.He has also served on the editorial boards for distinguished journals, such as IEEE Transactions on Knowledge and Data Engineering, and refereed papers for varied journals and proceedings.Hairong Zheng is presently the deputy director and professor of Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences, and the director of the National Innovation Center for High-Performance Medical Devices.He is also the vice President of the Chinese Society of Biomedical Engineering and the Executive member of the International Federation of Medical and Bioengineering (IFMBE).His current research interests include medical imaging technology and systems, information technology, and theoretical methods in medical imaging applications.He proposed the fast imaging theory of physical and mathematical prior information fusion, systematically solved the problem of high-field fast MR imaging technology, and realized clinical applications.He developed the non-linear acoustic radiation force theory, invented the ultrasonic shear wave quantitative elastography instrument, and the original non-invasive ultrasonic neuromodulation technology.

Table 1 .
Comparison of this study with previous reviews

Sensing Layer etwork Layer Cloud Infrastructure Layer Medical Equipment Wearable Devices
Figure 2. Hierarchical architecture of IoMT systems

Table 2 .
Communication technologies in IoMT systems IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN)-is inexpensive, easily adaptable, and consumes less power, which makes it suitable for sensor-based IoMT systems.•Ethernet-as one of the most widely used standards proposed by the IEEE for wired connectivity, ethernet enables the provision of connectionless user data integrity, origin authenticity, and data confidentiality.

Table 3 .
IoMT devices and peripherals security taxonomy of state-of-the-art

Table 3 ,
including compromised features, mitigation, and corresponding solutions.The security of IoMT devices still needs to encounter threats

Table 4 .
IoMT network security taxonomy of state-of-the-art .1.2Hardware functional safety This kind of safety issue is associated with the functionalities of hardware, ranging from switches to physical servers in cloud data centers, which can deteriorate the functionality of the cloud services and render

Table 5 .
Cloud security taxonomy of state-of-the-art