# Tokens Shuffling Approach for Privacy, Security, and Reliability in IoHT under a Pandemic
## 2 Related Work  
All new and smart technologies depend mainly on data, which have become the real wealth in this era [20]. However, on the dark side of these technologies, collecting a lot about our data, our lives, and our surroundings and storing and analyzing them make these technologies capable of discovering a lot of sensitive information about each person, and they may also find information that the person does not know about his behavior, habits, and character [21]. Thus, the development in the level of these technologies and smart services has resulted in the emergence of a new challenge related to the issue of protecting security and privacy. No user is comfortable disclosing his data (for example, his medical data) to the public, where these data may be exploited maliciously and greatly affect the user and his life. The most dangerous thing is dealing with a malicious or hacked service provider. Thus, this server may manipulate its data to reveal information outside the scope of the announced service, which is called a privacy violation [22]. In general, privacy can be defined as a person's right to determine for whom, when, how, why, and where the user's data will be used. It means users' right to access and manage the data completely. At the same time, it means ensuring that their identity is not revealed to others and that they are not tracked [23]. As for security, it is an older concept than privacy, and it is imperative to protect the confidentiality and integrity of data (not to modify it) and, finally, its availability and non-stop service. The best solution is the one that provides both. For more details, see [24]. Many techniques and methods have been introduced to protect privacy and security, but they still suffer from open problems. Moreover, there is no practical approach that can be used during a pandemic, where the accuracy of data is a critical issue in addition to performance and reliability. The following points discuss the most common protection approaches, their drawbacks, and why they are unsuitable for COVID-19 scenarios. Processing data approach [25]: this approach depends on summarizing or analyzing the data and finding the knowledge by using statistics methods or data mining before sending it to the service provider. It is valid for specific applications but not valid for medical applications because it modifies the data, especially in pandemics, where we need accurate data and not summarized or modified data. Access permission approach [26]: it is related to user awareness. It enables him to access his data and ensure service provider (SP) compliance with privacy laws such as the General Data Protection Regulation (GDPR), which will allow the data owner to grant access permission to his data. So, the SP must obtain data access permission before using or sharing these data. This approach is insufficient to deal with the malicious server or external attacker. Encryption and Authentication [27]: encryption is adopted in many services to ensure the protection and confidentiality of data, but it does not preserve the data privacy of users in relation to service providers themselves. This is because the service provider can collect a lot of data, create a profile for each user, and reveal a lot of sensitive information that is not authorized. Thus, it is not suitable alone in health systems and services. Authentication ensures the reliability of users and avoids counterfeiters or unauthorized access to a service. Notably, this approach focuses on data security more than privacy. Blockchain [28]: many medical systems started depending on blockchain, which provides a reliable environment for saving, integrating, and preventing repetition and modification. However, the blockchain does not achieve privacy in relation to the service provider's side or the cooperated node. Thus, blockchain is considered an excellent choice for saving data in the case of hiding the user's identity [29].