Privacy Protection with Pseudonymization and Anonymization In a Health IoT System: Results from OCARIoT This paper presents the implementation of a usersu0027 privacy protection approach in a health Internet of Things (IoT) system. It is composed of a set of security layers based on cryptography, pseudonymization and anonymization techniques applied to processed (DataInUse, DIU), stored (DataAtRest, DAR) and transmitted (DataInMotion, DIM) data. Regarding security and privacy in IoT systems, especially in digital health systems, it is necessary to guarantee that the user rights are respected. This requires a securityindepth strategy established based on riskbased results, every interconnecting actors, their security and privacy requirements and the specific aspects of the entire ecosystem, including the applications and platform. The presented privacy protection approach was developed and applied in a digital health platform, OCARIoT.

Security and Privacy Functionalities in IoT Internet of Things (IoT) offers a variety of technologies for connecting different kinds of heterogeneous devices. Security and privacy are becoming the main issue for IoT systems and their developers. Nevertheless, most works on IoT security and privacy requirements look at these requirements from a highlevel view. Hence, the essential aspects of security and privacy functionalities will be disregarded, causing wrong design decisions. To combat this problem, this paper summarizes the most current documents related to security and privacy functionalities in the setting of IoT and provides a new taxonomy framework that organizes all aspects of security and privacy baselines, guidelines, and recommendations. To give an understanding of how the framework can help to improve security and privacy of IoT products, we combine it with a security classification method and demonstrate the usefulness by a case study of health products. Our framework can serve as a cornerstone towards the development of appropriate security solutions.