A comprehensive survey on security and privacy in IoMT-driven smart healthcare: security attacks, mitigation measures, and future research direction

Abstract The Internet of Medical Things (IoMT) refers to interconnected medical devices, sensors, communication networks, and cloud-based platforms that enable continuous patient monitoring and data-driven healthcare services. While IoMT technologies significantly enhance diagnostic accuracy, real-time monitoring, and clinical decision-making, they also introduce critical security and privacy challenges. The heterogeneity of medical devices, diversity of communication protocols, and stringent performance and energy constraints complicate the design of standardized and interoperable security frameworks, leaving IoMT ecosystems vulnerable to unauthorized access, data tampering, service disruption, and emerging cyberattacks. This survey presents a comprehensive and systematic analysis of security and privacy challenges in IoMT- driven smart healthcare systems using a three-tier architectural model comprising the Device, Edge, and Cloud layers. Based on a structured, systematic literature review, the study examines layer-specific security requirements, operational constraints, and key vulnerabilities affecting system trustworthiness. A unified taxonomy of existing security and privacy-preserving mechanisms is developed to classify current solutions and analyze their design principles, strengths, and limitations. Beyond descriptive analysis, the survey provides a cross-layer examination of threat propagation, defene strategies, and performance trade-offs, highlighting how security decisions at one architectural layer influence the resilience of the overall IoMT ecosystem. The study identifies persistent research gaps, including the need for lightweight cryptographic techniques for resource-constrained devices, scalable authentication schemes, secure data interoperability, and privacy-preserving analytics on encrypted medical data. Finally, emerging research directions such as federated learning, post-quantum cryptography, and zero-trust architectures are discussed to guide future advancements in secure IoMT-enabled healthcare systems.