Privacy-preserving messaging for medical device networks

Abstract

Internet of medical things (IoMT) deployments rely on lightweight messaging, but the message queuing telemetry transport (MQTT) protocol still exposes sensitive metadata through plaintext topic names and stable client identifiers. In healthcare settings, this visibility can reveal patient identity, location, and monitored condition even when payloads are encrypted. This paper presents a gateway-based privacy architecture that replaces semantic MQTT topics and client identifier (ClientIDs) with rotating pseudonyms managed by a topic and ID privacy manager (TPM). The design uses hash-based message authentication code using secure hash algorithm 256-bit (HMAC-SHA256) for pseudonym generation, advanced encryption standard-galois/counter mode (AES-GCM) for payload protection, and a short overlap phase that preserves message delivery during rotation without modifying the broker. Experiments from 5 to 10,000 patients show a consistent 5.0x increase in topic diversity, 2.50 μs per message cryptographic overhead, 0.063 ms maximum latency overhead, and zero packet loss. These results indicate that practical IoMT deployments can improve metadata privacy while still meeting real-time clinical communication requirements.