Edge-Assisted Zero-Trust Post-Quantum Authentication Framework for Medical IoT

The Internet of Medical Things enables real-time health monitoring through wireless sensors and embedded computing, but raises critical concerns regarding patient data confidentiality in the era of quantum computing. Classical public-key cryptosystems, including RSA and ECC, remain vulnerable to Shor’s algorithm, which efficiently solves integer factorization and discrete logarithm problems on quantum computers. Although the National Institute of Standards and Technology (NIST) has standardized post-quantum cryptographic algorithms that are resistant to quantum cyber threats, the available solutions are either computationally burdensome for resource-constrained IoMT devices or compromise the authentication of the end-to-end verification chain via proxy-based approaches. This paper proposes a zero trust-based post-quantum framework that leverages the power of edge-based computing offloading while maintaining the cryptographic verification chain. The architectural design employs CRYSTALS-Kyber-512 for key encapsulation, CRYSTALS-Dilithium-2 for dual-layer digital signatures, and AES-256-GCM for symmetric key encryption. The Quantum-Secure Edge Server (QSES) carries out computationally expensive post-quantum computations, while digital signatures from devices are verifiable at application servers, thereby allowing for non-repudiation, which is critical for medical liability applications. These security proofs show Existential Unforgeability under Adaptive Chosen Message Attacks (EUF-CMA) in the Quantum Random Oracle Model (QROM). They are based on the standard assumptions of Module-LWE and Module-SIS hardness and were checked again using the Scyther tool and a full end-to-end security analysis. Performance evaluation demonstrates 1.87 ms client-side computation with 8,416 bytes communication overhead, achieving faster processing than full on-device post-quantum implementations while maintaining end-to-end authentication properties absent in existing edge-offloading schemes.