PQAC-BIoMT: Post-Quantum Authentication and Access Control Framework for Blockchain-Enabled IoMT Systems

Background: In recent years, the Internet of Medical Things (IoMT) has transformed the healthcare sector through real-time patient monitoring and continuous data collection. However, transmitting sensitive medical information over public networks exposes IoMT systems to significant security threats, while emerging quantum computing technologies challenge the reliability of traditional cryptographic systems.Objective: The objective of this study is to propose PQAC-BIoMT, a secure and robust model for remote user authentication and access control in IoMT environments, capable of withstanding both conventional and quantum attacks.Methods: This article proposes a decentralized authentication framework that integrates post-quantum cryptography using Kyber Public-Key Encryption (Kyber-PKE) into blockchain-based smart contracts. Fog computing nodes are used to reduce the authentication latency and improve the system scalability. A role-based authorization mechanism is integrated to link user identities to functional roles and enforce authorization to medical data and system resource access. Formal security verification is conducted using Burrows-Abadi-Needham (BAN) logic to validate the correctness of authentication, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is used to assess resistance to known attacks. PQAC-BIoMT is further evaluated through a comparative analysis of the computational load, energy consumption and security properties.Results: Our security analysis demonstrates that PQAC-BIoMT effectively resists common attacks while providing quantum-resistant protection against them. The performance evaluation shows that the proposed scheme achieves relatively lower computational and energy overhead compared to existing approaches, making it suitable for resource-constrained IoMT devices.Conclusion: The proposed PQAC-BIoMT scheme delivers a secure, quantum-resilient authentication and authorization mechanism for IoMT systems, enhancing both data protection and operational efficiency, which can support practical deployment in real-world IoMT applications.