PQ-MedTrust: Coupling Continuous Trust to Post-Quantum Credential Revocation for Autonomous Clinical Agents
Year: 2026
Type: article
Abstract: Autonomous clinical agents increasingly act on Internet-of-Medical-Things (IoMT) end points, yet existing identity and access-management mechanisms remain human-centric, quantum-vulnerable, and poorly suited to continuous action-level trust enforcement. We present PQ-MedTrust, a three-tier post-quantum trust-to-revocation architecture integrating Decentralized Identifiers, Verifiable Credentials, identity–behavior–context trust with risk dependent decay, hybrid classical/post-quantum authentication, and automatic credential revocation. We implement and measure the complete enforcement path and characterize where behavioral trust succeeds, becomes detection-latency limited, or fails to separate malicious from benign behavior. A liboqs-based testbed evaluates classical-only, hybrid, PQC-only, and SLH-DSA configurations. On a general-purpose CPU, classical, hybrid, and PQC-only handshakes remain below 1.5ms, while hybrid authorized actions expand to 21.1KB versus 1.8KB classically. Cryptographic enforcement adds 0.07–11.1ms. Across 1,000 runs per scenario, aggressive scope abuse and one-shot mimicry are detected in 100% of runs, while adaptive stealth reaches 20.2% detection at 24h and 75.3% at 120h. The pooled benign false-positive rate is 1.8% under reliable context, but rises sharply when context is degraded or benign agents emit the unusual-but-in-scope behavior used to characterize adaptive stealth. These results show modest CPU-tier PQC cost but substantial communication overhead, while exposing the operating limits of automatic behavior-driven revocation.
Source: Future Internet
DOI: 10.3390/fi18100548
Language: English
Topic: Access Control and Trust
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $1,930
OpenAlex ID: W7204154247