Towards Post-Quantum Secure Pharmacovigilance with ML-KEM and ML-DSA

Technical Summary: Towards Post-Quantum Secure Pharmacovigilance with ML-KEM and ML-DSA

Problem Statement
Pharmacovigilance systems manage sensitive healthcare data, including adverse event reports and clinical observations, which must remain confidential for many years. Current public-key cryptographic systems (e.g., RSA, ECC) face potential vulnerability to future quantum computing advances, specifically through Shor's algorithm. This creates a "harvest now, decrypt later" (HNDL) threat model, where adversaries could intercept and store encrypted data today to decrypt it once quantum computers become sufficiently powerful. Additionally, these systems require robust data integrity and authenticity to prevent tampering with safety reports, which could lead to incorrect clinical conclusions. While Post-Quantum Cryptography (PQC) offers algorithms resistant to quantum attacks, there is a gap in understanding how to integrate these standardized primitives into realistic, end-to-end healthcare data pipelines.

Methodology
The authors designed and implemented an educational, end-to-end prototype of a post-quantum secure pharmacovigilance data pipeline. The system models a simplified but realistic data flow involving four primary components: a Hospital (sender), a Gateway Server (intermediate node), a Pharmaceutical System (receiver), and an Attacker Module (simulating adversarial behavior).

The cryptographic pipeline employs a layered approach using NIST-standardized lattice-based algorithms:

1. Key Establishment: The hospital uses ML-KEM-768 (Module-Lattice-Based Key Encapsulation Mechanism) to encapsulate a shared secret using the gateway's public key.
2. Key Derivation: The shared secret is processed through HKDF-SHA-256 to derive a 256-bit symmetric encryption key.
3. Data Encryption: Pharmacovigilance data (treated as raw byte streams regardless of format) is encrypted using AES-256-GCM for confidentiality and integrity.
4. Digital Signatures: The encrypted payload is signed using ML-DSA-65 (Module-Lattice-Based Digital Signature Algorithm) to ensure authenticity and detect tampering.
5. Transmission & Verification: The payload (ML-KEM ciphertext, AES ciphertext, signature, and metadata) is sent to the gateway. The gateway decapsulates the key, and the pharmaceutical system verifies the ML-DSA signature before decrypting the data.

The system supports multiple file formats (TXT, CSV, JSON, PDF) by processing them as raw bytes. A web-based dashboard visualizes system activity, including packet logs and benchmark metrics. The implementation utilizes existing open-source Python libraries for ML-KEM and ML-DSA rather than implementing algorithms from scratch.

Key Contributions

• System-Level Integration: The paper moves beyond theoretical algorithm analysis to demonstrate the integration of ML-KEM and ML-DSA into a functional data pipeline involving key establishment, symmetric encryption, and digital signatures.
• Attack Simulation: The prototype includes a dedicated attacker module that simulates ciphertext tampering, random corruption, truncation, and replay-based modification to demonstrate the system's ability to detect integrity violations.
• Performance Benchmarking: The authors evaluated the system using synthetic datasets ranging from 1 MB to 10 MB across different file formats to measure the computational overhead of PQC primitives compared to symmetric encryption.
• Educational Prototype: The work serves as a practical exploration of how PQC can be applied to healthcare data flows, highlighting both feasibility and current architectural limitations.

Results
Performance evaluation revealed the following trends:

• Constant Overhead: ML-KEM encapsulation and decapsulation times remained nearly constant regardless of file size, adding a small, fixed overhead to the pipeline.
• Linear Scaling: AES encryption/decryption and ML-DSA signing times increased linearly with data size. For larger payloads (e.g., 10 MB), symmetric encryption and digital signatures dominated the runtime, while the PQC key establishment cost remained negligible in comparison.
• Format Independence: The system demonstrated consistent performance across TXT, CSV, JSON, and PDF formats, confirming that processing data as raw byte streams effectively abstracts file structure from cryptographic performance.
• Security Efficacy: Attack simulations confirmed that any modification to the encrypted payload resulted in signature verification failures (ML-DSA) or authentication tag mismatches (AES-GCM), successfully preventing the processing of tampered data.

Significance and Limitations
The paper positions this work as an educational systems-level exploration rather than a production-ready healthcare system. Its significance lies in demonstrating the feasibility of integrating NIST-standardized PQC primitives (ML-KEM and ML-DSA) into a realistic data pipeline to mitigate long-term quantum threats to pharmacovigilance data.

The authors explicitly acknowledge several limitations:

• Implementation: The use of unoptimized, educational Python libraries means performance results may not reflect production-grade deployments using hardware acceleration or optimized C libraries.
• Metadata Integrity: The current design signs only the encrypted payload, not the metadata (e.g., file name, source). Consequently, metadata-only manipulation may go undetected.
• Security Scope: The threat model focuses on network-level attacks (tampering, replay) and does not address insider threats, key compromise, or side-channel vulnerabilities.
• Session Key Exposure: For demonstration purposes, the gateway logs the recovered shared secret, a practice that would be unacceptable in a real-world secure deployment.

The authors conclude that while PQC integration introduces additional overhead, it is computationally feasible for moderate-scale data exchange, with the primary performance cost driven by symmetric encryption and signatures rather than the post-quantum key establishment itself. Future work is suggested to include hybrid approaches for backward compatibility, metadata integrity improvements, and more advanced threat modeling.