Controlled Authentication Semi-Quantum Key Agreement Protocol for the Internet of Medical Things

In the internet of medical things (IoMT) systems, devices typically transmit critical data, such as patient physiological information, diagnostic data, and surgical control commands among others. This data requires a very high level of security, as traditional encryption methods based on mathematical problems may not withstand the growing threats of quantum cyberattacks. For this purpose, we propose a new healthcare system model (refer to Figure 1 for detailed information) that integrates CASQKA with the IoMT. In the new system model, the security of key agreement between IoMT devices is ensured by quantum principles. This system model not only provides highly secure keys for secure data communication and data integrity authentication between devices but also possesses the capability for identity authentication between devices, preventing data from being intercepted or eavesdropped on during transmission.

Figure 1.

Healthcare model with CASQKA.

The new system model consists of the following modules, each with its respective functionality.

Hospital Information Server: Acting as a fully trusted party within the system model, is equipped with comprehensive quantum capabilities. It oversees identity authentication and key agreement processes. The server is responsible for storing the identity sequences of various IoMT devices, calculating error rates, and managing the final shared keys.

Quantum Communication Module: It possesses the capability to prepare quantum state sequences, receive sequence information from both the hospital server and IoMT devices, and perform encoding and decoding according to Table 1.

IoMT Gateway: A quantum channel and a classical authentication channel are established between the hospital server and the IoMT devices.

IoMT Devices: They are equipped with semi-quantum capabilities. These include various medical sensors, wearable devices and smart diagnostic equipment for transmitting users’ medical data.

The workflow of the new system model primarily consists of the Identity Authentication Phase, Key Agreement Phase, and Secure Communication Phase, as detailed below: During the authentication phase, the hospital’s information server verifies the identity of the IoMT devices to protect against identity impersonation attacks. In the key agreement phase, the hospital’s information server and the IoMT devices use the CASQKA protocol to establish a fair shared key. In the secure communication phase, the IoMT devices and the hospital’s information server use the shared key to encrypt the transmitted message along with the message digest, ensuring the confidentiality and integrity of the messages.

The new system model begins with the authentication of IoMT devices. Next, key agreement is completed between the hospital information server and each IoMT device, resulting in the establishment of a shared key. During the Communication Phase, the IoMT devices automatically collect the user’s pathological data and, after providing encryption and message integrity protection through the shared key, transmit the pathological data to the hospital’s information server. The hospital server then transmits the data to the hospital diagnostic system. The doctor provides medical diagnoses and advice through the diagnostic system, encrypts the information and ensures message integrity using the shared key, and transmits it back to the IoMT devices. This completes the communication process of the new healthcare system, ensuring the confidentiality and integrity of data transmission between doctors and patients. It prevents the leakage of patient privacy and the tampering of pathological data.

IoMT devices, such as wearable sensors and mobile medical equipment, inherently involve mobility, which can pose challenges for establishing reliable quantum communication channels. In our proposed model, we address this challenge by leveraging quantum communication technologies such as fiber optics for stationary communication links and free space for mobile devices.

For the mobile IoMT devices, free-space optical links are employed, which utilize laser-based communication for quantum transmission. These links are robust enough to accommodate the dynamic movement of IoMT devices while maintaining secure and efficient quantum key exchange. Additionally, the quantum communication module at each IoMT device is designed to dynamically adjust to the mobile environment, optimizing the communication protocol for varying distances and line-of-sight conditions.

In scenarios where fiber optic connections are impractical due to the mobility of IoMT devices, we employ hybrid systems that combine classical and quantum communication techniques. Classical channels handle the control and synchronization of quantum keys, while quantum channels are responsible for the actual key agreement and encryption processes. This hybrid approach ensures that even in highly mobile environments, such as between the hospital server and roaming IoMT devices, secure key agreement and data integrity can be reliably maintained.

The W states was first proposed by Dür et al. [31]. It is a quantum state of m (m > 2) qubits involving an equal superposition of m terms, those with only one qubit in the state |1〉, while all the other qubits are in the state |0〉. The W state exhibits multi-body entanglement and retains partial entanglement properties within its subsystems [31]. This means that even if one quantum bit is lost, the W states still maintains a certain degree of entanglement. The partial entanglement characteristic of the W states offers higher robustness in quantum communication. A four-particle W states (the preparation and measurement of the W states is shown in Figure 2) can be represented as follows: 1|W〉ABCD=12(|0001〉+|0010〉+|0100〉+|1000〉)|W{\rangle _{ABCD}} = {1 \over 2}(|0001\rangle \; + |0010\rangle \; + |0100\rangle \; + |1000\rangle ) 2=12(|Φ+〉+|Φ−〉)12⊗|Ψ+〉34+|Ψ+〉12⊗12(|Φ+〉+|Φ−〉)34 )\left. { = {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{12}} \otimes {{\left| {{\Psi ^ + }} \right\rangle }_{34}} + {{\left| {{\Psi ^ + }} \right\rangle }_{12}} \otimes {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{34}}} \right) 3=12(|Φ+〉+|Φ−〉)13⊗|Ψ+〉24+|Ψ+〉13⊗12(|Φ+〉+|Φ−〉)24 )\left. { = {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{13}} \otimes {{\left| {{\Psi ^ + }} \right\rangle }_{24}} + {{\left| {{\Psi ^ + }} \right\rangle }_{13}} \otimes {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{24}}} \right) 4=12(|Φ+〉+|Φ−〉)14⊗|Ψ+〉23+|Ψ+〉14⊗12(|Φ+〉+|Φ−〉)22 )\left. { = {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{14}} \otimes {{\left| {{\Psi ^ + }} \right\rangle }_{23}} + {{\left| {{\Psi ^ + }} \right\rangle }_{14}} \otimes {1 \over 2}{{\left( {\left| {{\Phi ^ + }} \right\rangle + \left| {{\Phi ^ - }} \right\rangle } \right)}_{22}}} \right)

Figure 2.

Quantum circuit diagram for preparing and measuring a 4-Particle W States.

Key properties of W states relevant to CASQKA protocol:

Entanglement robustness: For instance, if any single qubit is trace out from the fourth-particle W state, the remaining three-qubit reduced state is a mixed state that includes a three-qubit W state component. Specifically, tracing out qubit D yields: 5ρABC=34|W˜3〉〈W˜3|+14|000〉〈000|{\rho _{ABC}} = {3 \over 4}\left| {{{\widetilde W}_3}} \right\rangle \langle {\widetilde W_3}| + {1 \over 4}|000\rangle \;\langle 000| where |W˜3〉=1/3(|001〉+|010〉+|100〉)\left| {{{\widetilde W}_3}} \right\rangle = 1/\sqrt 3 (|001\rangle \; + |010\rangle \; + |100\rangle ). This residual entanglement ensures robustness against qubit loss, unlike GHZ states which become fully separable.

Bell-state decomposition and eavesdropping detection: The W state can be decomposed into combinations of Bell states (Equations 2–4). This property enables efficient parity checks via local Bell-state basis measurement. Any eavesdropping attempt disrupts the expected correlations, triggering protocol termination.

Efficiency advantage: W states enable deterministic entanglement swapping without postselection (unlike probabilistic GHZ-based schemes), achieving a qubit efficiency of η = 1 – 0(1/m) for m-party key distribution.

Security proof against attacks: For an eavesdropper (Eve) inducing an error rate ϵ, the mutual information I (A : E) between Alice and Eve is bounded by: I (A : E) ≤ 2ϵ log d + h(ϵ), where d is the Hilbert space dimension and h is the binary entropy function.

The security bound holds only when the photon loss probability is below the W state’s lossthreshold: for the 4-particle W state, this threshold is p < 0.75 [32], meaning the residuaW-state entanglement component remains dominant as long as the single-qubit lossprobability is less than 75% [33]. Exceeding this threshold reduces the residual entanglement anddegrades the QKD key rate following the relation R ∝ (1 – p_L)⁴ (where m is the number of qubits in the W state), highlighting the need for loss mitigation (e.g., entanglement purification) inhigh-loss OKD links.

Assume the participants in the protocol are Alice, Bob, Charlie, and Dave. Alice corresponds to the hospital information server in the new healthcare system model described in Section 2, while Bob, Charlie, and Dave represent IoMT devices. Among them, Alice is a fully trusted party with complete quantum capabilities. Bob, Charlie, and Dave are semi-quantum participants who need to complete identity authentication before proceeding with the CASQKA protocol. They are only able to perform CTRL and SIFT operations. CTRL refers to sending back the particle without interference, while SIFT involves measuring the particle in the Z basis and preparing a new particle in the same state to send back to the sender. However, there are two situations for SIFT: one is to prepare a quantum state based on the measurement results and send it back to the receiver immediately, or to use a classical bit to record the measurement results. When the sender needs it, they can re prepare the quantum state based on the recorded classical bits and send it.

In the protocol design, the pre-shared authentication information is securely distributed during the users’ initial face-to-face registration phase. That is to say, Alice used a random number generator to generate identity information for Bob, Charlie, and Dave, and then embeds the information into the device.

In our protocol, the classical authenticated channel is used to transmit public but integrity-sensitive information, such as whether a particle operation is a CTRL or SIFT operation, the positional information of these particles, and information about particles used for safety detection. Although encryption is not required, it is critical to prevent any unauthorized modification of these messages. To ensure authenticity and integrity, we employ lattice-based digital signature schemes, such as Dilithium or Falcon [34], which provide strong post-quantum security guarantees against both classical and quantum adversaries.

The specific protocol flow is show in Figure 3.

Figure 3.

Workflow of the proposed protocol.

Step 1. Before the protocol begins, Bob, Charlie, and Dave share their identity sequences: I_B, I_C, and I_D with Alice (complete through face-to-face registration). Each Ii={ Ii(1),Ii(2),Ii(3)…Ii(n) }{I_i} = \left\{ {I_i^{(1)},I_i^{(2)},I_i^{(3)} \ldots I_i^{(n)}} \right\}, where i can be B, C, or D. The values Ii(1),Ii(2),Ii(3)…Ii(n)∈{0,1}I_i^{(1)},I_i^{(2)},I_i^{(3)} \ldots I_i^{(n)} \in \{ 0,1\} (with approximately equal probabilities for 0 and 1). Alice, Bob, Charlie, and Dave randomly generate their private keys: KA={ KA(1),KA(2),KA(3)…KA(n) }{K_A} = \left\{ {K_A^{(1)},K_A^{(2)},K_A^{(3)} \ldots K_A^{(n)}} \right\}, KB={ KB(1),KB(2),KB(3)…KB(n) }{K_B} = \left\{ {K_B^{(1)},K_B^{(2)},K_B^{(3)} \ldots K_B^{(n)}} \right\}, KC={ KC(1),KC(2),KC(3)…KC(n) }{K_C} = \left\{ {K_C^{(1)},K_C^{(2)},K_C^{(3)} \ldots K_C^{(n)}} \right\}, KD={ KD(1),KD(2),KD(3)…KD(n) }{K_D} = \left\{ {K_D^{(1)},K_D^{(2)},K_D^{(3)} \ldots K_D^{(n)}} \right\} where KA(i),KB(i),KC(i),KD(i)∈{0,1}K_A^{(i)},K_B^{(i)},K_C^{(i)},K_D^{(i)} \in \{ 0,1\} (with approximately equal probabilities for 0 and 1), and i ∈ {1, 2, …, n}.

Step 2. Alice prepares 8n W states, forming a W states sequence. Alice divides this W states sequence into four sequences: S_A, S_B, S_C, S_D. Sequence S_A consists of all the first particles from the W states, S_B consists of all the second particles, S_C consists of all the third particles, and S_D consists of all the fourth particles. Alice begins to transmit the sequences S_B, S_C, S_D to Bob, Charlie, and Dave in order, while keeping sequence S_A for herself.

Step 3. Bob, Charlie, and Dave randomly perform either the CTRL or SIFT operations on particles in their respective sequence S_B, S_C, S_D and record the measurement results of the SIFT operations as classical bits according to the encoding rules in Table 1. After executing the operations on all particles, Bob, Charlie, and Dave disclose the positions about the CTRL and SIFT operations performed on the W states particles in sequences S_B, S_C, and S_D through the classical authentication channel. There are a total of eight scenarios (refer to Table 2 for detailed information).

Step 4. In Case 1, Alice uses Z-basis to measure the particles reflected by Bob, Charlie, and Dave, as well as the particles retained by herself, and calculates the error rate using Equation (1). In Cases 2, 3, and 4, Alice performs a Bell basis measurement on the particles reflected by Bob, as well as the particles retained by herself, and calculates the error rate using Equation (2). In Cases 5 and 6, Alice performs a Bell basis measurement on the particles reflected by Charlie, as well as the particles retained by herself, and calculates the error rate using Equation (3). In Case 7, Alice performs a Bell basis measurement on the particles reflected by Dave, as well as the particles retained by herself, and calculates the error rate using Equation (4). If the error rates for all seven cases mentioned above are below the threshold, the protocol continues; otherwise, it is terminated.

Step 5. After passing the security check, Bob, Charlie, and Dave proceed with their respective authentication operations. Taking Bob as an example, he constructs a classical bit sequence VB={ VB(1),VB(2),VB(3)…VB(n) }{V_B} = \left\{ {V_B^{(1)},V_B^{(2)},V_B^{(3)} \ldots V_B^{(n)}} \right\} based on the measurement results recorded in Case 5 of Table 2, where each VB(i)V_B^{(i)} takes a value of 0 or 1 (i ∈ {1, 2, …, n}). Bob then performs a bitwise XOR operation between his identity sequence I_B and the sequence V_B, resulting in a new sequence VB*V_B^*, defined as VB*={VB(1)⊕IB(1),VB(2)⊕IB(2),VB(3)⊕B[3)…VB(n)⊕IB(n) }\left. {V_B^* = \{ V_B^{(1)} \oplus I_B^{(1)},V_B^{(2)} \oplus I_B^{(2)},V_B^{(3)} \oplus _B^{[3)} \ldots V_B^{(n)} \oplus I_B^{(n)}} \right\}. Finally, Bob announces the classical bit sequence VB*V_B^* to Alice through the classical authentication channel. At the same time, Charlie and Dave perform the same operation as Bob based on the measurement results recorded in Case 3 and Case 2 in Table 2, respectively. Finally, Charlie and Dave announced the classical bit sequences VC*V_C^* and VD*V_D^* to Alice through the classical authentication channel. Symbols such as V_B, V_C, V_D are specifically explained in Table 3.

Table 3.

IB, IC, ID	Bob/Charlie/Dave’s pre-shared identity bit strings (n bits)
KA, KB, KC, KD	Each party’s private key string (n bits)
SA, SB, SC, SD	The four-particle sequences of the W state are held by Alice, Bob, Charlie, and Dave, respectively.
VB, VC, VD	The n-bit outcomes of Z-basis measurements performed by Bob/Charlie/Dave at the SIFT positions.
VB*VC*,VD*V_B^*V_C^*,V_D^*	The XOR of the measurement outcome with the identity string, VB*={ VB(1)⊕IB(1),VB(2)⊕IB(2),VB(3)⊕IB(3)…VB(n)⊕IB(n) }V_B^* = \left\{ {V_B^{(1)} \oplus I_B^{(1)},V_B^{(2)} \oplus I_B^{(2)},V_B^{(3)} \oplus I_B^{(3)} \ldots V_B^{(n)} \oplus I_B^{(n)}} \right\} used for authentication.
VAB, AC, VAD	The classical bit string actually measured by Alice at the corresponding positions, used for comparison and verification.
RB,RC,RDRB′,RC′,RD′K{{R_B},{R_C},{R_D}}	The n-bit SIFT measurement results of Bob/Charlie/Dave in Case-8 used to conceal the private key the final 4-party shared key
KAB, KAC, KAD	The key segments permuted by Alice using IB, IC, ID are sent to Bob/Charlie/Dave, respectively.

Step 6. Upon receiving the sequences VB*V_B^*, VC*V_C^*, and VD*V_D^*, Alice processes them to verify authentication. Taking VB*V_B^* as an example, Alice performs a bitwise XOR operation between Bob’s pre-shared identity sequence I_B (from Step 1) and the received sequence VB*V_B^*, generating a new sequence VB*′,VB*′={ VB*(1)⊕IB(1),VB*(2)⊕IB(2),VB*(3)⊕ IB(3)…VB*(n)⊕IB(n) }V_B^{{*^\prime }},V_B^{{*^\prime }} = \left\{ {V_B^{*(1)} \oplus I_B^{(1)},V_B^{*(2)} \oplus I_B^{(2)},V_B^{*(3)} \oplus } \right.\left. {I_B^{(3)} \ldots V_B^{*(n)} \oplus I_B^{(n)}} \right\}. Alice performs the same operation on the sequences VC*V_C^*, and VD*V_D^* using Charlie’s and Dave’s pre-shared identity sequences I_C and I_D, respectively, obtaining the new sequences VC*′V_C^{{*^\prime }} and VD*′V_D^{{*^\prime }}.

Step 7. Based on the position information disclosed by Bob, Charlie, and Dave in Step 3, Alice is able to obtain the measurement results corresponding to Case 5 in Table 2 (Bob’s SIFT, Charlie and Dave’s CTRL) by performing Z-basis measurements. These results form a classical bit sequence V_AB. Similarly, Alice extracts V_AC and V_AD based on Case 3 (Charlie’s SIFT) and Case 2 (Dave’s SIFT), respectively. Each of these sequences is then converted into a classical bit sequence according to the encoding rules in Table 1. Finally, Alice compares VB*′V_B^{{*^\prime }} with V_AB to calculate the error rate and verify Bob’s identity. The same process is applied to verify Charlie’s and Dave’s identities by comparing VC*′V_C^{{*^\prime }} with V_AC, and VD*′V_D^{{*^\prime }} with V_AD. If all the error rates are below the predefined threshold, the identity authentication passes and the protocol continues; otherwise, the protocol is terminated.

Completeness & soundness in a nutshell. Let n be the length of identity sequence I and P_e the single-bit QBER. Alice accepts if the mismatch rate ≤ ϵ = 1/3. (1) Honest Bob: mismatches ∼ Bin(n, P_e); Hoeffding gives Pr[reject] ≤ exp(–2n(1/3 – P_e)²). (2) Any attacker ignorant of I faces a one-time pad; mismatch rate ∼ Bin(n, 1/2), so Pr[accept] ≤ exp(–2n(1/2 – 1/3)²) = exp(–n/18). Both bounds vanish exponentially in n.

Step 8. After successfully passing the identity authentication in Step 7, continue with the protocol. For Case 8, Bob, Charlie, and Dave encode the measurement results of the corresponding positions into classical sequences R_B, R_C, and R_D according to the rules specified in Table 1. Subsequently, Bob performs the operation RB′=KB⊕RBR_B^\prime = {K_B} \oplus {R_B}. Charlie and Dave perform the same operation to obtain the sequences RC′R_C^\prime and RD′R_D^\prime .

Step 9. Bob, Charlie, and Dave then iterate through their respective identity sequences I_B, I_C, and I_D. When IB(i)=0I_B^{(i)} = 0, the positions of RB′(j)R_B^{\prime (j)} and RB′(j+1)R_B^{\prime (j + 1)} in RB′R_B^\prime are not swapped. When IB(i)=1I_B^{(i)} = 1, the positions of RB′(j)R_B^{\prime (j)} and RB′(j+1)R_B^{\prime (j + 1)} in RB′R_B^\prime are swapped. When Bob reaches IB(⌊ i2 ⌋+1)I_B^{\left( {\left\lfloor {{i \over 2}} \right\rfloor + 1} \right)}, he begins the second round of swapping. If the length n of I_B and RB′R_B^\prime is odd, the index j selected from the set {1, 3, 5, …, n, 2, 4, 6, …, n – 1}. Conversely, if the length n is even, j is chosen from the set {1, 3, 5, …, n – 1, 1, 3, 5, …, n – 1}. Finally, the sequence RB′R_B^\prime is transformed into sequence RB′*R_B^{\prime *}, while Charlie and Dave perform the same operations to obtain sequences RC′*R_C^{\prime *} and RD′*R_D^{\prime *}, respectively. Bob, Charlie, and Dave convert their respective sequences into quantum states according to the encoding rules in Table 1 and send them to Alice.

Step 10. Upon receiving the sequences sent by Bob, Charlie, and Dave, Alice uses her retained identity sequences I_B, I_C, and I_D to recover RB′,RC′R_B^\prime ,R_C^\prime , and RD′R_D^\prime . Based on the information disclosed by Bob, Charlie, and Dave in step 3, Alice measures the second, third, and fourth particles of the W states particles where all parties performed the SIFT operation to obtain the sequences R_AB, R_AC, R_AD. Alice applies the rules from step 8 with sequence RB′R_B^\prime and sequence R_AB to recover K_B. Alice performs the same operations on Charlie’s and Dave’s sequences to obtain K_C and K_D. Alice calculates the shared key K=KA⊕KB⊕KC⊕KDK = {K_A} \oplus {K_B} \oplus {K_C} \oplus {K_D} and converts K into quantum sequence according to Table 1.

Step 11. Alice iterates through the sequence I_B, I_C, and I_D. When IB(i)=0I_B^{(i)} = 0, the positions of K^j and K^j+1 in K are not swapped. When IB(i)=1I_B^{(i)} = 1, the positions of K^j and K^j+1 in K are swapped. When Alice reaches IB(⌊ i2 ⌋+1)I_B^{\left( {\left\lfloor {{i \over 2}} \right\rfloor + 1} \right)}, she begins the second round of permutation. If the length n of I_B and K is odd, the index j selected from the set {1, 3, 5, …, n, 2, 4, 6, …, n – 1}. Conversely, if the length n is even, j is chosen from the set {1, 3, 5, …, n – 1, 1, 3, 5, …, n – 1}. Finally, the sequence K is transformed into K_AB. Alice performs the same operations to obtain the sequence K_AC and K_AD by iterating sequence I_C and I_D. Alice sequentially sends the sequences K_AB, K_AC, and K_AD to Bob, Charlie, and Dave.

Step 12. Bob, Charlie, and Dave sequentially measure their received sequences and record the measurement results. Then, based on their respective identity sequences I_B, I_C, and I_D, they perform the inverse operations of those in Step 11 to reconstruct the shared key. Consequently, each of them successfully obtains the shared key.

Initialization phase:

Alice prepares and distributes 8N W-states, splitting them into four sequences S_A, S_B, S_C, S_D that contain, respectively, the first, second, third, and fourth particle of every W-state. She keeps S_A for herself and sends S_B, S_C, S_Dto Bob, Charlie, and Dave. Each of the three recipients randomly performs either a CTRL or a SIFT operation on the particles in his own sequence and, according to Table 1, records the measurement outcome of any SIFT operation as a classical bit. After all operations are finished, they publicly announce which operation was applied to each W-state particle and the corresponding positions. According to Table 2, the error rate is computed for all seven cases except Case 8. If the error rates of these seven cases are all below the prescribed threshold, the quantum channel is judged to be secure.

Authentication phase:

Bob constructs a classical sequence VB={ VB(1),VB(2),VB(3)…VB(n) }{V_B} = \left\{ {V_B^{(1)},V_B^{(2)},V_B^{(3)} \ldots V_B^{(n)}} \right\} based on Case 5. He bitwise XORs V_B with I_B to obtain VB*={ VB(1)⊕IB(1),VB(2)⊕IB(2),VB(3)⊕IB(3)…VB(n)⊕IB(n) }V_B^* = \left\{ {V_B^{(1)} \oplus I_B^{(1)},V_B^{(2)} \oplus I_B^{(2)},V_B^{(3)} \oplus I_B^{(3)} \ldots V_B^{(n)} \oplus I_B^{(n)}} \right\} and sends VB*V_B^* to Alice.Charlie and Dave perform the same operation with their own data. Alice XORs the received VB*V_B^* with I_B to recover VB*′={ VB*(1)⊕IB(1),VB*(2)⊕IB(2),VB*(3)⊕IB(3)…VB*(n)⊕IB(n) }V_B^{{*^\prime }} = \left\{ {V_B^{*(1)} \oplus I_B^{(1)},V_B^{*(2)} \oplus I_B^{(2)},V_B^{*(3)} \oplus I_B^{(3)} \ldots V_B^{*(n)} \oplus I_B^{(n)}} \right\}, and likewise computes VC*′V_C^{{*^\prime }} from VC*V_C^* and I_C and VD*′V_D^{{*^\prime }} from VD*V_D^* and I_D. Using Table 2, she derives the expected particle-measurement results for Case 5 and labels them V_AB ; similarly she obtains V_AC from Case 3 and V_AD from Case 2. By comparing V_AB with VB*′V_B^{{*^\prime }} she calculates the error rate and verifies Bob’s identity; the same procedure is repeated to authenticate Charlie and Dave.

Key-agreement phase:

For every instance that falls into Case 8, Bob, Charlie and Dave encode their respective measurement outcomes into the classical strings R_B, R_C and R_D according to the rule given in Table 1. Bob computes RB′=KB⊕RBR_B^\prime = {K_B} \oplus {R_B} and Charlie and Dave similarly obtain RC′R_C^\prime and RD′R_D^\prime . Next, Bob permutes RB′R_B^\prime with I_Bto produce RB′*R_B^{\prime *}, prepares the corresponding quantum states, and transmits them to Alice. Alice applies the inverse of the I_B permutation to RB′*R_B^{\prime *} to recover RB′R_B^\prime , measures her own Case-8 particles (using the information revealed in Step 3) to obtain R_AB, and finally recovers Bob’s key contribution as KB=RAB⊕RB′{K_B} = {R_{AB}} \oplus R_B^\prime . Identical steps give Charlie and Dave K_C and K_D. Alice now forms the common key K = K_A ⊕ K_B ⊕ K_C ⊕ K_D, converts K into a quantum sequence, and performs three separate permutations governed by I_B, I_C, and I_D to generate K_AB, K_AC, and K_AD, which she sends to Bob, Charlie, and Dave, respectively. Each recipient applies the inverse of his own permutation (I_B, I_C, and I_D) to retrieve the final shared key K.

A permutation is a bijective function π that rearranges the elements of a finite set: π : {1, 2,…, n} → {1,2,…, n}. The inverse permutation π⁻¹ is the reverse function of π, satisfying π⁻¹(π(i)) = i. A permutation reorders positions; its inverse “restores” the original order. In matrix form, the inverse of a permutation matrix is simply its transpose. Alice permutes K with I_B to obtain K_B; only someone who knows I_B can apply the inverse permutation to K_B and recover K

Before the protocol begins, Bob, Charlie, Dave and Alice share identity sequences. Suppose Bob’s identity sequence is I_B = {1, 0}, Charlie’s is I_C = {0, 1}, and Dave’s is I_D = {1, 1}. Bob’s private key is K_B = {1, 1}, Charlie’s is K_C = {0, 0}, Dave’s is K_D = {1, 0}, and Alice’s private key is K_A = {1, 1}. Alice prepares 16 four-particle W states and divides them into four sequences: S_A, S_B, S_C, S_D. Sequences S_B, S_C, S_D are distributed to Bob, Charlie, and Dave respectively, while S_A is retained by Alice. Each party (Bob/Charlie/Dave) randomly performs CTRL or SIFT operations on their respective particle sequences, recording the SIFT measurement results as classical bits according to the encoding rules specified in Table 1. Alice then conducts the security verification using Cases 1-7 in Table 2 and Equations (1)–(4). The protocol proceeds only upon successful verification; otherwise, it is terminated immediately.

Bob, Charlie, and Dave begin the authentication process. For Bob, he performs a SIFT operation on the second-position particle of the 3rd and 5^th W states. Meanwhile, Charlie and Dave perform CTRL operations on the third and fourth-position particles, respectively (Case 5 in Table 2). Based on the measurement results of the particles returned by the three participants and the measurement results of the particles retained by Alice, Alice determines the quantum states are |1000〉 and |0010〉, obtaining the classical bit sequence V_AB = {0, 0}. At this point, Bob obtains the classical bit sequence V_B = {0, 0} and performs an XOR operation with his identity sequence I_B, resulting in the new sequence VB*={1,0}V_B^* = \{ 1,0\} . Bob then announces the sequence VB*V_B^* over the classical verification channel. Alice begins verifying Bob’s identity by performing an XOR operation between the sequence VB*V_B^* and the corresponding bits from the shared identity sequence I_B, obtaining the new sequence VB*′={0,0}V_B^{{*^\prime }} = \{ 0,0\} . By comparing the sequence VB*′V_B^{{*^\prime }} with V_AB, Alice can confirm Bob’s identity sequence I_B = {1, 0} as valid. Case 3 in Table 2 corresponds to the 10th and 14th W states, with Charlie completing the similar authentication process. Case 2 in Table 2 corresponds to the 2nd and 16th W states, with Dave completing the corresponding authentication process. Ultimately, Alice verifies Charlie’s identity sequence I_C = {0, 1} and Dave’s identity sequence I_D = {1, 1}, and all identity verifications are successful, allowing the protocol to proceed.

At the 7th and 12th W states particles, Bob, Charlie, and Dave all perform a SIFT operation, Bob’s measurement result are |1〉 and |0〉, Charlie’s measurement result are |0〉 and |0〉, Dave’s measurement results are |0〉 and |1〉. Bob obtains the sequence RB′={0,1}R_B^\prime = \{ 0,1\} , Charlie obtains RC′={0,0}R_C^\prime = \{ 0,0\} , and Dave obtains RD′={1,1}R_D^\prime = \{ 1,1\} . Bob, Charlie, and Dave permute RB′,RC′R_B^\prime ,R_C^\prime , and RD′R_D^\prime , convert them into quantum sequences, and send them to Alice. Alice uses inverse permutation to recover the sequences RB′,RC′R_B^\prime ,R_C^\prime , and RD′R_D^\prime allowing her to obtain Bob, Charlie, and Dave’s private keys: K_B = {1, 1}, K_C = {0, 0}, and K_D = {1, 0}. Finally, Alice computes the shared key K = {1 ⊕ 1 ⊕ 0 ⊕ 1, 1 ⊕ 1 ⊕ 0 ⊕ 0} = {1, 0}. Alice then permutes and sends the shared key K to Bob, Charlie, and Dave, who use inverse permutation to obtain the final shared key K.

In this novel system model, despite the protocol utilizing four-particle W states and being designed for four participants, its scalability has been fully considered. Specifically, under an N-particle W state (express as follows) [42], the system’s cluster scalability can be effectively enhanced.

6|WN〉=1N∑i=1N|0〉⊗(i−1)|1〉|0〉⊗(N−i)\left| {{W_N}} \right\rangle = {1 \over {\sqrt N }}\sum\limits_{i = 1}^N | 0{\rangle ^{ \otimes (i - 1)}}|1\rangle |0{\rangle ^{ \otimes (N - i)}}

Experimental advancements have demonstrated the feasibility of generating large-scale W states. For instance, [43] reported the preparation of an eight-photon W state, while [44] achieved the generation of W states involving four to eight particles in an ion trap system. These developments provide a practical foundation for extending our protocol.

To support a larger number of IoMT devices and participants, several critical aspects are considered [45]:

• (1)

  Entanglement distribution and network latency: As the number of participants grows, the protocol relies on distributing multipartite W states across nodes. Since each participant requires only partial access to the global entangled state, the quantum channel’s latency remains relatively constant compared to protocols that require full entanglement reinitialization for each new participant. Moreover, recent studies in quantum repeaters and network routing allow low-latency entanglement distribution even in large-scale settings.

• (2)

  Bandwidth and communication overhead: The communication bandwidth consumption grows linearly with the number of devices, as each additional IoMT device requires an entangled qubit and minimal classical communication. However, due to the W state’s symmetric and robust entanglement structure, this overhead is significantly lower than that in protocols based on GHZ or cluster states, which often require global state reconstruction when nodes are added or removed.

• (3)

  Computational complexity and local operations: Each participant performs only local measurements and simple unitary operations, regardless of the total number of parties. This ensures that the computational overhead at each node remains constant (O(1)) with respect to N. Furthermore, because the protocol avoids complex global state manipulations, the system exhibits high parallelism and supports efficient identity authentication and key agreement across a large-scale network.

• (4)

  System integration and security scalability: Newly added IoMT devices can establish entanglement with hospital servers through dedicated quantum communication modules without requiring reconfiguration of existing participants. The inherent fault-tolerant nature of the W state allows the system to tolerate minor decoherence and measurement errors during dynamic node addition. This supports secure and scalable integration of multiple hospitals, wearable medical devices, and cloud-based information centers.

Therefore, by leveraging the symmetric structure and robust entanglement of the N-particle W state, the proposed protocol not only supports large-scale cluster expansion but also maintains stable performance in terms of latency, bandwidth, and computational cost. This make it particularly suitable for the heterogeneous and highly dynamic IoMT environment.

In practical quantum communication systems, quantum states are vulnerable to environmental noise, leading to transmission and measurement errors. To address this, the proposed protocol incorporates standard quantum error detection through sample testing and eavesdropping checks. Specifically, during the verification phase, Alice and Charlie randomly select a subset of qubits for comparison. The observed quantum bit error rate (QBER) is computed, and if it exceeds a predefined threshold, the protocol aborts. This mechanism helps identify potential channel disturbances or malicious interference.

Furthermore, although the protocol assumes ideal quantum channels in theory, in practice, fault tolerance is critical. If a quantum device—such as a photon detector or quantum memory—fails, the protocol is designed to be restarted without relying on the previously used qubits. Since each round of key agreement is independent, the impact of individual device failure is localized and does not compromise previously established keys.

Regarding network partitioning or unstable classical channels, the protocol includes acknowledgment messages after each quantum transmission stage. If acknowledgments are not received within a timeout period, the protocol times out and restarts the key agreement process. This mechanism ensures resilience in unstable IoMT environments.

In the simulation process of the protocol, the design of the quantum circuit is crucial. We utilized Qiskit to design the quantum circuit. In Step 3 of Section 3.2, the quantum circuits of eight cases that Bob, Charlie, and Dave can perform are approximately depicted in Figure 4. In these quantum circuits, q1₀ to q1₃ represent the four particles of the W states, which is formed using C-NOT gates, H gates, and Ry gates. To the right of the 5th barrier, Bob, Charlie, and Dave perform operations on q1₁, q1₂, and q1₃, respectively. To the right of the 6th barrier, Alice operates on q1₀ to q1₃.

• (a)

  Case-1 (CTRL-CTRL-CTRL, eavesdropping-check only)

  Alice:

  • Prepares the 4-qubit W state by applying RY(π/4) to q10, then three CNOTs with q10 as control and q11, q12, q13 as targets, and a final RY(π/4) on each of q11, q12, q13.

  • Sends q11, q12, q13 to Bob, Charlie and Dave, who immediately reflect them without measurement.

  • Upon return, Alice measures all four qubits in the Z basis, computes the error rate and aborts if it exceeds the threshold.

• (b)

  Case-2,3,5 (two CTRL + one SIFT, mixed check)

  Identical W-state preparation. Remote action:

  The qubit marked SIFT (e.g., q11) is Z-measured, the classical result recorded, a fresh qubit in the same state is prepared and sent back.

  The other two qubits are simply reflected. Alice: performs a Bell measurement (CNOT then H followed by Z measurements) on the reflected pair, and a separate Z measurement on the SIFT-returned qubit; results are combined to compute the error rate.

• (c)

  Case-4,6,7 (one CTRL + two SIFT, majority-measure mode) Preparation as above. Remote action:

  Two qubits undergo SIFT (measure-resend); one qubit is reflected.

  Alice: Bell-measures the reflected qubit together with her retained q10, Z-measures the two SIFT-returned qubits, records the classical bits for later authentication.

• (d)

  Case-8 (SIFT-SIFT-SIFT, key-agreement mode) Preparation unchanged. Remote action:

  Bob, Charlie and Dave each SIFT their qubit: Z-measure → obtain classical bitr_i → XOR with private key K_i → permute bit positions according to identity string I_i → encode the new classical bit into a fresh |0〉 / |1〉 qubit → send back to Alice. Alice:

  • Z-measures the three returned qubits to recover the classical bits.

  • Reverses the I_i-based permutation to extract KB, KC, KD.

  • Computes the final shared key K = KA ⊗ KB ⊗ KC ⊗ KD.

Figure 4.

(a) Quantum circuit for case 1 in Table 2. (b) Quantum circuit for case 2 in Table 2 (similar to case 3 and case 5 in Table 2). (c) Quantum circuit for case 4 in Table 2 (similar to case 6 and case 7 in Table 2). (d) Quantum circuit for case 8 in Table 2.

Figure 5 illustrates the simulation results of the aforementioned quantum circuit. By comparing Figure 5 with Equation (1) we observe that the measurement results from the simulation consistently correspond to Equation (1), with no erroneous measurement outcomes present in Figure 5. This confirms that the four particles in the protocol maintain their entanglement characteristics in the W states. Consequently, since our proposed protocol is primarily based on the entanglement properties of the W states, this validates the security of the protocol we have proposed.

Figure 5.

(a) Run results of (a) in Figure 4. (b) Run results of (b) in Figure 4. (c) Run results of (c) in Figure 4. (d) Run results of (d) in Figure 4.

We also used Qiskit in Table 4 to simulate the protocol’s performance in a noisy environment by introducing two types of quantum noise, which were applied to single-qubit and two-qubit gates, respectively.

The single-qubit noise was modeled as amplitude damping noise, which simulates the energy dissipation of a qubit (e.g., spontaneous emission) causing a decay from the excited state |1〉 to the ground state |0〉. For instance, after applying an X gate, the qubit initialized in |0〉 may fail to fully flip to |1〉 due to noise. This type of noise was applied to all single-qubit gates, including X, H, and RY gates.

The two-qubit noise was modeled as depolarizing noise, which simulates the effect of environmental disturbance that randomly transforms a quantum state into a maximally mixed state (e.g., bit-flip or phase-flip errors). For example, after applying a CX gate, the entanglement between the two qubits may be lost due to noise. This noise was applied to all two-qubit gates, including CX and CZ gates.

Amplitude damping noise is a major source of noise in real quantum hardware, while depolarizing noise is suitable for modeling complex disturbances in multi-qubit operations. Therefore, we selected these two noise models. The noise parameter was set to 0.01, indicating a 1% probability of noise occurrence per gate operation.

According to the measurement results in Figure 6, it can be seen that the target W state still dominates the measurement results. Therefore, our protocol and quantum circuit have a certain robustness to noise.

Figure 6.

Measurement results of the quantum circuit in Figure 4 under noisy environment.

When sharing the key, if preparing one qubit takes time t₁ and the interval between the preparation of two successive qubits is t₂, the total time required to generate a key of length N is T = nt₁ + (n – 1)t₂.

Currently, the performance of quantum key agreement protocols is primarily evaluated using the quantum bit efficiency η = c / (q + b) proposed by Cabello [33], where c represents the bit length of the shared key obtained after the protocol is completed, q represents the total number of quantum bits used by the protocol, and b represents the number of classical bits used. In this protocol, the length of the final shared key is c = n bits. Alice prepares 8n W states particles, and the particles sent and returned during key negotiation are 6n in total, so q = 8n x 4 + 6n = 38n. The total number of classical bits used by Bob, Charlie, and Dave is 3n, so b = 3n. The quantum bit efficiency of this protocol is calculated as η = n/(38n + 3n) = 2.43%.

Table 5 presents a comparative analysis of the proposed CASQKA protocol against several existing quantum key agreement protocols in terms of quantum resource, identity authentication, semi-quantum properties, and qubit efficiency. Unlike most existing protocols, which either lack identity authentication or do not support semi quantum capabilities, the proposed protocol achieves both functions simultaneously. This dual capability enhances the applicability of our protocol in scenarios such as IoMT, where resource constrained devices and secure authentication are essential.

Although the qubit efficiency (3.03%) of the proposed protocol is moderate compared to certain high-efficiency protocols such as Ref [22] (53.33%) or Ref [25] (16.67%), it balances functionality and security requirements more comprehensively. Additionally, the use of W states offers robustness against particle loss, which is beneficial in practical noisy environments.

Moreover, the CASQKA protocol has the potential to be extended to support multi-user environments, dynamic participant joining, or even hierarchical key agreement structures in future research. This flexibility makes it a promising candidate for secure communication in emerging quantum-enhanced networks.

In this protocol, Alice is responsible for preparing all quantum states: a total of 8N W-states, each built with five single-qubit gates plus three CNOT gates, i.e., eight quantum gates per state. During the authentication phase, Bob handles three classical strings V_B, I_B and VB*V_B^*—amounting to 3N bits. Charlie and Dave perform the same computations, giving another 3N each. Alice processes the corresponding strings for all three parties (VB*V_B^*, I_B and VB*′V_B^{{*^\prime }}, etc.), so her related classical data also sum to 9N. Consequently, the total classical information that must be manipulated in the authentication stage is 18N bits.

As shown in Table 5, cluster states cannot be used for identity verification at all. Five-qubit entangled states, four-particle GHZ states, and single-particle states do not permit semi-quantum operation. Bell states support either semi-quantum communication or authentication, but not both simultaneously. Although W-states are more complex to prepare than Bell states, they enable both tasks—authenticated identification and semi-quantum key distribution—in a single scheme.

To investigate the impact of noise on the stability of the protocol, we implement a simulation framework using Qiskit to evaluate the quantum bit error rate (QBER) under various noise conditions. The quantum circuit first prepares a 4-qubit W state and introduces noise models before measurement. Two common types of quantum noise were considered: (1) amplitude damping noise, which models energy dissipation from the system to the environment. (2) depolarizing noise, which captures random transitions of the quantum state into a maximally mixed state. These noise types are representative of dominant errors in current quantum computing hardware.

In our simulations, we select four pairs of noise parameters (P_a, P_d), where P_a denotes the amplitude damping probability and P_d denotes the depolarizing probability. Specifically, the tested parameter sets were (0.001, 0.01), (0.005, 0.02), (0.01, 0.03), and (0.02, 0.04). For each configuration, the circuit was executed with increasing numbers of measurement shots to collect output distributions, from which the QBER was calculated by comparing with the ideal W state outcomes (i.e., computational basis states with Hamming weight one).

The results are visualized as QBER versus the number of measurement shots. In Figure 7, the notation “Noise Level: P_a, P_d” indicates the amplitude damping and depolarizing probabilities, respectively. Experimental findings indicate that as the number of particles increases, the QBER gradually decreases and eventually stabilizes. It is noteworthy that under higher noise level conditions (e.g., in the range of 0.02-0.04), the system maintains relatively higher QBER values, while lower noise configurations (e.g., 0.001-0.01) exhibit significantly superior low-error performance.

Figure 7.

Quantum bit error rate under various noise levels.

Based on the aforementioned noise model and the study of quantum bit error rate (QBER), we proceed to investigate the key generation rate (KGR) of the protocol. The estimated formula for the key generation rate is given by: 21KGR=max(0,1−H(QBER)),KGR = \max (0,1 - H(QBER)), where H(QBER) = – QBER · log₂ (QBER) – (1 – QBER) · log₂(1 – QBER) is the binary Shannon entropy function, also referred to as the bit entropy function, which quantifies the uncertainty of a single bit. In the simulation, we estimate the final usable key generation rate (KGR) by calculating the QBER from the measurement results and substituting it into the Shannon entropy function.

Figure 8 illustrates the relationship between the key generation rate and the number of particles (shots) for our protocol under varying noise levels. The results demonstrate that the key generation rate gradually increases with the number of shots and eventually approaches saturation. Notably, as the noise level escalates (e.g., from 0.001 to 0.04), the key generation rate exhibits a declining trend. Under elevated noise conditions (e.g., 0.04), the rate stabilizes at a comparatively lower level (below 0.5).

Figure 8.

Key generation rate under various noise levels.

Next, we compare the communication complexity of the proposed protocol with that of the protocol in Ref [5] (see Table 6 for details). Our proposed CASQKA protocol, as a multiparty semi-quantum key agreement scheme, features both identity authentication and controllability. It is well-suited for systems with strict security requirements and sufficient resources on the controller’s side. Although it offers more advanced functionalities, it sacrifices some efficiency. In contrast, the protocol in Ref [5] is designed for point-to-point quantum key distribution, making it suitable for simple two-party key distribution scenarios. While its functionality is limited, it achieves optimal efficiency.

Despite the advantages offered by the proposed controlled authentication semi-quantum key agreement (CASQKA) protocol in terms of security and efficiency within IoMT environments, there are several limitations that warrant further discussion.

First, the protocol assumes the presence of a trusted controller, which may not always be feasible or cost-effective in large-scale or decentralized IoMT systems. The compromise or malfunction of this controller could critically impact the protocol’s security.

Second, while the protocol reduces the quantum requirements for semi-quantum participants, it still assumes their ability to perform specific classical operations with high reliability.

Third, the simulation and evaluation of the protocol are performed under idealized noise models. Real-world quantum channels may exhibit more complex or unpredictable noise behavior, which could lead to higher error rates and lower key generation efficiency.

Future work will focus on addressing these challenges through experimental validation, controller decentralization, and adaptive noise-resilient techniques.

While the CASQKA protocol demonstrates theoretical feasibility and security, several practical challenges must be addressed to enable deployment in real-world IoMT systems:

Device compatibility: Most IoMT devices, such as wearable sensors and home-use medical instruments, lack full quantum capabilities. Our protocol accommodates this limitation by allowing these devices to operate in a semiquantum mode, performing only basic classical operations (e.g., SIFT and CTRL). However, implementing even these operations requires the integration of lightweight quantum communication modules, which remains an ongoing engineering challenge.

Interoperability: The IoMT ecosystem comprises heterogeneous devices from multiple manufacturers. To ensure smooth interoperability, standardization of quantum communication interfaces (e.g., encoding rules, authentication formats) is essential. Our protocol is designed to rely on simple and well-defined encoding rules (see Table 1), facilitating integration across diverse device types.

Integration with existing healthcare systems: Deploying CASQKA requires compatibility with traditional electronic health record (EHR) systems, hospital information systems (HIS), and communication infrastructures. This can be achieved by encapsulating the CASQKA protocol within existing network layers as a secure key distribution module, which provides encryption keys to classical protocols (e.g., TLS) used in healthcare data transfer.

Scalability and maintenance: The centralized trusted hospital server must manage entanglement distribution, identity verification, and error rate monitoring. This necessitates robust server-side hardware with quantum-capable interfaces, as well as efficient key management mechanisms. Periodic calibration, channel noise tracking, and synchronization across mobile IoMT nodes are required to maintain long-term system stability.

In summary, while the CASQKA protocol is conceptually well-suited for IoMT, real-world implementation requires careful attention to hardware design, protocol interoperability, and system integration. Future work will explore hardware prototypes and standard interface frameworks for practical deployment.