Planning: Post-Quantum Identity and Audit for Medical XR Training

In healthcare provider organizations, immersive simulation systems include virtual and augmented reality headsets for users to interact with complex digital representations of patient data. However, the digital security protecting this sensitive information is at risk. This one-year planning project, led by Meharry Medical College, seeks to develop an expert-reviewed plan for building secure immersive health training systems. In collaboration with Middle Tennessee State University, Vanderbilt University, Oak Ridge National Laboratory, Microsoft Corporation, and IonQ, engage in intentionally coordinated convenings bringing together experts in clinical simulation, information security, and quantum computing. The team will establish a partnership and governance agreement, develop a research plan, construct a security architecture with a threat analysis, and design a graduate mentorship program. The activity will provide graduate students with practical knowledge on quantum-resistant cybersecurity and health information protection. The project materials will be made freely available to educators, clinical trainers, and information technology staff for broad adoption. This collaborative planning project establishes the partnership, methods, and reference design required to examine quantum-safe security for immersive systems for clinical training purposes. Identity management, access control, and audit mechanisms in extended reality clinical training platforms and digital patient twins depend on classical public-key cryptography, principally the Rivest-Shamir-Adleman (RSA) and elliptic-curve families, both vulnerable to cryptographically relevant quantum computers and to harvest-now, decrypt-later collection. Following curated workshops and other convenings, a comprehensive analysis of current literature and standards, as well as comparative assessment of candidate cryptographic and privacy-preserving techniques are anticipated to lead to 1) specification of security and performance requirements, 2) realistic threat models, 3) data governance and compliance needs, and 4)development of a reference architecture which will incorporate quantum resistant identity management, privacy preserving access control, tamper evident audit logging and low latency computation for virtual reality (VR) and augmented reality (AR) applications. The expected results include an integrated, quantum-resilient reference architecture for privacy-preserving clinical extended reality and an implementation ready research plan that reduces technical and organizational risks and advances the secure adoption of immersive technologies in healthcare training. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.