PQ-FundusChain: a postquantum blockchain framework for secure and privacy-preserving retinal fundus image sharing in teleophthalmology

Introduction Teleophthalmology depends on secure exchange of retinal fundus images between primary care screening locations and referral centers. Current image-sharing systems remain vulnerable to quantum attacks on public-key cryptography and to centralized storage failures with limited auditability. Methods This paper presents PQ-FundusChain, a consortium blockchain framework for quantum-resistant fundus image sharing. Each image is encrypted with an AES-256-GCM session key encapsulated using ML-KEM (FIPS 203). ML-DSA (FIPS 204) authenticates blockchain transactions. Encrypted images are stored in decentralized off-chain storage, while content hashes, metadata, and access policies are recorded on-chain. Access requests are evaluated through a risk-aware policy combining trust, access-history, and location scores with a fundus sensitivity score based on retinal anatomy and diabetic retinopathy severity. Results Experimental evaluation on the public Messidor-2 dataset shows a share-side cryptographic and hashing cost of approximately 4.02 ms per image, an access-side cost of approximately 3.48 ms, smart-contract execution of approximately 0.25 ms for both AccessGrant and PolicyUpdate, and a per-image on-chain record of approximately 4.83 KB independent of image resolution. The additional latency introduced by postquantum mechanisms remains below 1 ms for image sharing. Discussion The results demonstrate that postquantum protection can be incorporated into teleophthalmology workflows with modest computational overhead, with security analysis confirming confidentiality, integrity, authentication, non-repudiation, fine-grained access control, and resistance to harvest-now, decrypt-later attacks.