PQ-Neurolink: latency-aware post-quantum-ready secure communication for distributed brain–computer interfaces

Introduction: Distributed electroencephalography (EEG) brain-computer interface (BCI) systems increasingly transmit neural data and control messages between a head-worn device, a nearby hub, and cloud-assisted services. These links require integrity, authenticity, replay protection, and low latency, while migration to post-quantum cryptography can increase session-establishment cost. Methods: We present PQ-NeuroLink, a latency-aware post-quantum-ready communication framework that separates authenticated session establishment from the symmetric streaming fast path. The design supports classical X25519, post-quantum ML-KEM-768, and hybrid ML-KEM-768 plus X25519 key establishment, with pinned ML-DSA public keys for endpoint identity binding. The prototype was evaluated using EEG-derived traffic from public datasets over BLE-like and Wi-Fi-like link profiles, 1-hop and 2-hop topologies, symmetric key-update and public-key refresh events, active tampering scenarios, and MCU-informed resource and processing-energy projections. Results: Identity pinning and transcript binding prevented successful modeled session-splicing attempts. Post-quantum and hybrid modes primarily increased handshake bytes rather than steady-state streaming latency. In the most constrained BLE 1-hop summary condition, the hybrid M3 mode increased p95 latency by 0.45 ms relative to the unsecured M0 baseline while maintaining 99.0% packet delivery. Discussion: Post-quantum-ready authenticated session establishment can be integrated into distributed EEG communication prototypes when public-key operations are kept off the per-frame path. PQ-NeuroLink provides a reproducible communication-layer basis for secure next-generation BCI deployment studies requiring low-latency operation and long-horizon post-quantum protection.