A Hybrid Post-Quantum Encryption Architecture with Self-Hosted Key Management for SME Cloud Data Protection

• URL: http://arxiv.org/abs/2608.26777v1
• Date: Thu, 27 Aug 2026 08:09:17 GMT
• Title: A Hybrid Post-Quantum Encryption Architecture with Self-Hosted Key Management for SME Cloud Data Protection
• Abstract summary: Quantum Cloud Guard (QCG) is a software-only three-layer architecture.<n>It combines client-side hybrid post-quantum encryption, self-hosted key custody, and an integrated application-layer abuse-prevention gateway.<n>On a 24 MHz STM32F407, ML-KEM-1024 key generation takes 40.8 ms and decapsulation 44.0 ms; on the server every post-quantum operation stays sub-millisecond, signing adding 0.24 ms per request.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Harvesting ciphertext from cloud storage needs no quantum computer; decrypting it later does. That gap is the harvest-now-decrypt-later exposure: anything protected by RSA or ECDH today that must stay secret for decades is already compromised. Small and medium-sized enterprises are least able to respond: they neither run the infrastructure on which their data sits on nor employ a cryptographer. Bespoke migration suits firms with security budgets; a managed key service relocates trust rather than removing it. The obstacle is architectural, not cryptographic. We present Quantum Cloud Guard (QCG), a software-only three-layer architecture. No prior SME-oriented system combines its three elements: client-side hybrid post-quantum encryption, self-hosted key custody with client-verifiable ML-DSA-87 signatures on served keys, and an integrated application-layer abuse-prevention gateway. Files never leave the client: each is sealed under AES-256-GCM, its key wrapped to an ML-KEM-1024 public key from the enterprise's key service. The enterprise alone administers it; it signs every key with ML-DSA-87, so a client that pinned it detects substitution. Separating key custody from data custody is the point: a provider holding both can read the data. On a 24 MHz STM32F407, ML-KEM-1024 key generation takes 40.8 ms and decapsulation 44.0 ms; on the server every post-quantum operation stays sub-millisecond, signing adding 0.24 ms per request. The service runs on a 4.49 EUR/month virtual server. Under sustained flooding, the in-process gateway Sentinel Gate rejected 98.8% of attack traffic while a legitimate client's median latency moved from 621 to 625 ms. Being single-source, this shows filtering effectiveness, not DDoS resilience.

Related papers

• Sentinel-Based Failover for QKD-Augmented IPsec Tunnels [30.508117880183832]
  tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism.<n>Our open-source StrongSwan plugin uses a sentinel-based coordination protocol.<n> tunnel survives a complete KME outage without any interruption of the protected traffic.
  arXiv  Detail & Related papers  (2026-09-01T11:59:13Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Q-FE: A Quantum-Native 6G Far-Edge Architecture Securing Industrial IoT Digital Twins via CSIDH-PQC and Asynchronous Federated Learning [0.0]
  We propose Q-FE, a Quantum-Native 6G Far-Edge architecture integrating three co-designed components.<n>Q-FE reduces MAC-layer overhead by 62% versus ML-KEM/Kyber-1024, maintains P99.9 URLLC latency at 0.78 ms, and accelerates global-model convergence by 31% over synchronous Federated Learning.<n>A formal threat model confirms resilience against quantum eavesdropping, model-poisoning, and Sybil attacks.
  arXiv  Detail & Related papers  (2026-06-02T13:13:44Z)
• Post-Quantum Entropy as a Service for Embedded Systems [0.0]
  We build a Quantum Entropy as a Service (QE) system that moves QRNG-derived entropy from a Quantis device to ESP32-class clients over post-quantum-secured channels.<n>On the server side, the design exposes two paths: direct quantum entropy through a custom OpenSSL provider and mixed entropy through the Linux system pool.
  arXiv  Detail & Related papers  (2026-03-10T23:09:55Z)
• "MCP Does Not Stand for Misuse Cryptography Protocol": Uncovering Cryptographic Misuse in Model Context Protocol at Scale [27.85822797774986]
  The Model Context Protocol (MCP) is emerging as the interface for tool integration.<n>MCP provides no guarantees of authenticity or confidentiality, forcing developers to implement cryptography themselves.<n>We presentYSCOPE, the first domain-specific framework for detecting cryptographic misuses in MCP implementations.<n>Our study establishes the first ecosystem-wide view of cryptographic misuse in MCP and provides both tools and insights to strengthen the security foundations of this rapidly growing protocol.
  arXiv  Detail & Related papers  (2025-12-03T13:25:59Z)
• AmphiKey: A Dual-Mode Secure Authenticated Key Encapsulation Protocol for Smart Grid [1.382448805410091]
  AmphiKey is designed to secure smart grid communications against both classical and quantum threats.<n>It offers two distinct operational modes within a single framework: an Authenticated Mode and a Deniable Mode.<n>Key contributions include providing a flexible protocol with enhanced security, optional deniability, and efficiency adapted to the diverse needs of the smart grid infrastructure.
  arXiv  Detail & Related papers  (2025-09-01T18:21:51Z)
• SONNI: Secure Oblivious Neural Network Inference [0.29494468099506893]
  We identify a weakness in this protocol that enables a completely undetectable novel model-stealing attack.<n>This attack works even under multikey encryption that prevents a simple collusion attack to steal model parameters.<n>We propose a mitigation that protects privacy even in the presence of a malicious server and malicious client or model provider.
  arXiv  Detail & Related papers  (2025-04-26T17:23:38Z)
• Secure Multi-Party Biometric Verification using QKD assisted Quantum Oblivious Transfer [34.46964288961048]
  We present a practical implementation of a secure multiparty computation application enabled by quantum oblivious transfer (QOT)<n>The QOT protocol uses polarization-encoded entangled states to share oblivious keys between two parties with quantum key distribution (QKD) providing authentication.<n>A practical use case is demonstrated for privacy-preserving fingerprint matching against no-fly lists from Interpol and the United Nations.
  arXiv  Detail & Related papers  (2025-01-09T15:51:30Z)
• Enhancing Industrial Cybersecurity: SoftHSM Implementation on SBCs for Mitigating MITM Attacks [1.8434042562191815]
  This study simulates the use of SoftHSM on a single-board computer (SBC) to enhance industrial system security and cost-effectively MITM attacks. The security system integrates AES and RSA cryptographic algorithms, with SoftHSM handling RSA key storage. In terms of performance, the system achieved an average encryption time of 3.29 seconds, a slot access time of 0.018 seconds, and a decryption time of 2.558 seconds.
  arXiv  Detail & Related papers  (2024-09-16T02:40:02Z)
• MUDGUARD: Taming Malicious Majorities in Federated Learning using Privacy-Preserving Byzantine-Robust Clustering [34.429892915267686]
  Byzantine-robust Federated Learning (FL) aims to counter malicious clients and train an accurate global model while maintaining an extremely low attack success rate. Most existing systems, however, are only robust when most of the clients are honest. We propose a novel Byzantine-robust and privacy-preserving FL system, called MUDGUARD, that can operate under malicious minority emphor majority in both the server and client sides.
  arXiv  Detail & Related papers  (2022-08-22T09:17:58Z)
• Recovering AES Keys with a Deep Cold Boot Attack [91.22679787578438]
  Cold boot attacks inspect the corrupted random access memory soon after the power has been shut down. In this work, we combine a novel cryptographic variant of a deep error correcting code technique with a modified SAT solver scheme to apply the attack on AES keys. Our results show that our methods outperform the state of the art attack methods by a very large margin.
  arXiv  Detail & Related papers  (2021-06-09T07:57:01Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.