A Hybrid Post-Quantum Encryption Architecture with Self-Hosted Key Management for SME Cloud Data Protection

Harvesting ciphertext from cloud storage needs no quantum computer; decrypting it later does. That gapis the harvest-now-decrypt-later exposure: anything protected by RSA or ECDH today that must stay secret fordecades is already compromised. Small and medium-sized enterprises are least able to respond: they neither run theinfrastructure on which their data sits on nor employ a cryptographer. Bespoke migration suits firms with securitybudgets; a managed key service relocates trust rather than removing it. The obstacle is architectural, not cryptographic.We present Quantum Cloud Guard (QCG), a software-only three-layer architecture. No prior SME-oriented systemcombines its three elements: client-side hybrid post-quantum encryption, self-hosted key custody with client-verifiableML-DSA-87 signatures on served keys, and an integrated application-layer abuse-prevention gateway. Files neverleave the client: each is sealed under AES-256-GCM, its key wrapped to an ML-KEM-1024 public key from theenterprise’s key service. The enterprise alone administers it; it signs every key with ML-DSA-87, so a client thatpinned it detects substitution. Separating key custody from data custody is the point: a provider holding both can readthe data. On a 24 MHz STM32F407, ML-KEM-1024 key generation takes 40.8 ms and decapsulation 44.0 ms; on theserver every post-quantum operation stays sub-millisecond, signing adding 0.24 ms per request. The service runs ona 4.49 EUR/month virtual server. Under sustained flooding, the in-process gateway Sentinel Gate rejected 98.8% ofattack traffic while a legitimate client’s median latency moved from 621 to 625 ms. Being single-source, this showsfiltering effectiveness, not DDoS resilience.