A Hybrid Encryption Architecture With Distributed Key Management for Cloud-Based Data Digitization at Hai Phong University

The authors' earlier study compared the performance of AES, RSA, and a hybrid encryption scheme on digitized data, finding the hybrid model to be the best performance trade-off; however, real-world effectiveness depends heavily on how encryption keys are organized, distributed, and protected across multiple university units. This paper proposes a five-layer architecture — digitization application layer, hybrid encryption layer, Key Management Service (KMS), Role-Based Access Control (RBAC) layer, and cloud storage infrastructure — together with a key lifecycle process (generation, distribution, use/rotation, revocation, audit logging). The team built a simulation model of KMS workload as the number of managed users/records grows from 100 to 10,000, measuring key rotation time, distribution latency, access-control latency, revocation latency, and key-metadata storage size. All figures are simulated data, disclosed transparently to illustrate the scalability of the proposed architecture rather than measurements from a production system. Results show that key-rotation cost and revocation latency scale nearly linearly with system size, while access-control latency grows more slowly thanks to caching, indicating the architecture scales adequately for the university's current and near-term (3–5 year) needs. The paper also provides a conceptual-level threat analysis and mitigation recommendations for insider key-leakage risk.