Post-Quantum Lattice-Based Cryptographic Schemes for Long-Term Data-at-Rest Protection in Enterprise Database Systems

Enterprise databases store sensitive financial, healthcare, genomic, and governmental records requiring long-term confidentiality. However, quantum computing threatens conventional RSA and elliptic-curve cryptography through Shor’s algorithm, while harvest-now-decrypt-later attacks expose encrypted archives to future decryption. This paper proposes a lattice-based post-quantum envelope-encryption architecture that replaces conventional key-wrapping mechanisms in transparent data encryption (TDE) systems while preserving AES-256 bulk encryption. The framework integrates a hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) and classical cryptographic combiner, Module-Lattice-Based Digital Signature Algorithm (ML-DSA) or Falcon Digital Signature Algorithm (FN-DSA) authentication, hash-chained audit logging, and policy-driven cryptographic agility. Seven algorithms support hybrid encapsulation, decapsulation, enterprise rekeying, audit verification, mode negotiation, and exposure-aware migration scheduling. An analytical performance model estimates a 9% latency increase per hybrid key-rewrapping operation, reaching 12% at the highest security level. Parallel processing reduces the projected rekeying time for ten million keys from over ten hours to under ninety seconds using 512 workers. A ten-year ML-DSA-authenticated audit trail across 1,000 tenants requires approximately 400 MB, compared with approximately 100 MB using FN-DSA. Four case studies covering financial, healthcare, genomic, and multinational systems demonstrate computationally feasible migration within one hour. Without migration, long-retention records face estimated residual exposure periods of 41–57 years under Mosca’s inequality. The findings indicate that cryptographic key management, rather than computational migration costs, represents the primary challenge in protecting enterprise databases against quantum threats. Future work includes hardware security module integration, constant-time implementations, and empirical validation under operational enterprise workloads.