A Systematic Architectural Process for Non-Invasive Introduction of Post-Quantum Cryptography on Permissioned Blockchains: Application to Hyperledger Besu

The evolution of quantum computing imposes the need to migrate distributed systems to cryptographic mechanisms resistant to quantum attacks. However, in permissioned blockchains, the direct replacement of cryptographic primitives tends to compromise the compatibility, interoperability, and evolutionary maintenance of existing clients. This work proposes a systematic architectural process to guide the non-invasive introduction of post-quantum cryptography in permissioned blockchains, based on the identification, classification and selection of low-coupling architectural points for the integration of new cryptographic primitives. As a case study, the process is applied to Hyperledger Besu, in which the migration is conducted by tunneling the communication protocol in TLS 1.3 and extending the validation pipeline using hybrid signatures integrated via JNI to the liboqs library. The experimental evaluation, conducted on x86_64 and ARMv9 platforms, demonstrates that the application of the process preserves the customer's original architecture, maintaining its interoperability and enabling the incremental adoption of post-quantum cryptography. The results also show that, although certain post-quantum primitives have superior computational performance than classical alternatives, the main impact of migration is concentrated in the increase of cryptographic payload and distributed communication. The results obtained indicate that the proposed process constitutes a practical and repeatable approach to support the cryptographic evolution of permissioned blockchains.