🔐 SecureVault DMS

A Robust Secure Document Management System with Military-Grade Encryption

Enterprise-grade document security with hybrid encryption, role-based access control, and secure file sharing — all from your command line.

📋 Table of Contents

Overview
Features
Security Architecture
Installation
Usage
Project Structure
Technical Details
Screenshots
Contributing
License

🌟 Overview

SecureVault DMS is a command-line Secure Document Management System designed for information security applications. It implements a comprehensive security model combining symmetric and asymmetric encryption to provide confidentiality, integrity verification, and secure document sharing between users.

Built as a demonstration of modern cryptographic practices, this system showcases:

Hybrid Encryption — AES-256 for data + RSA-2048 for key exchange
Zero-Knowledge Architecture — Documents are encrypted client-side before storage
Integrity Verification — SHA-256 hashing ensures document authenticity

✨ Features

🔒 Security Features

Feature	Description
AES-256 Encryption	Documents are encrypted using AES-256 in CBC mode with random IVs
RSA-2048 Key Pairs	Each user gets a unique RSA key pair for secure key exchange
SHA-256 Hashing	Password hashing and file integrity verification
Hybrid Encryption	Combines speed of symmetric encryption with security of asymmetric

👥 User Management

Feature	Description
User Registration	Secure user registration with password hashing
Authentication	Session-based authentication system
Role-Based Access	User and Admin roles with different privileges
RSA Key Generation	Automatic key pair generation on registration

📄 Document Management

Feature	Description
Secure Upload	Encrypt and upload any file type
Secure Download	Decrypt and verify file integrity on download
Document Sharing	Share encrypted documents with other users
Integrity Verification	Automatic hash verification on download

🛡️ Admin Capabilities

View all registered users
View all documents in the system
Delete any document (admin override)

🏗️ Security Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                         SECUREVAULT DMS ARCHITECTURE                        │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐    │
│  │   User Input     │────▶│  Authentication  │────▶│  Authorization   │    │
│  │  (CLI Interface) │     │  (SHA-256 Hash)  │     │  (RBAC System)   │    │
│  └──────────────────┘     └──────────────────┘     └──────────────────┘    │
│                                                              │              │
│                                                              ▼              │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │                        ENCRYPTION PIPELINE                           │  │
│  │  ┌─────────────┐     ┌─────────────┐     ┌─────────────────────────┐ │  │
│  │  │  Document   │────▶│  AES-256    │────▶│   RSA-2048 Encrypted   │ │  │
│  │  │  (Plaintext)│     │  Encryption │     │   AES Key + IV + Data  │ │  │
│  │  └─────────────┘     └─────────────┘     └─────────────────────────┘ │  │
│  └──────────────────────────────────────────────────────────────────────┘  │
│                                                              │              │
│                                                              ▼              │
│  ┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐    │
│  │  SQLite Database │◀────│  Metadata Store  │◀────│ Encrypted Files  │    │
│  │  (Users, Docs)   │     │  (Hashes, Keys)  │     │  (uploads/ dir)  │    │
│  └──────────────────┘     └──────────────────┘     └──────────────────┘    │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Encryption Flow

Upload Process:

Document → Generate AES-256 Key → Encrypt with AES-CBC → 
Encrypt AES Key with User's RSA Public Key → Store Encrypted Data + Metadata

Download Process:

Retrieve Encrypted Data → Decrypt AES Key with RSA Private Key → 
Decrypt Document with AES → Verify SHA-256 Hash → Output Decrypted File

Sharing Process:

Decrypt AES Key (Owner's Private Key) → Re-encrypt AES Key (Target's Public Key) → 
Create Share Record → Target User Can Now Decrypt

🚀 Installation

Prerequisites

Python 3.8 or higher
pip (Python package manager)

Quick Start

# Clone the repository
git clone https://github.com/khizer-flow/securevault-dms.git
cd securevault-dms

# Create virtual environment (recommended)
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install cryptography pycryptodome

# Run the application
python main.py

Dependencies

cryptography==41.0.7
pycryptodome==3.19.0

💻 Usage

Starting the Application

python main.py

Main Menu (Unauthenticated)

==================================================
    SECURE DOCUMENT MANAGEMENT SYSTEM
==================================================
1. Register
2. Login
3. Exit

Document Operations (Authenticated)

==================================================
    SECURE DOCUMENT MANAGEMENT SYSTEM
==================================================
Welcome, johndoe (user)

--- DOCUMENT MANAGEMENT ---
1. Upload Document
2. Download Document
3. List My Documents
4. List Shared Documents
5. Share Document
6. Delete Document

--- ACCOUNT ---
9. Logout
0. Exit

Example Workflow

# 1. Register a new user
> Choose: 1 (Register)
> Username: alice
> Password: ********
> Register as admin? (y/N): n
✅ User registered successfully!

# 2. Login
> Choose: 2 (Login)
> Username: alice
> Password: ********
✅ Login successful! Welcome alice (user)

# 3. Upload a document
> Choose: 1 (Upload Document)
> Enter file path: /path/to/secret-report.pdf
✅ Document 'secret-report.pdf' uploaded and encrypted successfully!

# 4. Share with another user
> Choose: 5 (Share Document)
> Enter document ID: 1
> Enter target username: bob
✅ Document shared successfully with bob!

📁 Project Structure

securevault-dms/
├── 📄 main.py              # CLI interface and main application loop
├── 🔐 crypto.py            # Cryptographic operations (AES, RSA, SHA-256)
├── 👤 auth.py              # User authentication and session management
├── 📂 document_manager.py  # Document CRUD operations and sharing
├── 💾 database.py          # SQLite database initialization and queries
├── 📦 models.py            # Data models (User, Document)
├── 📋 requirements.txt     # Python dependencies
├── 📁 uploads/             # Encrypted document storage
└── 📖 README.md            # This file

Module Responsibilities

Module	Purpose
`main.py`	Entry point, CLI menu, user interaction handling
`crypto.py`	All cryptographic operations including encryption/decryption
`auth.py`	User registration, login, session management, RBAC
`document_manager.py`	File upload, download, sharing, and deletion
`database.py`	SQLite database schema and query operations
`models.py`	Dataclass definitions for User and Document entities

🔧 Technical Details

Cryptographic Specifications

Algorithm	Purpose	Key Size
AES-256-CBC	Document encryption	256-bit
RSA-OAEP	Key encryption/exchange	2048-bit
SHA-256	Password hashing, file integrity	256-bit

Database Schema

-- Users Table
CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT UNIQUE NOT NULL,
    password_hash TEXT NOT NULL,
    role TEXT NOT NULL DEFAULT 'user',
    public_key TEXT NOT NULL,
    private_key TEXT NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Documents Table
CREATE TABLE documents (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    filename TEXT NOT NULL,
    file_path TEXT NOT NULL,
    file_hash TEXT NOT NULL,
    encrypted_key TEXT NOT NULL,
    owner_id INTEGER NOT NULL,
    uploaded_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    is_encrypted BOOLEAN DEFAULT TRUE,
    FOREIGN KEY (owner_id) REFERENCES users(id)
);

-- Document Shares Table
CREATE TABLE document_shares (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    document_id INTEGER NOT NULL,
    shared_with_user_id INTEGER NOT NULL,
    shared_by_user_id INTEGER NOT NULL,
    shared_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (document_id) REFERENCES documents(id),
    UNIQUE (document_id, shared_with_user_id)
);

Security Considerations

⚠️ Note: This is an educational/demonstration project. For production use, consider:

Storing private keys in a hardware security module (HSM)

Implementing proper key derivation functions (Argon2, bcrypt) instead of raw SHA-256 for passwords

Adding audit logging and rate limiting

Implementing secure key backup and recovery mechanisms

📸 Screenshots

Registration & Login

🚀 Secure Document Management System Started!

==================================================
    SECURE DOCUMENT MANAGEMENT SYSTEM
==================================================
1. Register
2. Login
3. Exit

Enter your choice: 1

--- USER REGISTRATION ---
Username: alice
Password: ********
Confirm Password: ********
Register as admin? (y/N): n
✅ User registered successfully!

Document Management

==================================================
    SECURE DOCUMENT MANAGEMENT SYSTEM
==================================================
Welcome, alice (user)

--- DOCUMENT MANAGEMENT ---
1. Upload Document
2. Download Document
3. List My Documents
4. List Shared Documents
5. Share Document
6. Delete Document

--- ACCOUNT ---
9. Logout
0. Exit

Enter your choice: 3

--- MY DOCUMENTS ---
ID: 1, Filename: confidential-report.pdf, Uploaded: 2024-12-17 00:00:00
ID: 2, Filename: project-plans.docx, Uploaded: 2024-12-17 00:05:00

🤝 Contributing

Contributions are welcome! Here's how you can help:

Fork the repository
Create a feature branch (git checkout -b feature/amazing-feature)
Commit your changes (git commit -m 'Add amazing feature')
Push to the branch (git push origin feature/amazing-feature)
Open a Pull Request

Ideas for Improvements

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

👨‍💻 Author

Name

GitHub: @khizer-flow

⭐ Star this repository if you found it helpful!

Built with 🔐 by security enthusiasts, for security enthusiasts

Name		Name	Last commit message	Last commit date
Latest commit History 4 Commits
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
auth.py		auth.py
crypto.py		crypto.py
database.py		database.py
document_manager.py		document_manager.py
main.py		main.py
models.py		models.py
project.py		project.py
requirements.txt		requirements.txt

License

khizer-flow/securevault-dms

Folders and files

Latest commit

History

Repository files navigation