System Architecture

Overview

FaceVault is a secure file encryption and decryption web application that uses face recognition as a second-factor authentication mechanism. The system implements end-to-end encryption with client-side key management and biometric-based key unlocking.

System Components

1. Frontend Application

• Technologies: React with TypeScript, Tailwind CSS, Wouter, TanStack Query.
• Responsibilities: UI, Face enrollment/auth, Client-side encryption/decryption, Key management.

2. Face Detection and Recognition

• Technologies: face-api.js, MediaStream API.
• Responsibilities: Face enrollment, Liveness detection, Face authentication, Face descriptor generation.

3. Cryptographic Operations

• Technologies: Web Crypto API (RSA-OAEP, AES-GCM, PBKDF2).
• Responsibilities: Key generation, Key wrapping/unwrapping, File encryption/decryption.

4. Local Storage

• Technologies: IndexedDB.
• Responsibilities: Storing face templates and wrapped private keys locally.

5. Backend API Server

• Technologies: Node.js, Express.js, Passport.js.
• Responsibilities: User management, Public key storage, File metadata storage, Rate limiting.

6. Database

• Technologies: PostgreSQL with Drizzle ORM.
• Responsibilities: Storing user accounts, public keys, and encrypted file metadata.

7. File Storage

• Responsibilities: Storage of encrypted file blobs.

Data Flow

User Registration

1. User provides credentials.
2. Client generates RSA key pair.
3. User enrolls face; Private key is wrapped with face-derived Key Encryption Key (KEK).
4. Public key and wrapped private key stored on server.
5. Face templates stored locally in IndexedDB.

File Encryption

1. Client generates random AES key.
2. File is encrypted with AES key.
3. AES key is encrypted with user's public key.
4. Encrypted file and metadata sent to server.

File Decryption

1. Server returns encrypted file and metadata.
2. User performs face authentication to derive KEK.
3. KEK unwraps private key.
4. Private key decrypts AES key.
5. AES key decrypts file content.

Security Model

Zero-Knowledge Architecture

• Private keys never leave the client in plaintext.
• Server never has access to face templates.
• All encryption/decryption happens client-side.

Key Management

• Asymmetric keys generated client-side.
• Private keys wrapped with biometric-derived KEK.
• Public keys stored on server for file encryption.