DocLok: Cloud Document Vault

Problem Statement

Individuals increasingly store personal documents (identity proofs, certificates, medical records) online. While convenient for job applications and financial processes, this creates risks of unauthorized access, data exposure, and fraud. Users lack secure, privacy-focused document management with strong protection and control.

Target Audience

Students, job seekers, professionals, and families needing secure storage of identity proofs, certificates, and medical records with privacy protection during banking, healthcare, and job verification processes.

Unique Selling Proposition (USP)

• Security-first approach protecting documents from upload to access
• AES-256 encryption before cloud storage with user-controlled keys (derived from password)
• Zero-knowledge environment—only user can decrypt, not the system
• Multi-layer authentication (password, OTP, PIN) for access control
• SHA-256 tamper detection ensures file integrity
• Complete user control, privacy, and trust in document management

Overview and Scope

DocLok is a cloud-based document vault that detects and masks sensitive data, encrypts documents before upload, verifies file integrity, and implements multi-layer authentication to ensure documents remain private, tamper-proof, and user-controlled.

How the Project is Different from Competitors

Unlike platforms focusing on storage and sharing, DocLok prioritizes content protection with encryption-first architecture at every stage.

Key Differentiators

• Encryption-First: Documents are encrypted (AES-256) before cloud storage
• User-Controlled Keys: Encryption key derived from user password (no server access)
• Content Protection: Sensitive data is detected and masked before encryption
• MFA at Every Login: OTP-based authentication for strong identity verification
• PIN-Based Access: Additional PIN required for upload, view, and download
• Session Timeout: Auto logout after inactivity for safety
• Tamper Detection: SHA-256 hashing ensures data integrity
• Flexible Usage: Supports various personal documents

Technical Features

• AES-256 Encryption: Ensures strong confidentiality by encrypting documents before storage using a symmetric key algorithm.
• SHA-256 Hashing: Generates a unique fingerprint of encrypted files to detect any tampering during retrieval.
• OCR-Based Text Extraction: Uses Tesseract/EasyOCR to convert document images into machine-readable text.
• Image Preprocessing: OpenCV is used to enhance image quality (noise removal, thresholding) to improve OCR accuracy.
• Sensitive Data Detection & Masking: Pattern-based detection (using regex) identifies structured data like Aadhaar and PAN numbers and masks them before encryption.
• Multi-Factor Authentication (MFA): OTP-based verification adds an extra layer of user authentication.
• Cloud Storage (AWS S3): Stores encrypted documents securely with high availability and scalability.

System Architecture

Processing Flow

1. Upload: User uploads image/PDF via frontend
2. Preprocessing: OpenCV enhances image (grayscale, thresholding, noise reduction)
3. OCR: Tesseract/EasyOCR extracts text
4. Sensitive Data Detection: Regex identifies Aadhaar, PAN numbers
5. Masking: Partial masking (e.g., 1234 5678 9012 → XXXX XXXX 9012)
6. Encryption: AES-256 encryption converts file to unreadable binary
7. Hashing: SHA-256 hash generated for integrity verification
8. Storage: Encrypted file → AWS S3; Metadata (File ID, User ID, Hash, Salt, S3 path) → MongoDB

AES Encryption Mechanism

AES-256 operates on 128-bit data blocks with 256-bit key size and 14 rounds. Each round performs SubBytes (substitution), ShiftRows (row shifting), MixColumns (column mixing), and AddRoundKey operations, ensuring highly randomized and secure output.

Encryption Key Management

Key Generation: Derived from user password + random salt using PBKDF2 KDF. Salt randomly generated per file, stored with metadata. Same password generates different keys per file; prevents brute-force attacks.

Decryption: User enters password → system retrieves salt → regenerates key via KDF → decrypts file

Password Recovery: Recovery key generated at encryption and provided to user. If both password and recovery key lost, documents become permanently inaccessible. Ensures encryption keys never stored, giving users complete control and preventing unauthorized access even after system breach.

Hashing and Integrity Verification

SHA-256 generates unique hash stored with metadata. During retrieval: fetch file → recompute hash → compare with stored hash. Mismatch indicates file tampering.

Authentication & MFA

Primary Authentication: Password-based login with OTP (sent to email/mobile) enforced at every login for continuous identity verification. Password also derives encryption key via secure KDF.

Secondary Authorization: PIN required for upload, view, and download operations. Acts as secondary authentication within active session with limited incorrect attempt protection.

Backend & Frontend Design

Backend: Python with Streamlit. Handles file upload, preprocessing (OpenCV), OCR, sensitive data masking, AES-256 encryption, and SHA-256 hashing. Event-driven execution; extensible to Flask/FastAPI.

Frontend: Streamlit interface with file upload, document preview, and secure download options. Triggers backend processing based on user actions.

Cloud Storage

AWS S3: Stores encrypted documents with controlled access policies and unique object paths.

MongoDB: Maintains metadata (File ID, User ID, Hash, Salt, S3 path) for efficient management.

Hybrid Approach: Encrypted files in S3, metadata in MongoDB. Upload: process, encrypt, store file in S3 + metadata in MongoDB. Access: retrieve metadata, fetch encrypted file, verify hash, decrypt.

Dashboard

Navigation: Dashboard, Upload Document, My Documents, Security Settings, Profile, Logout

Main Dashboard: Total documents, recent activity, storage usage, security status

Upload Section: File upload, PIN required, processing/success status

My Documents: File list with details, View/Download/Delete actions (PIN required)

Security: PIN management, indicators for Encrypted/Verified/Tampered status

Deployment

Deploy via Streamlit Cloud from GitHub repository. Frontend and backend run in single environment with encrypted documents in S3. Cost-effective and suitable for small-scale usage and demonstration.

Cost and Pricing

Development/Testing: OCR & Processing (free), Streamlit Cloud (free), AWS S3 (₹2-5/month), Data Transfer (₹0-30/month) = ₹50-60/month

Scaling (100 users, 50MB/user avg): Storage (₹10/month), Requests (₹80-100/month) = ₹80-150/month

Outcome

Secure, privacy-focused document storage with protection against unauthorized access, tamper-proof verification, and increased trust in digital document handling.

Limitations

Requires internet connectivity; slight processing delay due to security operations.

Timeline

Month 1: System setup, document upload/preprocessing, OCR integration

Month 2: Sensitive data detection/masking, AES encryption, hashing implementation

Month 3: Frontend development, AWS S3 integration, authentication, testing, deployment

Future Scope

• Scale to enterprises (banks, hospitals, legal, government) with role-based access control and audit logs
• Add automated document classification and AI-based sensitive data detection
• Implement paid tier with advanced features for users and organizations to scale storage and security