Secure Financial Report Sharing

Advanced Faiz Encryption

NRP	Name
5025231074	Rogelio Kenny Arisandi
5025231163	Muhammad Thariq Darobi
5025231174	Faiz Adli Nugraha
5025231069	R. Rafif Aqil Aabid Hermawan

Report - Assignment 1

https://docs.google.com/document/d/1jTE7xVNk0bXiXEIJM_iNs1s5qMhB_ohlz65qlE08njI/edit?usp=sharing

Introduction

This project is a secure, multi-user web application build with the Flask framework. It provides a platform for users to securely upload, store, and share confidential files. This project is designed to meet the specific scenario of exchanging sensitive financial reports within an organization

Core Objective

The main objective is to ensure the confidentiality and integrity of user-uploaded files. Confidentiality is achieved by encrypting all files and associated metadata using symmetric algorithms. Integrity is achieved by verifying a file’s SHA-256 hash upon download, guaranteeing it has not been tampered

Core Features

User Management

• Full authentication: users can register and log in.
• Passwords are securely hashed using SHA-256 with 600,000 iterations via set_password, and verified with check_password.

Secure File Upload

• Authenticated users can upload files via a dedicated form.
• Users must choose one of the supported symmetric algorithms: AES-CBC, DES-CBC, or RC4.
• Files are encrypted on the server and stored in the uploads/ directory.

Data Sharing

• File owners can share uploaded documents with other registered users.
• Sharing is enforced via a database-level permission system.

File Retrieval & Decryption

• Authorized users (owner or shared recipients) can download and decrypt files.
• Decryption occurs only after the user is authenticated and their permissions for the file are verified.

Performance Logging

• All encryption/decryption operations are logged to instance/crypto_bench.jsonl.
• Each log entry records: algorithm used, file size, time taken (ms), and final ciphertext size.

Excel Data Flow and Encryption Process

This process describes how Excel data is securely handled throughout the system from the moment a user uploads a file, to when another authorized user views the decrypted content on the Excel detail page.

1. Upload and Parsing When a user uploads an Excel file (.xlsx), the system first parses the file using the openpyxl library. The contents of the spreadsheet are read and converted into a structured DataFrame format. This allows the system to analyze and extract relevant financial information such as totals, transaction records, or specific cell ranges before encryption.

2. Encryption of Parsed Data After parsing, the structured DataFrame data is serialized into a string or JSON format. This serialized representation is then encrypted using the user’s unique encryption key derived from the PBKDF2 function (as explained in the Key Derivation section The encryption process utilizes one of the supported symmetric algorithms AES-CBC, DES-CBC, or RC4 depending on the user’s selection at upload time. The encrypted output is stored in the database under the description field of the corresponding document record, ensuring that even the parsed Excel summary data remains confidential.

3. Storage in the Database Once encrypted, both the file metadata (e.g., filename, hash, algorithm, and size) and the encrypted parsed data are committed to the database through SQLAlchemy ORM. The actual encrypted file (.enc) is stored in the /uploads directory, while the encrypted summary string remains safely stored within the database table. This dual-storage mechanism ensures both data integrity and efficient retrieval without exposing plaintext information.

4. Decryption upon User Access When a user clicks the “See Excel Detail” button, the system first verifies that the user is authenticated and authorized to access the file. After verification, the system retrieves the encryption key belonging to the document’s owner. This key is then used to decrypt the encrypted summary text stored in the database.

5. Display of Decrypted Data The decrypted summary is converted back into a readable, structured DataFrame format. The web application then renders this decrypted content in the Excel detail page using Flask’s render_template. This enables the authorized user to view the original, human-readable data extracted from the Excel file without ever exposing the raw file or unencrypted data on the server.

6. End-to-End Security Throughout this process, all operations including parsing, encryption, decryption, and viewing are logged in the system’s crypto_bench.jsonl file for transparency and performance auditing. This ensures that every access and transformation of sensitive data is recorded with the algorithm used, execution time, and file metadata for traceability.

Technologies Used

• Backend: Python 3, Flask and WTForm for Form Authentication.
• Database: Flask SQLAlchemy with SQLite database
• Security: PyCryptodome and Werkzeug
• File Processing: Openpyxl, used for analyzing uploaded excel spreadsheets

Requirements

• Python 3.10+
• Virtual environment (venv)

Installation and Setup

1. Clone & enter the project:

   git clone https://github.com/NETICS-Laboratory/secure-financial-report-sharing-advanced-faiz-encryption.git
   cd secure-financial-report-sharing-advanced-faiz-encryption/backend

2. Create & activate virtual environment:

   # Windows (PowerShell)
   python -m venv .venv
   .\.venv\Scripts\Activate.ps1
   
   # macOS/Linux
   python3 -m venv .venv
   source .venv/bin/activate

3. Upgrade pip:

   python -m pip install --upgrade pip

4. Install dependencies:

   pip install Flask flask-sqlalchemy flask-jwt-extended flask-cors werkzeug cryptography pandas openpyxl email_validator Flask-WTF flask-login pycryptodome

5. Configure environment variables:

   # Windows (PowerShell)
    if (!(Test-Path .\config.py)) { Copy-Item .\config-example.py .\config.py -Force }; python -c "import secrets,pathlib,re; p=pathlib.Path('config.py'); s=p.read_text(encoding='utf-8').replace('\t','    '); k=secrets.token_hex(32); s=re.sub(r'(?m)^\s*SECRET_KEY\s*=.*','    SECRET_KEY = os.environ.get(\'SECRET_KEY\', \''+k+'\')',s,1); p.write_text(s, encoding='utf-8')"
   
   # macOS/Linux
   [ -f config.py ] || cp config-example.py config.py; python3 -c "import secrets,pathlib,re; p=pathlib.Path('config.py'); s=p.read_text(encoding='utf-8').replace('\t','    '); k=secrets.token_hex(32); s=re.sub(r'(?m)^\s*SECRET_KEY\s*=.*','    SECRET_KEY = os.environ.get(\'SECRET_KEY\', \''+k+'\')',s,1); p.write_text(s, encoding='utf-8')"

6. Run the application:

   python main.py

7. Open your browser:

   http://127.0.0.1:5050/
   

Usage

Encrypting Files (Upload)

1. Register and log in.
2. Click Upload, choose a file.
3. Select an algorithm (AES-CBC, DES-CBC, or RC4).
4. Submit. The encrypted blob is saved under uploads/{document_id}.enc.
5. For Excel files, a description/summary is generated and encrypted.

Decrypting Files (Download)

1. On the Home page, click Download on a file you own or that was shared with you.
2. The app decrypts server-side and sends you the plaintext file if integrity (SHA-256) matches.

Notes on Key Usage

• You do not type keys manually. Keys are derived per user:

  KDF: PBKDF2-HMAC-SHA256(secret_key, salt=user_id, iterations=600_000)
  

• Changing SECRET_KEY after uploads will break decryption for existing files.
• Shared files decrypt with the owner’s key automatically (the app handles this).

Project Structure

backend/
├── config.py                 # Default config (uses env overrides)
├── config-example.py         # Example config
├── encryption.py             # AES/DES/RC4 + PBKDF2 helpers
├── excel_analyzer.py         # Excel header check + template generator
├── main.py                   # Flask app factory, routes, logging, bootstrap
├── models.py                 # SQLAlchemy models (User, Document, M2M shares)
├── templates/                # Jinja2 templates (Tailwind UI)
│   ├── _form_helpers.html
│   ├── details.html
│   ├── index.html
│   ├── layout.html
│   ├── login.html
│   ├── register.html
│   ├── share.html
│   └── upload.html
├── instance/
│   └── crypto_logs/
│       └── crypto_bench.jsonl   # created at runtime
└── uploads/                     # encrypted blobs ({document_id}.enc)

Screenshots

Interface Highlights

• Home
• Login
• Register
• Home (Logged in)
• Details
• Upload