Write-only limited-read filesystem

Abstract

A secure filesystem provides write-only access with limited read. The filesystem stores data as an encrypted block on a user machine using a symmetric (active) key, along with metadata including a read condition. While the read condition is valid, local applications can read the data using the active key. When the read condition becomes invalid, the active key is deleted so local applications no longer have access. However, the filesystem encrypts the active key to yield an inactive key, using an RSA public key. The corresponding private key is sent to an authorized party machine, but deleted from the user machine. Thus the user machine is unable to decrypt the inactive key, but the authorized party machine can still read the data by first decrypting the inactive key using the private key to regenerate the active key, and then decrypting the encrypted block using the regenerated active key.