Protect. Detect. Heal.
A Production-Inspired Self-Healing Cryptographic Key Management & Real-Time Threat Response Platform.
KMSVault is a next-generation Key Management Service (KMS) and Automated Threat Remediation platform. It combines envelope encryption, deterministic threat scoring, automated incident self-healing, tamper-evident hash-chained auditing, and a Nordic Scandinavian cyber defense dashboard with real-time 3D telemetry.
- 🔒 Envelope Encryption Pattern: Data Encryption Keys (DEKs) are generated with cryptographically secure random bytes and wrapped with Master Key Encryption Keys (KEKs) via AES-256-GCM. Plaintext DEKs never touch persistent storage.
- 🔄 Strict Key Lifecycle State Machine: Strictly validated transitions:
GENERATED→ACTIVE→ROTATING→DEPRECATED→REVOKED→DESTROYED. - ⚡ Deterministic Explainable Risk Scoring: Evaluates burst velocity, repeated authentication failures, unauthorized access attempts, and temporal anomalies with point contributions (0–100 risk score).
- 🛡️ Autonomous Self-Healing Orchestration: When critical threats or compromised keys are detected, KMSVault automatically executes blast-radius impact analysis, revokes the compromised key, provisions fresh key material, and remaps authorized microservices with zero downtime.
- 📜 Tamper-Evident SHA-256 Audit Ledger: Immutable audit log with cryptographic hash chaining and real-time chain verification.
- 🌐 Nordic Cybersecurity Command Center: Cyberpunk aesthetic featuring Three.js 3D interactive graphics, real-time WebSocket telemetry, and simulation war rooms.
┌────────────────────────┐
│ Client / UI │
│ (React 18 + Three.js) │
└───────────▲────────────┘
│ WebSocket / REST
┌───────────▼────────────┐
│ Express API Server │
└───────────┬────────────┘
┌──────────────────────────┼──────────────────────────┐
│ │ │
┌──────────▼──────────┐ ┌──────────▼──────────┐ ┌──────────▼──────────┐
│ Envelope Crypto │ │ Threat & Risk Engine│ │ Self-Healing Orch │
│ (AES-256-GCM/KEK) │ │ (Rules & Scoring) │ │ (Revoke & Remap) │
└──────────┬──────────┘ └──────────┬──────────┘ └──────────┬──────────┘
│ │ │
└──────────────────────────┼──────────────────────────┘
│
┌───────────▼────────────┐
│ Tamper-Evident Audit │
│ (SHA-256 Hash Chain) │
└────────────────────────┘
- Node.js 18+ (tested on Node 18, 20, 22+)
- npm 9+
# Backend dependencies
cd backend && npm install
# Frontend dependencies
cd ../frontend && npm installcd backend && npm testRun backend and frontend concurrently:
# Terminal 1 — Backend (starts Express API & Socket.IO on http://localhost:5000)
cd backend && npm run dev
# Terminal 2 — Frontend (starts Vite Dev Server on http://localhost:5173)
cd frontend && npm run devOpen http://localhost:5173 in your browser.
| Role | Password | Access Level | |
|---|---|---|---|
| Admin | admin@kmsvault.dev |
Admin@KMSVault2024! |
Full administrative access, key provisioning, rotation, destruction |
| Security Analyst | analyst@kmsvault.dev |
Analyst@KMSVault2024! |
Threat monitoring, simulation triggers, alert triage |
| Auditor | auditor@kmsvault.dev |
Auditor@KMSVault2024! |
Read-only audit logs, tamper verification |
| Developer | developer@kmsvault.dev |
Dev@KMSVault2024! |
Crypto workbench, key usage, application credentials |
- KPI Metrics Overview: Live counts of Total Keys, Active Keys, Rotated Generations, and Isolated Keys.
- Search & Filter: Search by Key ID, tag, or purpose; filter by status or algorithm (
AES-256-GCM,RSA-3072,HMAC-SHA256). - View Toggle: Switch between Glass Cards and a high-density Table View.
- Envelope Diff & Inspection: Inspect ciphertext storage structures, IVs, Auth Tags, and lineage ancestry.
- Cryptographic Rotation: Side-by-side key comparison and automated microservice key swapping with zero downtime.
- 6-Stage Autonomous Demo Simulation: Live, deterministic multi-stage attack flow that triggers real-time threat response:
- System Secure (Normal traffic baseline)
- Traffic Frequency Anomaly (Velocity burst)
- Unauthorized Access Attempt (Authentication failure)
- Critical Threat Detected (Risk score > 80 policy match)
- Autonomous Self-Healing (Automated revocation & replacement)
- System Recovery (Re-keying verified, posture restored)
- Live Autonomous Topology Visualizer: Real-time 4-node attack path monitoring.
- Rule-based detection evaluating velocity anomalies, brute-force failures, and off-hour access.
- Triage alerts and review the exact score breakdown.
- Manage microservice permissions and perform blast-radius analysis before rotating or revoking keys.
- Real-time cryptographic ledger chaining every event with SHA-256 hashes.
- Single-click "Verify Audit Chain" to detect any historical tampering.
- Interactive interface for encryption, decryption, digital signing, and signature verification.
| Endpoint | Method | Role | Description |
|---|---|---|---|
/api/auth/login |
POST |
Public | Authenticate user & receive JWT |
/api/keys |
GET |
Authenticated | List all managed cryptographic keys |
/api/keys |
POST |
admin |
Provision a new key |
/api/keys/:id/rotate |
POST |
admin |
Rotate key to next version |
/api/keys/:id/revoke |
POST |
admin |
Revoke a key |
/api/keys/:id/use |
POST |
Authenticated | Record key usage and evaluate risk |
/api/simulation/demo |
POST |
Analyst / Admin | Execute 6-stage demo attack simulation |
/api/simulation/key-compromise |
POST |
Analyst / Admin | Execute targeted compromise scenario |
/api/audit/verify |
POST |
Auditor / Admin | Verify SHA-256 audit chain integrity |
/api/metrics/dashboard |
GET |
Authenticated | Get real-time system metrics & posture |
- Zero Plaintext Storage: Plaintext DEKs are wiped from memory buffers immediately after cryptographic operations.
- Client Role Trust Prevention: Roles are verified server-side via database lookups upon token validation.
- Rate Limiting & Security Headers: Helmet middleware, CORS domain restriction, and granular endpoint rate limiting.
- Zero-Dependency Local Dev: Automatic in-memory MongoDB fallback with pre-seeded test data for zero-config onboarding.
MIT License. Built for cybersecurity resilience and advanced key management.