Dual-Layer Vault
What should a system reveal when refusing access is unsafe?
Dual-Layer Vault is a research-driven software project exploring a limitation of conventional access control: what happens when a legitimate user is pressured to unlock a system and simply refusing is not a safe option? Instead of relying on encryption alone, the project investigates a controlled-disclosure architecture designed to reveal different, internally consistent layers of information under different access conditions.
The challenge
Traditional authentication and access control are primarily designed to prevent unauthorised access. They generally assume that the legitimate user remains free to refuse when access is demanded. In a coercion-prone situation, that assumption can break down: refusal itself may increase risk. The challenge therefore becomes not only how to protect sensitive information, but how a system might provide a plausible and usable response to forced access without revealing the information the user is trying to protect.
The approach
The project addresses this problem through a dual-layer controlled-disclosure architecture. Standard access presents a functional and internally consistent layer of information, while protected access reveals the protected layer. The standard state is designed to behave as a legitimate system experience rather than an obvious denial or empty decoy. The concept was implemented as a working prototype and evaluated within a defined threat model, combining privacy-oriented architecture, full-stack engineering and user research rather than treating the idea as a purely theoretical security proposal.
Key capabilities
- Privacy-oriented system design
- Controlled disclosure architecture
- Dual-layer access design
- Threat modelling
- Research-driven engineering
- User evaluation & analysis
Technology & engineering
Threat model
The project focuses on interpersonal coercion and observed interaction: a scenario in which an adversary can pressure the legitimate user to access the system and may know that a controlled-disclosure mechanism exists. The model does not assume compromise of the backend, source code, network infrastructure, administrative access or forensic extraction. This boundary is intentional - the architecture is evaluated against a defined coercion scenario rather than presented as a universal defence against every form of system compromise.
Implementation
The controlled-disclosure architecture was implemented as an end-to-end web application with separate standard and protected access states. Access mode is determined server-side and the application maintains separation between the information available through each state. This allowed the proposed architecture to be evaluated as a working interactive system rather than only as a conceptual security model.
Evaluation
The prototype was evaluated through user studies examining usability, interface clarity and interaction with the dual-layer access model. Post-development evaluation included 33 participants and showed strong overall usability, while mode switching emerged as the comparatively weakest aspect of the interaction and an important area for future refinement. The evaluation complements the architectural work by examining whether the controlled-disclosure concept remains understandable and usable in practice.
Outcome
Dual-Layer Vault progressed from a security and privacy research question into a defined architecture, working prototype, user evaluation and peer-reviewed research contribution. The resulting paper was accepted for publication and presentation at SEEDA-CECNSM 2026, demonstrating how research, threat modelling, software architecture and implementation can be combined within one engineering process.
Accepted for publication and presentation - SEEDA-CECNSM 2026 - IEEE conference proceedings.