Edit: I mostly used my university's guidelines on how to meet DPA standards and their own. I extrapolated a bit because encryption on a VM hosted by my uni that is already probably encrypted makes little sense wrt. adversaries.
The data we manipulate is very sensitive and the website will stay around for a while and be reused across projects, so I believe I must include attacks to the Web server and encrypt PII against it.
I realise this has nothing to do with the DPA but just my interpretation of "keep personal data secure, in proportion to their sensitivity".
I need to set up a Web server on which research participants upload tarballs (the size and contents of which depend on projects) containing Personally Identifiable Information and sensitive data. I must comply with the DPA and other guidelines which recommend encryption but do not clarify encryption against which threats. I hence assume that I must protect my participant' data against a breach into the server.
This is what I roughly planned on doing:
- The data is encrypted by my Web server upon arrival using a newly-made symmetric key.
- The symmetric key is encrypted by the server using the public key of the researcher who will process the data, and that symmetric key is stored with the data.
- We researchers connect to the server, set up a decrypted image of the encrypted files.
- We work on that image, potentially adding or modifying files (i.e., creating summaries of data, transcripts, metrics, and so on, which can also contain some PII until we sat down and anonymized them properly).
- Whenever we leave the server, no data must be left unencrypted.
I originally asked if I can automatically create encrypted volumes and then reopen them from elsewhere, which has been pointed out to be a singularly bad idea by smrt28. What I planned to do:
- The server creates an encrypted volume per user, puts the raw data from the user in the root folder of that volume, and shuts the volume properly when done.
- I SSHFS to the folder containing all those volume files.
- I use a local script to open unencrypted mount points for all those volumes.
- I happily modify the users' data and create new files.
- I shut down the mount points and all is fine, the new data has been added to the servers already encrypted.
The original question: how can I make dm-crypt use asymmetric keys so that the server can only create a new encrypted volume and I can encrypt/decrypt? Is that even possible with volumes? If lvm can't do that, any alternatives?
The solution I'll adopt
I will just get this Web server to write the data to a write-only mount of another server's partition. The other server will be hosted by my university and accessible only from our authenticated university VPN. That partition will be encrypted and backed up by the university as they see fit.
We researchers will just connect to the VPN, mount the partition and do our things, which is essentially the same as in the original setup.