How Medshare Puts a Cryptographic Kill Switch in Patient Hands

In the healthcare industry, patient data is under constant siege. Medical data breaches have reached historic highs, largely driven by bad actors targeting centralized servers to hold highly sensitive records and diagnostic imaging for ransom.

The industry’s legacy response has always been to build taller walls around the central vault. But at the recent Atsign AI Architect Hackathon, Eric Ko took first place by proving a radical alternative: What if the vault didn’t exist, and the patient held the only key?

Medshare isn’t just another medical storage app. It achieves true patient data sovereignty by coupling a clean, cross-platform Flutter UI with a headless Dart backend. This architecture gives patients a real-time cryptographic kill switch to instantly control access to their medical records.

You can explore the source code, check out the architectural separation of planes, and review the cascade-delete implementation directly in Eric Ko’s Medshare GitHub repository.

Separating the data and control planes

To build a zero-trust medical sharing platform in a 24-hour sprint, Eric leaned heavily on a core architectural principle of the Atsign platform: deliberately separating the data plane from the control plane.

In traditional cloud systems, the platform hosting your files controls both the storage and the access permissions. If an attacker compromises the platform’s backend application logic, they can bypass permission checks and access the plaintext files.

Medshare avoids this vulnerability entirely by splitting the architecture:

• The data plane: The storage node or imaging clinic acts as a secure vault that holds nothing but encrypted bytes. By design, it remains separate from the content, meaning it cannot see or inspect the files it hosts.
• The control plane: The patient acts as the exclusive custodian of the cryptographic keys. An app permission isn’t a flag flipped in a database; it is a live cryptographic key handed directly from the patient’s identity to a doctor’s identity.

Without explicit authorization from the patient’s control plane, a specialist attempting to fetch the file from the data plane is blocked entirely at the network layer.

Inside the Atsign primitives

Translating this architectural split into working code required mapping the user experience directly to Atsign’s decentralized primitives. Utilizing Atsign’s native, platform-provided encryption, the entire sharing loop was built and verified in clean, headless Dart before a single UI element was even wired up.

1. Secure delivery

When a clinic processes a patient’s medical scan, they don’t upload it to a multi-tenant database. Instead, they lock the file using encryption and route it straight to the patient’s unique atSign using a shared key pattern (scanref.medshare).

2. Time-limited windows via TTL

Patients often need to share scans with specialists for a brief window—such as a single consultation or a second-opinion review. In Medshare, when a patient grants a doctor access, the application utilizes Atsign’s native TTL (Time-To-Live) primitive.

The patient’s app constructs a SharedKey(“scan”, specialist, patient) and assigns it a strict expiration timestamp, like one day or one week. The moment that timer ticks down to zero, the key self-destructs at the platform layer.

3. Instant revocation via cascade delete

A time limit is great, but true data sovereignty requires an instantaneous, manual override. If a patient wants to cut off access before a TTL expires, they hit Revoke on their screen.

This triggers a cascade-delete (ccd) primitive. In peer-to-peer networks, data caching can leave lingering vulnerabilities on secondary nodes. Medshare’s use of cascade-delete ensures that deleting the parent shared key on the patient’s side actively forces a synchronized wipe of the cached copy on the recipient’s specialist node.

Because the specialist’s application is engineered to bypass local plaintext caching and re-verify the cryptographic key upon every single view request, the moment a key is revoked, the doctor’s view fails its read validation and goes completely dark in real time.

The realities of a zero-trust architecture

Part of what made Medshare the winning hackathon project was Eric’s transparent approach to security boundaries. In his design documentation, he explicitly outlined the physical realities of data security:

• Revocation vs. exfiltration: A cryptographic kill switch can perfectly control access to a secure viewing pipeline, but it cannot retroactively claw back an image if a recipient takes a manual screenshot or saves the raw decrypted file locally outside of the app environment.
• Metadata leakage: While the contents of the medical scans are entirely opaque to everyone except the patient and the authorized doctor, the fact that an exchange took place between those two specific atSigns is visible at the network routing layer.

By defining these boundaries upfront on the canvas, Eric built a resilient system architecture that serves as an excellent foundation for HIPAA-compliant workflows without requiring an expensive, high-maintenance cloud backend.

Next up in the series

Medshare proved that patient-controlled sharing can protect human health data. To see how that exact same identity protocol scales up to massive enterprise routing environments, read about IoT Lighthouse—a project by Aidan Daniel that builds identity-based protection for legacy Diameter and SS7 telecom nodes.