Secure AI Chatbot for Mental Health Support

With mental health issues on the rise, specifically in Malang, Indonesia, there is a growing need for accessible, secure, and private mental health support without shaming the users. Through this problem, Komfy was created to provide a safe space for users, integrated with a direct contact information for the mental health unit from the Faculty of Computer Science called "ULTKSP".

Project Overview

Komfy was created to ensure a safe space where users can discuss their mental health concerns without fear of judgment or exposure. The application features an AI-powered chatbot that provides empathetic responses and guidance, while also offering a journaling feature for users to express their thoughts and feelings privately. Without overclaims of a superpowerful AI, the app wishes to provide comfort and support with precautions built-in. Every chat is analyzed by the chatbot based on a certain threshold and directs the user to mental health professionals if necessary. The app is designed with end-to-end encryption to ensure that all user data remains confidential and secure.

Technical Implementation

Each users can have a chatroom with the chatbot called "Kommate" and a private journal called "Komfess". The mobile app is implemented using Flutter for the frontend, Firebase for the backend, and Vertex / Gemini API for AI integration. The app uses RSA and AES encryption to ensure that all user data is secure and private. The app also features gamification elements to encourage users to engage with the app and track their progress over time. The next section will explain the encryption implementation in detail.

Komfy Registration and Key Setup Flow

The encryption works by generating a unique RSA key pair for each user upon registration, a random salt and initialization vector (IV) is also generated to ensure uniqueness even if multiple users use the same password. The public key is saved in plaintext in Firebase for the server/chatbot to use and encrypt messages, while the private key is stored both on the user's device and an encrypted version in Firebase. The RSA Private key is ONLY locally decrypted and used on the user's phone to decrypt messages received from the server/chatbot. To support multiple logins/devices while maintaining security, AES encryption is used for encrypting the user's RSA private key when storing their private key in Firebase. The user will locally encrypt and decrypt the Private RSA key using their password combined with salt and IV that is stored in Firebase. The app will use the locally secured and saved decrypted RSA Private key to decrypt their stored messages. This ensures that even if the server is compromised, all of the user's messages and their private key remains secure.