A dual-layer end-to-end encryption system was implemented to ensure secure communication and protect sensitive data at every stage. The approach consisted of the following: 

1. Asymmetric Encryption for Transmission:

• Messages from the client (e.g., doctor or patient) were encrypted using RSA public keys. 
• This ensured that the data was secured while in transit and could not be intercepted or read by unauthorized parties.
• On reaching the server, the messages were decrypted using the server’s private key, ensuring that only the intended recipient (the server) could access the content.

2. Symmetric Encryption for Storage and Processing: 

• After decryption on the server, the messages were immediately re-encrypted using a symmetric AES-256 key. 
• This key was dynamically generated for each session by a secure Key Management Service (KMS) like AWS KMS, enhancing data protection by preventing reuse of keys across sessions. 
• Symmetric encryption provided faster and more efficient processing compared to asymmetric encryption, making it ideal for handling large volumes of data. 
• The re-encrypted messages were securely stored in the database, ensuring their confidentiality even if the storage system was compromised. 

3. Decryption for Processing: 

• When the OpenAI chat completion API was invoked to generate a response, the system used the symmetric key to decrypt the stored messages. 
• The decrypted content was processed by the API, ensuring that sensitive information was only temporarily in plaintext during processing. 
• After the API generated a response, the system re-encrypted the response using the same symmetric key. 
• The re-encrypted response was then sent back to the client, ensuring data security during the return transmission. 

This dual-layer encryption system ensured comprehensive protection for sensitive data throughout its lifecycle, addressing potential vulnerabilities in transmission, storage, and processing.