SecureEdgeLLM Gateway

Security and audit proxy for corporate LLM access via augmented reality (AR) devices. Developed to ensure industrial data protection (DLP) and dynamically enforce Role-Based Access Control (RBAC).

---

Prerequisites

To run this project locally, you will need:

• Docker and Docker Compose installed.
• Git to clone the repository.
• A free account on Groq Cloud (to generate the API Key).
• Android Studio (only if running the mobile app locally).

---

Quick Setup (3 Steps)

1. Clone the repository

git clone <https://github.com/RobotEby/SecureEdgeLLM.git> SecureEdgeLLM
cd SecureEdgeLLM

2. Configure Environment Variables

Copy the example file to create your local .env:

cp .env.example .env

Open the .env file and insert your Groq API key (we keep the variable named after OpenAI for library compatibility):

.env configuration example

KEYCLOAK_URL=http://localhost:8080
KEYCLOAK_REALM=secureedge
KEYCLOAK_CLIENT_ID=secureedge-proxy

LLM_PROVIDER=groq
OPENAI_API_KEY=gsk_your_groq_key_here

DATABASE_PATH=./audit.db

3. Start the Infrastructure (Keycloak + Proxy)

Docker will handle downloading the dependencies, installing the NLP language models (Spacy/Presidio), and bringing up the services.

docker compose up -d --build --force-recreate

Wait about 30 to 60 seconds for Keycloak to finish its internal initialization and for the status to change to Healthy.

---

Validation and Integrated Tests

To ensure that communication between Keycloak, Proxy, DLP Filter, and the LLM is working, use the commands below.

Check Proxy Health:

curl http://127.0.0.1:8080/health

Expected response: {"status":"ok"}

Fire Test (Full Flow: JWT + LLM + DLP):

This script simulates the app's request. It requests a token from Keycloak (as user João) and asks the AI a technical question. The proxy will validate the token, inject the access level into the prompt, send it to Groq (Llama 3.1), and redact sensitive data using Microsoft Presidio.

Copy and paste into the terminal:

docker compose exec proxy bash -lc '
set -euo pipefail

TOKEN=$(curl -s -X POST "http://keycloak:8000/realms/secureedge/protocol/openid-connect/token" \
  -d "grant_type=password&client_id=secureedge-proxy&client_secret=secureedge-secret-demo&username=joao.silva&password=senha123" \
  | python3 -c '"'"'import sys, json; print(json.load(sys.stdin).get("access_token", ""))'"'"')

curl -s -X POST "http://127.0.0.1:8000/api/v1/query" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"text\":\"What is the procedure for replacing the seal on pump P-201?\"}" \
  | python3 -m json.tool
'

The response should come in JSON format containing the technical instruction and the "filtered_count" metric, proving that the DLP acted on the response.

---

Mock Test Users

Use these credentials to test different scope injection levels (RBAC) in the AI:

User	Password	Functional Profile	Unit
joao.silva	senha123	technician_level_1	North Plant — Rio de Janeiro
maria.santos	senha123	technician_level_2	South Plant — Santos
carlos.lima	senha123	supervisor	Operations Board

---

Architecture and Data Flow

Security does not occur on the end device (AR Glasses), but at the edge. The flow happens in 5 steps invisible to the user:

1. Authentication:  The AR Device sends a JWT.
2. Interception:    The SecureEdge Proxy validates the JWT against Keycloak.
3. Scope Injection: The Proxy builds a System Prompt based on the user's permissions.
4. LLM Inference:   The query is sent to the Groq model (Meta Llama 3.1).
5. DLP & Audit:     The response passes through Microsoft Presidio to remove PII/Critical Data,
                    the request is saved to SQLite (Audit Log), and the clean text is returned to the AR device.

---

Project Structure

SecureEdgeLLM/
├── proxy/              # FastAPI Backend (Auth Middleware, LLM Client, DLP Filter)
│   └── app/
│       ├── main.py
│       ├── middleware/     # JWT Validation
│       ├── services/       # HTTP Client (Groq) and Scope Injection
│       └── ...
├── auth/               # Keycloak Realm Export (realm-export.json)
├── mobile/             # Android Application Source Code
├── docs/               # Supplementary documentation and pitch scripts
├── docker-compose.yml  # Container orchestration
└── Dockerfile          # Proxy build instructions