AISpace Implements Ephemeral Encrypted File Transfer for AI Agents

Autonomous AI agents running in separate microservices, containers, or sandboxed environments create data boundary issues. One agent processes raw CSV files or scrapes web pages; downstream agents need exact artifacts to compute embedding vectors or generate reports. While techniques like homomorphic encryption and private AI inference protect compute workloads, transferring raw intermediate artifacts remains a security bottleneck.

Passing large files inside JSON API payloads inflates memory overhead, breaks LLM token budgets, and exposes unencrypted intermediate data to central logs. Dumping intermediate files into standard cloud storage buckets creates audit problems. Storage buckets accumulate stale artifacts, demand IAM key management across short-lived agent workers, and leave unencrypted data at rest.

AISpace uses an ephemeral, zero-knowledge file transfer system for autonomous agent networks and human operators. Design guarantees payload contents never touch disk unencrypted, intermediate servers cannot read transfers, and files auto-destruct in memory when target agent completes download.

The Problem with Shared Storage in Agent Swarms

Standard object storage like AWS S3 or Google Cloud Storage performs poorly for short-lived data handoffs between isolated execution environments.

Consider workflow where analyst agent starts transient Docker container to execute untrusted Python code. Container outputs dataset_snapshot.parquet containing sensitive customer identifiers. Agent passes file to validation agent inside separate network segment.

Storing file in S3 creates three issues:

1. Stale Data Retention: Agent process crash before cleanup leaves temporary files until lifecycle policies clean them.
2. Coarse Access Control: Distributing AWS credentials or generating signed S3 URLs across dynamic agent processes expands attack surface—a management hurdle similar to using temporary Cloudflare accounts for AI agents.
3. Internal Data Visibility: Platform engineers, DB admins, and observability tools inspect intermediate agent payloads stored in plain text.

AISpace replaces persistent buckets with ephemeral peer-to-peer relay protocol using client-side encryption, authenticated key negotiation, and automatic RAM purging.

Cryptographic Architecture

AISpace separates payload transmission from payload storage. Central relay server acts as blind broker routing encrypted byte streams without access to plaintext or cryptographic keys.

+=========+         1. Ephemeral Key Gen        +=========+
| Sender Agent (A) |  ................> | Receiver Agent(B)|
+=========+                                     +=========+
         |                                                        |
         | 2. Encrypt with K_session                              |
         v                                                        |
+=========================+              |
|        Blind Relay Server (Memory-Only)          |              |
| Payload stored with short TTL (e.g., 300s)       |              |
+=========================+              |
         |                                                        |
         | 3. Stream encrypted bytes                              |
         +............................+
                                                                  |
                                             4. Decrypt in memory & purge

1. Key Negotiation and Identity Binding

Before transfer, sending agent (Agent A) and receiving agent (Agent B) perform authenticated handshake using persistent Ed25519 identity keypairs registered with control plane.

When Agent A transfers file to Agent B:

1. Agent A requests Agent B public identity key from directory service.
2. Agent A generates temporary X25519 keypair for transfer session.
3. Agent A derives shared secret using ECDH over Curve25519 with Agent B static public key and Agent A ephemeral private key.
4. Agent A passes secret through HKDF-SHA256 with context string (aispace-ephemeral-v1) to produce 256-bit symmetric key K_session.

2. Chunk-Based Symmetric Encryption

To support memory-constrained containers, protocol encrypts files using chunked AES-256-GCM.

Each 1MB chunk receives incremental 64-bit counter value combined with random 96-bit base nonce. This guarantees nonce uniqueness across chunks without risking key reuse in GCM mode.

import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes
 
def derive_session_key(shared_secret: bytes, salt: bytes) -> bytes:
    hkdf = HKDF(
        algorithm=hashes.SHA256(),
        length=32,
        salt=salt,
        info=b"aispace-ephemeral-v1",
    )
    return hkdf.derive(shared_secret)
 
def encrypt_chunk(key: bytes, nonce_base: bytes, counter: int, plaintext: bytes) -> bytes:
    # Build 12-byte nonce by appending counter to base nonce
    nonce = nonce_base[:4] + counter.to_bytes(8, byteorder="big")
    aesgcm = AESGCM(key)
    # Encrypt and append tag directly
    return aesgcm.encrypt(nonce, plaintext, None)

Sender computes SHA-256 hash tree over encrypted chunk tags, allowing receiver to verify stream integrity while reading chunks from network.

Implementation: Python Agent Transport SDK

Python agents interact with encryption protocol using async client wrapper. Sender agent encrypts and streams file to blind relay:

import asyncio
import httpx
from cryptography.hazmat.primitives.asymmetric import x25519
 
class EphemeralSender:
    def __init__(self, relay_url: str):
        self.relay_url = relay_url
        self.ephemeral_private_key = x25519.X25519PrivateKey.generate()
        self.ephemeral_public_key = self.ephemeral_private_key.public_key()
 
    async def send_file(self, recipient_pub_key_bytes: bytes, file_path: str, ttl_seconds: int = 300):
        # 1. Reconstruct recipient public key
        recipient_pub_key = x25519.X25519PublicKey.from_public_bytes(recipient_pub_key_bytes)
        
        # 2. Perform ECDH key exchange
        raw_shared_secret = self.ephemeral_private_key.exchange(recipient_pub_key)
        
        # 3. Derive symmetric key
        salt = os.urandom(16)
        session_key = derive_session_key(raw_shared_secret, salt)
        
        # 4. Stream payload to relay
        nonce_base = os.urandom(12)
        
        headers = {
            "X-AISpace-Sender-Key": self.ephemeral_public_key.public_bytes_raw().hex(),
            "X-AISpace-Salt": salt.hex(),
            "X-AISpace-Nonce-Base": nonce_base.hex(),
            "X-AISpace-TTL": str(ttl_seconds),
        }
        
        async def file_stream():
            counter = 0
            with open(file_path, "rb") as f:
                while chunk := f.read(1024 * 1024):
                    encrypted_block = encrypt_chunk(session_key, nonce_base, counter, chunk)
                    yield encrypted_block
                    counter += 1
 
        async with httpx.AsyncClient() as client:
            res = await client.post(
                f"{self.relay_url}/v1/transfer",
                headers=headers,
                content=file_stream(),
                timeout=60.0
            )
            res.raise_for_status()
            return res.json()["file_id"]

Receiver agent uses identity key paired with sender public key from headers to re-derive session_key and decrypt incoming blocks:

class EphemeralReceiver:
    def __init__(self, receiver_private_key: x25519.X25519PrivateKey):
        self.private_key = receiver_private_key
 
    async def download_file(self, relay_url: str, file_id: str, output_path: str):
        async with httpx.AsyncClient() as client:
            async with client.stream("GET", f"{relay_url}/v1/transfer/{file_id}") as response:
                response.raise_for_status()
                
                # Parse headers
                sender_pub_bytes = bytes.fromhex(response.headers["X-AISpace-Sender-Key"])
                salt = bytes.fromhex(response.headers["X-AISpace-Salt"])
                nonce_base = bytes.fromhex(response.headers["X-AISpace-Nonce-Base"])
                
                sender_pub_key = x25519.X25519PublicKey.from_public_bytes(sender_pub_bytes)
                raw_shared_secret = self.private_key.exchange(sender_pub_key)
                session_key = derive_session_key(raw_shared_secret, salt)
                
                counter = 0
                with open(output_path, "wb") as f:
                    async for chunk in response.aiter_bytes():
                        # Decrypt incoming 1MB chunk (+ 16 bytes auth tag)
                        decrypted_block = decrypt_chunk(session_key, nonce_base, counter, chunk)
                        f.write(decrypted_block)
                        counter += 1

Blind Relay Server Mechanics

Relay server runs as minimal Rust service storing payloads in RAM via lock-free slab allocator. Disk persistence is disabled.

Storage engine uses two deletion triggers:

• Read-Once Destruction: When reader fetches final chunk of encrypted stream, server drops memory allocation block and zero-fills underlying bytes.
• Hard TTL Expiry: If target agent crashes or drops off network, internal timer evicts unread payload from memory when TTL expires (default: 300 seconds).

Relay server only receives raw ciphertext blocks, salt values, and ephemeral public keys. Root compromise of relay infrastructure yields no unencrypted file contents without Agent B persistent private key and decrypted RAM buffers.

+====================================+
|                         Relay Memory Slab                             |
|                                                                       |
|  [ File ID: 0x9f8a ]                                                  |
|  ├─ Sender PubKey:  0x03a1...                                         |
|  ├─ Ciphertext:     0x8e11f... (Encrypted with K_session)             |
|  ├─ Created At:     1710000000                                        |
|  └─ TTL:            300s (Hard Limit)                                 |
|                                                                       |
|  TRIGGER 1: Reader reaches EOF  ==> Zero-fill RAM & drop index        |
|  TRIGGER 2: Clock > Created + TTL ==> Zero-fill RAM & drop index      |
+====================================+

Real-World Edge Cases and Failures

Memory Exhaustion on Parallel Streams

Decrypting hundreds of incoming file streams directly in RAM pushes container memory past limits (OOMKilled).

AISpace SDK uses fixed 4MB ring buffer per active file stream. Receiver pulls 1MB encrypted blocks from network socket, writes decrypted bytes to temporary file on encrypted tmpfs RAM disk, and exposes file descriptor directly to downstream processing functions.

Agent Crash and Race Conditions

If agent crashes mid-download, relay marks payload partially consumed. Instant restart requesting same file_id returns 404 Not Found if relay purged payload on first attempt.

AISpace implements two-phase commit header for file consumption:

1. Downloading agent sends X-AISpace-Consume-Mode: Peek header during initial download chunks.
2. Relay preserves buffer in RAM until receiver completes stream processing.
3. Receiver sends explicit ACK HTTP POST to /v1/transfer/{file_id}/ack.
4. Relay runs explicit_bzero on buffer memory.

If no ACK arrives before TTL expires, background timer purges memory block.

Replay Attack Prevention

An eavesdropper recording network streams could resend them to force recipient agents to re-execute tool calls. Beyond standard transport encryption and hardening AI agent gateways against prompt injection, protecting payload transfers requires transaction nonces and identity signatures.

AISpace embeds incremental timestamp and single-use transaction nonce into metadata header signed by sender Ed25519 identity key:

auth_payload = f"{file_id}:{recipient_agent_id}:{timestamp}:{nonce}".encode("utf-8")
signature = sender_identity_private_key.sign(auth_payload)

Relay server maintains Bloom filter of recently seen nonces, rejecting duplicate transfers matching active nonces within timestamp window.

Integrating Ephemeral Transfers into Agent Runtimes

Agents exchange ephemeral reference identifiers instead of writing custom cleanup hooks or managing temporary S3 buckets:

{
  "tool_call": "process_financial_report",
  "arguments": {
    "file_ref": "aispace://relay.internal/v1/transfer/8f3a-921c",
    "sha256_checksum": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  }
}

Worker agent resolves reference URI, executes cryptographic handshake, streams payload directly into memory, and lets relay clear remote bytes automatically.

Sensitive files exist only during active processing, encrypted end-to-end, and delete upon task completion.

[3 links added to text] → skipped: [remaining slugs], add when [relevant topics explicitly discussed].