Support for changing encryption classes of files

A non-transitory computer readable storage medium configured to store instructions that, when executed by a processor included in a computing device, cause the computing device to manage encryption of a file, by carrying out steps that include:

• receiving a user key in conjunction with a successful login that occurs on the computing device;
• forming a combined key based on (i) the user key, and (ii) a device key that is unique to the computing device;
• accessing an encryption key bag using the combined key, wherein the encryption key bag stores a plurality of encryption keys, and the plurality of encryption keys includes a first class key associated with a first encryption class;
• and
• in response to identifying a satisfaction of at least one condition associated with modifying at least one file from the first encryption class to a second encryption class:
• obtaining a second class key associated with the second encryption class,
• identifying a plurality of file extents of the at least one file, wherein each file extent is encrypted by a respective extent key, and each respective extent key is encrypted by the first class key, and
• for each file extent of the at least one file:
• decrypting the respective extent key using the first class key to produce a decrypted respective extent key, and
• encrypting the decrypted respective extent key using the second class key to produce an updated respective extent key.

A computing device configured to manage encryption of a file, the computing device comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, cause the processor to carry out steps that include:
• receiving a user key in conjunction with a successful login that occurs on the computing device;
• forming a combined key based on (i) the user key, and (ii) a device key that is unique to the computing device;
• accessing an encryption key bag using the combined key, wherein the encryption key bag stores a plurality of encryption keys, and the plurality of encryption keys includes a first class key associated with a first encryption class;
• and
• in response to identifying a satisfaction of at least one condition associated with modifying at least one file from the first encryption class to a second encryption class:
• obtaining a second class key associated with the second encryption class,
• identifying a plurality of file extents of the at least one file, wherein each file extent is encrypted by a respective extent key, and each respective extent key is encrypted by the first class key, and
• for each file extent of the at least one file:
• decrypting the respective extent key using the first class key to produce a decrypted respective extent key, and
• encrypting the decrypted respective extent key using the second class key to produce an updated respective extent key.