Security for data at rest in a remote network management platform

A computer-implemented method, wherein persistent storage includes one or more disks providing a parent filesystem with a pre-configured amount of free space, and wherein the method comprises:

• creating, within the pre-configured amount of free space N sparse files, each with an apparent size equivalent to the pre-configured amount of free space and an actual size based on space used by sparse file, wherein a sum of the apparent sizes of the N sparse files is greater than the pre-configured amount of free space, where N is at least 2;
• creating N virtual devices, one for each of the N sparse files;
• establishing N sets of cryptographic keys, one set for each of the N virtual devices;
• creating N encrypted virtual filesystems, one for each of the N virtual devices and one within each of the N sparse files;
• and
• mounting the N encrypted virtual filesystems within the parent filesystem as one of N child filesystems, wherein each of the N child filesystems uses one of the N sets of cryptographic keys for application-transparent encrypted data storage.

An article of manufacture including persistent storage and a non-transitory computer-readable medium, wherein the persistent storage includes one or more disks providing a parent filesystem with a pre-configured amount of free space, and wherein the non-transitory computer-readable medium has stored thereon program instructions that, upon execution by a computing system, cause the computing system to perform operations comprising:

• creating, within the pre-configured amount of free space N sparse files, each with an apparent size equivalent to the pre-configured amount of free space and an actual size based on space used, wherein a sum of the apparent sizes of the N sparse files is greater than the pre-configured amount of free space, where N is at least 2;
• creating N virtual devices, one for each of the N sparse files;
• establishing N sets of cryptographic keys, one set for each of the N virtual devices;
• creating N encrypted virtual filesystems, one for each of the N virtual devices and one within each of the N sparse files;
• and
• mounting the N encrypted virtual filesystems within the parent filesystem as one of N child filesystems, wherein each of the N child filesystems uses one of the N sets of cryptographic keys for application-transparent encrypted data storage.