Method and system for policy based real time data file access control

A computer system in a networked environment to identify a data file and allow access to the content of the data file wherein such access is allowed only after it is permitted by access policies, the system comprising a plurality of endpoint computing devices and a plurality of key store servers:

• wherein the plurality of endpoint computing devices comprises a computer network connection to at least one key store server and:
• generates at least one symmetric encryption key for each of a plurality of data files to be encrypted, and
• encrypts each of the plurality of data files using an unused encryption key to create an encrypted data file with a new unique file identifier (UFI) attached such that the UFI is retrievable from the encrypted data file without the encryption key, each UFI being a different string or number that is confirmed to be unique among key store servers, and
• sends each UFI, paired with the encryption key of the encrypted file the UFI is attached to, to the connected key store servers;
• and
• extracts the UFI from an encrypted file without the encryption key of the encrypted file when a user attempts to access that encrypted file from a plurality of encrypted files, and
• sends an access request with the retrieved UFI to the connected key store servers for the user, and
• receives a response to the request from the connected key store servers, and
• retrieves, from the response, the encryption key, if present, and the permissions for the UFI, and
• if the permissions allow access, decrypts the encrypted file and controls the user's access to the decrypted content and the encrypted file itself by matching the permissions, or
• if the permissions deny access, denies the user access by not decrypting the encrypted file;
• and
• wherein the plurality of key store servers stores access policies that output access permissions after evaluation;
• and
• receives a plurality of pairs of a UFI and an encryption key, and stores the plurality of pairs with each UFI coupled with the paired encryption key so that said encryption key can be retrieved using the UFI;
• and
• associates a set of access policies to each of the stored UFIs;
• and
• receives a file access request that contains UFIs from an endpoint computing device for a user, and
• calculates access permissions for each of the UFIs in the request through evaluating the access policies associated with the UFI and, if access is not denied by the access permissions, retrieves the encryption key that is coupled with the UFI, and links the access permissions and the encryption key, if retrieved, to the UFI, and
• sends a response that contains the access permissions and if retrieved, the encryption key, linked with each of the UFIs from the request, to the requesting computing device.