Encryption key management for file system
AssigneeInternational Business Machines Corporation
InventorsHiroshi Araki, Shah Mohammad R. Islam, Hiroyuki Miyoshi
Life of this patent
Estimating the term…
Abstract
In an approach to encryption key management, a computing device, responsive to a key storage condition, stores, in a cache memory, a first e/d key. The computing device receives a request to read a first file. The computing device, responsive to the request, accesses the first file, with the accessing of the first file including: accessing, from the cache memory, the first e/d key, decrypting the first file using the first e/d key and a second e/d key, and accessing the decrypted version of the first file.
Claims20
A computer-implemented method for use with an encrypted file system including a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the method comprising:
- responsive to a key storage condition, storing, in a cache memory, the first e/d key;
- receiving a request to read the first file;
- and
- responsive to the request, accessing the first file, with the accessing of the first file including:
- accessing, from the cache memory, the first e/d key,
- decrypting the first file using the first and second e/d keys, and
- accessing the decrypted version of the first file.
A computer program product for use with an encrypted file system including a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the computer program product comprising a computer readable storage medium having stored thereon:
- program instructions, responsive to a key storage condition, to store, in a cache memory, the first e/d key;
- program instructions to receive a request to read the first file;
- and
- program instructions, responsive to the request, to access the first file, with the accessing of the first file including:
- program instructions to access, from the cache memory, the first e/d key,
- program instructions to decrypt the first file using the first and second e/d keys, and
- program instructions to access the decrypted version of the first file.
A computer system for use with a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the computer system comprising:
- a processor(s) set, and
- a computer readable storage medium,
- wherein:
- the processor set is structured, located, connected and/or programmed to run program instructions stored on the computer readable storage medium;
- and
- the program instructions include:
- program instructions, responsive to a key storage condition, to store, in a cache memory, the first e/d key;
- program instructions to receive a request to read the first file;
- and
- program instructions, responsive to the request, to access the first file, with the accessing of the first file including:
- program instructions to access, from the cache memory, the first e/d key,
- program instructions to decrypt the first file using the first and second e/d keys, and
- program instructions to access the decrypted version of the first file.
Dependencies are inferred from the claim text.