# US 2017/0286709 A1 · Encryption key management for file system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0286709 A1
- Document ID: US20170286709A1
- Status: Published application
- Kind: A1
- Application number: 15/086,651
- Filed: 2016-03-31
- Published: 2017-10-05
- Earliest claimed: 2016-03-31
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Hiroshi Araki; Shah Mohammad R. Islam; Hiroyuki Miyoshi
- Web page: https://patentgrep.com/patent/US20170286709A1

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0822: {using key encryption key}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0836: {using tree structure or hierarchical structure}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- G06F 2221/2107: File encryption
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In an approach to encryption key management, a computing device, responsive to a key storage condition, stores, in a cache memory, a first e/d key. The computing device receives a request to read a first file. The computing device, responsive to the request, accesses the first file, with the accessing of the first file including: accessing, from the cache memory, the first e/d key, decrypting the first file using the first e/d key and a second e/d key, and accessing the decrypted version of the first file.

## Claims

### Claim 1

A computer-implemented method for use with an encrypted file system including a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the method comprising:
responsive to a key storage condition, storing, in a cache memory, the first e/d key;
receiving a request to read the first file; and
responsive to the request, accessing the first file, with the accessing of the first file including:
accessing, from the cache memory, the first e/d key,
decrypting the first file using the first and second e/d keys, and
accessing the decrypted version of the first file.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 wherein the key storage condition is performance of an access operation on the second file using the first and third e/d keys.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1 wherein the access of the first file further includes:
decrypting the second e/d key using the first e/d key accessed from the cache memory.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein the file system is hierarchical and includes a plurality of levels of file directories.

### Claim 5 (depends on 3)

The computer-implemented method of claim 3 wherein the cache memory is located on a processor that is used to perform decryption operations.

### Claim 6 (depends on 3)

The computer-implemented method of claim 3 wherein the cache memory is located in a volatile memory that is separate from a processor that is used to perform decryption operations.

### Claim 7 (depends on 4)

The computer-implemented method of claim 4 wherein:
the file system includes a master e/d key;
the file system further includes a second file directory encrypted by a fourth e/d key;
and which second file directory is a parent directory of the first file directory;
decryption of the first file requires at least use of all of the master e/d key, the first e/d key, the second e/d key and the fourth e/d key; and
decryption of the second file requires at least use of all of the master e/d key, the first e/d key, the third e/d key and the fourth e/d key.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7 further comprising:
responsive to the key storage condition, storing, in the cache memory, the fourth e/d key;
wherein the key storage condition is performance of an access operation on the second file using the master e/d key, the first e/d key, the third e/d key and the fourth e/d key.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8 further comprising:
re-encrypting the fourth key by the master key;
re-encrypting the first key by the master key; and
re-encrypting the third key by the master key.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1 wherein the first e/d key is stored in the cache memory in encrypted form.

### Claim 11 (depends on 1)

The computer-implemented method of claim 1 wherein the first e/d key is stored in the cache memory in decrypted form.

### Claim 12

A computer program product for use with an encrypted file system including a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the computer program product comprising a computer readable storage medium having stored thereon:
program instructions, responsive to a key storage condition, to store, in a cache memory, the first e/d key;
program instructions to receive a request to read the first file; and
program instructions, responsive to the request, to access the first file, with the accessing of the first file including:
program instructions to access, from the cache memory, the first e/d key,
program instructions to decrypt the first file using the first and second e/d keys, and
program instructions to access the decrypted version of the first file.

### Claim 13 (depends on 12)

The computer program product of claim 12 wherein the key storage condition is performance of an access operation on the second file using the first and third e/d keys.

### Claim 14 (depends on 12)

The computer program product of claim 12 wherein the access of the first file further includes:
program instructions to decrypt the second e/d key using the first e/d key accessed from the cache memory.

### Claim 15 (depends on 12)

The computer program product of claim 12 wherein the file system is hierarchical and includes a plurality of levels of file directories.

### Claim 16 (depends on 15)

The computer program product of claim 15 wherein:
the file system includes a master e/d key;
the file system further includes a second file directory encrypted by a fourth e/d key;
and which second file directory is a parent directory of the first file directory;
decryption of the first file requires at least use of all of the master e/d key, the first e/d key, the second e/d key and the fourth e/d key; and
decryption of the second file requires at least use of all of the master e/d key, the first e/d key, the third e/d key and the fourth e/d key.

### Claim 17

A computer system for use with a first encrypted file directory, with the first file directory including a first file and a second file, with the first file directory having a corresponding first encryption/decryption (e/d) key, the first file having a corresponding second e/d key, and the second file having a corresponding third e/d key, so that decryption of the first file requires at least use of both the first and second e/d keys, and decryption of the second file requires at least use of both the first and third e/d keys, the computer system comprising:
a processor(s) set, and
a computer readable storage medium,
wherein:
the processor set is structured, located, connected and/or programmed to run program instructions stored on the computer readable storage medium; and
the program instructions include:
program instructions, responsive to a key storage condition, to store, in a cache memory, the first e/d key;
program instructions to receive a request to read the first file; and
program instructions, responsive to the request, to access the first file, with the accessing of the first file including:
program instructions to access, from the cache memory, the first e/d key,
program instructions to decrypt the first file using the first and second e/d keys, and
program instructions to access the decrypted version of the first file.

### Claim 18 (depends on 17)

The computer system of claim 17 wherein the key storage condition is performance of an access operation on the second file using the first and third e/d keys.

### Claim 19 (depends on 17)

The computer system of claim 17 wherein the access of the first file further includes:
program instructions to decrypt the second e/d key using the first e/d key accessed from the cache memory.

### Claim 20 (depends on 17)

The computer system of claim 17 wherein the file system is hierarchical and includes a plurality of levels of file directories.