Method and system for encrypting files and storing the encrypted files in a storage file system

A computer program product comprising code means for execution on a computer system, which when executed by a computer, cause the computer to perform method steps of encrypting files and storing the encrypted files in a storage file system, the method comprising the steps of:

• configuring a software encryption layer to be located between a caller application and the storage file system;
• exposing unencrypted file names and file content by the software encryption layer to the caller application;
• encrypting, authenticating and storing by the software encryption layer file names, file modification and creation timestamps, and file contents obtained from the caller application;
• and
• controlling file access by the software encryption layer by allocating different encryption keys to at least one of different groups of files or different portions of file contents, wherein the controlling comprises using a master encryption key to derive subordinate encryption keys, and sharing and distributing the subordinate encryption keys to allow selective access to predetermined subsets of files, or portions of file contents of the storage file system.

A system of encrypting files and storing the encrypted files in a storage file system, the system comprising:

• a software encryption layer configured to be located between a caller application and the storage file system;
• wherein the software encryption layer is adapted to expose unencrypted file names and file content to the caller application;
• wherein the software encryption layer is adapted to encrypt, authenticate and store file names, file modification and creation timestamps, and file contents obtained from the caller application;
• and
• wherein the software encryption layer is adapted to control file access by allocating different encryption keys to at least one of different groups of files or different portions of file contents, wherein the software encryption layer is adapted to control file access by using a master encryption key to derive subordinate encryption keys, and shares and distributes the subordinate encryption keys to allow selective access to predetermined subsets of files, or portions of file contents of the storage file system.