System and method for file-level data protection

A system for encryption and key management, the system comprising:

• a processor;
• and
• a memory storing computer executable instructions that when executed by the processor cause the processor to:
• generate a unique file encryption key for a specified file in response to creation of the specified file by a computing device, wherein the specified file is associated with a user of the computing device;
• encrypt the specified file using the file encryption key to form an encrypted file;
• associate a protection class with the specified file, wherein the protection class includes certain file behavior and access rights for the specified file;
• generate a protection class key for the protection class;
• encrypt the unique file encryption key using the protection class key to form an encrypted file encryption key;
• and
• encrypt the protection class key using a user key and a device specific code in response to enabling of data protection on the device to form an encrypted protection class key, wherein the user key is based upon a passcode associated with the user, and the device specific code is a unique code associated with hardware of the computing device.

A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform encryption and key management, the instructions comprising:

• generating a set of unique file encryption keys for a plurality of specified files in response to creation of the specified files by a computing device, wherein the specified files are associated with a user of the computing device;
• encrypting each specified file of the plurality of specified files on the computing device using a corresponding unique file encryption key selected from a set of unique file encryption keys to form a plurality of encrypted files, wherein the encrypting is in response to creation of the specified files;
• assigning a protection class selected from a set of protection classes for each specified file, wherein the protection class associates certain file behavior and access rights for the specified file;
• generating a set of protection class keys corresponding to the set of protection classes;
• encrypting the set of unique file encryption keys using corresponding protection class keys in response to generating the set of protection class keys;
• and
• encrypting each protection class encryption key from the set of protection class keys using a combination of a user key and a device specific code in response to enabling of data protection on the device, wherein the user key is based upon a passcode associated with the user, and the device specific code is a unique code associated with hardware of the computing device.