# US 8,788,806 B2 · General purpose distributed encrypted file system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,788,806 B2
- Document ID: US8788806B2
- Status: Granted
- Kind: B2
- Application number: 13/423,184
- Filed: 2012-03-17
- Published: 2012-07-19
- Granted: 2014-07-22
- Earliest claimed: 2010-09-17
- Assignees: International Business Machines Corporation
- Applicants: Hussaina Nandyala Begum; Shawn Patrick Mullen; Manjunath A. Pattanshetti
- Inventors: Hussaina Nandyala Begum; Shawn Patrick Mullen; Manjunath A. Pattanshetti
- Web page: https://patentgrep.com/patent/US8788806B2

## CPC

- H04L 9/0822: {using key encryption key}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 2463/062: applying encryption of the keys
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A general purpose distributed encrypted file system generates a block key on a client machine. The client machine encrypts a file using the block key. Then, the client encrypts the block key on the first client machine with a public key of a keystore associated with a user and associates the encrypted block key with the encrypted data block as crypto metadata. The client machine caches the encrypted data block and the crypto metadata and sends the encrypted data block and the crypto metadata to a network file system server. When the client machine receives a return code from the network file system server indicating successful writes of the encrypted data block and the crypto metadata, the client machine clears the cached encrypted data block and the crypto metadata.

## Claims

### Claim 1

A method, which comprises:
generating a block key on a first client machine, wherein said block key is a combination of an initialization vector and a file key;
encrypting a data block on said first client machine with said block key;
encrypting said block key on said first client machine with a public key associated with a user;
associating said encrypted block key with said encrypted data block as crypto metadata;
caching said encrypted data block and said crypto metadata on said first client machine in a local encryption cache;
sending said encrypted data block and said crypto metadata from said first client machine to a network file system server wherein said cached encrypted data block and said crypto metadata remain on one of said first client machine or said network file system server until receipt of a return code indicating successful writes of said encrypted first data block and said crypto metadata by said network file system server; and,
clearing said cached encrypted data block and said crypto metadata upon receipt of the return code indicating successful writes of said encrypted data block and said crypto metadata by said network file system server.

### Claim 2 (depends on 1)

The method as claimed in claim 1, wherein said public key is part of a keystore associated with said user.

### Claim 3 (depends on 2)

The method as claimed in claim 2, wherein said keystore is stored on a remote server.

### Claim 4 (depends on 3)

The method as claimed in claim 3, wherein said remote server comprises a lightweight directory access protocol (LDAP) server.

### Claim 5 (depends on 1)

The method as claimed in claim 1, wherein said crypto metadata is associated with said encrypted data block as extended attributes.

### Claim 6 (depends on 1)

The method as claimed in claim 1, further comprising:
receiving said encrypted data block and said crypto metadata from said network file system server at a receiving client machine;
decrypting said crypto metadata using a private key to obtain said block key; and,
decrypting said encrypted data block with said block key.

### Claim 7 (depends on 6)

The method as claimed in claim 6, wherein said receiving client machine is said first client machine.

### Claim 8 (depends on 6)

The method as claimed in claim 6, wherein said private key is part of said keystore associated with said user.

### Claim 9 (depends on 8)

The method as claimed in claim 8, wherein said keystore is stored on a remote server.

### Claim 10 (depends on 9)

The method as claimed in claim 9, wherein said remote server comprises a lightweight directory access protocol (LDAP) server.