Key management in full disk and file-level encryption

An apparatus comprising:

• a memory;
• and
• at least one processor coupled to the memory;
• and
• a plurality of modules executing on the at least one processor, wherein the plurality of modules comprise:
• an interface module configured to fetch a distinct cryptographic key from a secure module in connection with a request to perform one of a decryption operation and an encryption operation on at least one of an individual file and an individual sector within a storage device on a computing device;
• a processor module configured to use the distinct cryptographic key to perform the one of a decryption operation and an encryption operation on the at least one of an individual file and an individual sector within the storage device on the computing device;
• and
• an over-writer module configured to discard the distinct cryptographic key within a pre-determined amount of time (i) subsequent to said performing the one of a decryption operation and an encryption operation on at least one of an individual file and an individual sector within the storage device on the computing device and (ii) prior to use for an additional one of a decryption operation and an encryption operation.

A method comprising:

• fetching a distinct cryptographic key from a secure module in connection with a request to decrypt at least one encrypted section of multiple files within a storage device on a computing device;
• using the distinct cryptographic key to decrypt the at least one encrypted section of multiple files within the storage device on the computing device;
• and
• discarding the distinct cryptographic key within a pre-determined amount of time (i) subsequent to said decryption of the at least one encrypted section of multiple files within the storage device on the computing device and (ii) prior to use for an additional decryption operation.