Patent ID: 9699155
Date: 2017-07-04
CPC Classifications: G06F,H04L

Claim:
1. A method, comprising: intercepting, by a virtual file system instantiated on a first computing system, a command to store one or more files which define one or more virtual machines, the command intercepted from a hypervisor instantiated on a second computing system, wherein the first computing system is separate from the second computing system; for at least one of the one or more files, receiving by the virtual file system a policy associated with the file from a policy server and receiving by the virtual file system an encryption key associated with the file from a key server; encrypting, by the virtual file system, a first portion of the at least one or more files using at least one of the one or more encryption keys, but not encrypting a second portion of the at least one or more files, wherein the encrypted first portion comprises application data and the non-encrypted second portion does not comprise application data; and transmitting, by the virtual file system, the encrypted first portion and the non-encrypted second portion from the virtual file system to a physical file system instantiated on a third computing system and informing a file system driver how to store the encrypted first portion and the non-encrypted second portion based on the one or more policies, wherein the physical file system stores the encrypted first portion and the non-encrypted second portion in a storage system based on the one or more policies received from the policy server.