Patent ID: 8607071

Claim:
A computer-implemented method to prevent replay attacks in an encrypted file system (EFS), the method comprising: generating a session key; providing the session key to a plurality of drive managers and an encrypted file system process; determining, by each of the drive managers, if the session key is an updated session key that is part of a key renewal request; in response to determining that the session key is an updated session key that is part of a key renewal request, performing, by the drive managers, the following: decrypting, at each of the drive managers, the updated session key; and after the decrypting, replacing a current session key with the updated session key at each of the drive managers; in response to determining that the session key is not an updated session key that is part of a key renewal request, storing, at the drive managers, the session key in further response to determining that user access to a computer system that is utilizing the encrypted file system is currently inhibited; in response to determining that the session key is not an updated session key that is part of a key renewal request, and that user access to the computer system that is utilizing the encrypted file system is not currently inhibited, logging an attempt to circumvent session key security; receiving a drive request at the encrypted file system process; encrypting the drive request using the generated session key provided to the encrypted file system process; sending the encrypted drive request to a selected one of the drive managers, wherein the selected drive manager performs steps of: attempting to decrypt the drive request using the session key provided to the selected drive manager; and performing the drive request in response to the decrypt attempt successfully decrypting the encrypted drive request, wherein the drive request is not performed in response to an unsuccessful decryption attempt.