Patent ID: 8745384

Claim:
A method comprising: sending an authentication registration request from at least one network device configured to encrypt and decrypt data to a management server that maintains different security information, including one or more access control policies and master keys, associated with each of a plurality of access groups for the management server to authenticate the at least one network device and register the at least one network device to a selected one of the access groups; in response to the authentication registration request, receiving at the at least one network device from the management server security information, including the one or more access control policies and master keys, associated with the selected access group; intercepting, with the at least one network device, a data file transmitted to cloud storage from a client in an enterprise computing environment; after the network device has been authenticated by the management server, authenticating, by the at least one network device, the client to ensure the client has permission to write the data to the cloud storage by accessing authentication information stored in the management server; and converting at the network device, based on the security information including the one or more access control policies and master keys received from the management server, the data file into an encrypted object configured to remain encrypted while at rest in the cloud storage.