Patent ID: 8176319

Claim:
Data storage apparatus available to at least one requestor via a network, comprising: a file server capable of communication with at least one client via the network; physical storage comprising LUNs; and an encryption device in communication with both the file server and the physical storage; wherein the encryption device is not in direct communication with the client; wherein the encryption device is communicatively coupled to a key server which is enabled to provide the encryption device with encryption keys; wherein the clients are not in direct communication with the key server; wherein the encryption device is enabled to use the encryption keys to selectively decrypt data being delivered from the physical storage; wherein first and second logical paths are established between the file server and the physical storage by way of the encryption device, the first path being employed for a first type of requestor, the first requestor corresponds to an owner of data being requested, and the second path being employed for a second type of requestor, wherein the second type of requestor is other than an owner of the data being requested, and wherein the physical storage is operative to provide decrypted data to the file server via the first path, and wherein the physical storage is operative to provide encrypted data and metadata in-the-clear stored on an unencrypted LUN of the LUNs, the metadata describing the data, to the file server via the second path.