Patent ID: 8549326

Claim:
A method for transparently managing user access of encrypted files, comprising the steps of: (a) provisioning each encrypted file with: (i) a trusted service account encryption certificate that enables a trusted service to add one or more encryption certificates to the encrypted file for one or more users or other entities that should be authorized to access a content of the encrypted file; (ii) special signed encrypted data blocks that include authorization information indicating one or more entities that can access the encrypted file; (iii) encrypting file system metadata for the encrypted file that are signed with a signing key; and (iv) a digital signature determined by hashing the encrypting file system metadata and special encrypted data blocks and using a signing key; and (b) when a user attempts to access an encrypted file, performing the following steps: (i) authenticating the user by accessing an authentication service that can authenticate the user; and if the user is authenticated by the authentication service, (ii) granting access to the encrypted file to the user if the authorization information indicates that the user should be granted access and if the authentication service authenticates the user; and if not, (iii) determining whether the user should be granted access to the file based either on a security descriptor for the file or a resource identifier that is included in the authorization information of the special encrypted data blocks; and if so, (iv) using the trusted service to add an encryption certificate for the user to the encrypting file system metadata, so that the user is granted access to the encrypted file; and (v) if the user is not specified in the authorization information and it is determined that the user should not be granted access to the file based on the authorization information, or if the user is not authenticated by the authentication service, denying the user access to the encrypted file.