Patent ID: 7222231

Claim:
A computer-implemented method for controlling access by a plurality of client applications to file data in a distributed file system including a distributed file system interface coupled to the client applications and a storage server and a meta-data server coupled to the distributed file system interface, comprising: receiving at the meta-data server an open-file request, the open-file request specifying a name of a first file, wherein the first file includes a first set of blocks; creating a security object at the meta-data server in response to the open-file request; generating a partial encryption key at the meta-data server and storing the partial encryption key in the security object; transmitting the security object to the storage server; completing generation of the encryption key at the storage server using the partial encryption key and storing a complete encryption key in the security object; returning the security object with the complete encryption key to the meta-data server; encrypting a list that identifies the first set of blocks, whereby an encrypted block list is formed; adding the encrypted block list to the security object; transmitting the security object to the distributed file interface; transmitting a close file request, along with the security object, from the distributed file system interface to the meta-data server, the close file request specifying the name of the first file; and removing the encrypted block list of the first file from the security object.