ENCRYPTION MANAGEMENT IN AN INFORMATION HANDLING SYSTEM

1 . A method of enforcing an encryption policy in an information handling system comprising steps of:

receiving a request for access to data;

automatically identifying from a plurality of encryption policies a particular encryption policy associated with the requested data;

selecting an available encryption implementation module capable of enforcing the identified encryption policy; and

initiating an encryption or decryption of the requested data using the selected encryption implementation module.

2 . The method of claim 1 wherein selecting an available encryption implementation module comprises:

determining a performance characteristic of each of multiple available encryption implementation modules capable of enforcing the identified encryption policy; and

selecting an encryption implementation module based at least on a comparison of the determined performance characteristics.

3 . The method of claim 1 wherein the encryption policy specifies an encryption algorithm and key source, the method further comprising:

accessing an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

4 . The method of claim 3 wherein the key source is located remote from the information handling system.

5 . The method of claim 1 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.

6 . The method of claim 1 wherein the key source specified in a first encryption policy is different from the key source specified in a second encryption policy.

7 . The method of claim 1 further comprising:

providing a user interface for setting one of the plurality of encryption policies by a user on a second information handling system; and

communicating this set encryption policy to the first information handling system.

8 . Software embodied in tangible computer-readable media and, when executed by a processor, operable to:

receive a request for access to data;

automatically identify from a plurality of encryption policies a particular encryption policy associated with the requested data;

select an available encryption implementation module capable of enforcing the identified encryption policy; and

initiate an encryption or decryption of the requested data using the selected encryption implementation module.

9 . The software of claim 8 wherein:

each of a plurality of encryption implementation modules provides a data interface; and

an abstraction layer provides a standardized interface to receive the request and initiate the encryption or decryption of the requested data independent of the data interface provided by the selected encryption implementation module.

10 . The software of claim 8 wherein the encryption policy specifies an encryption algorithm and key source, the method further comprising:

accessing an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

11 . The software of claim 10 wherein the key source is located remote from the information handling system.

12 . The software of claim 8 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.

13 . The software of claim 8 wherein the key source specified in a first encryption policy is different from the key source specified in a second encryption policy.

14 . The software of claim 8 further operable to:

provide a user interface for setting one of the plurality of encryption policies by a user on a second information handling system; and

communicate this set encryption policy to the first information handling system.

15 . An information handling system comprising:

a processor;

a memory coupled to the processor; and

a security policy enforcement subsystem enabled to:

receive a request for access to data;

automatically identify from a plurality of encryption policies a particular encryption policy associated with the requested data;

select an available encryption implementation module capable of enforcing the identified encryption policy; and

initiate an encryption or decryption of the requested data using the selected encryption implementation module.

16 . The information handling system of claim 15 wherein the security policy enforcement system comprises:

a security policy manager; and

an encryption services module configured to provide services to the security policy manager and to discover and request services of the encryption implementation module.

17 . The information handling system of claim 15 wherein the encryption policy specifies that the encryption implementation module utilize encryption specific hardware that protects the encryption key from unauthorized access.

18 . The information handling system of claim 15 wherein the encryption policy specifies an encryption algorithm and key source, the security policy enforcement subsystem further enabled to:

access an encryption key from the key source specified by the policy for use by the selected encryption implementation module.

19 . The information handling system of claim 18 wherein the key source is located remote from the information handling system.

20 . The information handling system of claim 15 wherein:

each encryption policy specifies an encryption algorithm; and

the encryption algorithm specified by a first encryption policy is different from the encryption algorithm specified by a second encryption policy.