MULTI-LAYER EMBEDDED ENCRYPTION

1 . A method for automatically encrypting files, the method comprising:

by a computing system comprising one or more processors:

in response to determining that file metadata associated with a file stored in a primary storage system satisfies a set of encryption rules, encrypting the file to obtain an encrypted file and modifying an extension of the encrypted file to include an encryption extension, wherein encrypting the file comprises:

obtaining a data encryption key;

encrypting the file with the data encryption key to obtain the encrypted file;

identifying a set of users who are authorized to access the file; and

for each user from the set of users:

encrypting a copy of the data encryption key for the user to obtain an encrypted copy of the data encryption key; and

embedding the encrypted copy of the data encryption key with the encrypted file.

2 . The method of claim 1 , wherein encrypting a copy of the data encryption key for each user comprises:

obtaining a public key associated with the user, wherein each user from the set of users is associated with a different public key, and wherein each public key corresponds to a private key with a one-to-one correspondence; and

encrypting the copy of the data encryption key using the public key to obtain the encrypted copy of the data encryption key for the user.

3 . The method of claim 2 , further comprising:

obtaining a passphrase for the user;

hashing the passphrase to obtain a modified passphrase; and

encrypting the private key using the modified passphrase.

4 . The method of claim 3 , further comprising:

discarding the data encryption key;

discarding the private key for the user;

discarding the passphrase for the user; and

discarding the modified passphrase for the user.

5 . The method of claim 3 , wherein hashing the passphrase to obtain the modified passphrase further comprises performing a hashing algorithm a threshold number of times, thereby reducing the probability that unauthorized attempts to access the passphrase are successful.

6 . The method of claim 3 , wherein the passphrase for at least one user from the set of users is the same passphrase used by the at least one user to access the computing system.

7 . The method of claim 1 , further comprising:

receiving a request to access the encrypted file from a first user from the set of users;

obtaining a copy of a passphrase associated with the first user;

hashing the copy of the passphrase to obtain a modified copy of the passphrase;

using the modified copy of the passphrase to decrypt an encrypted private key associated with the first user to obtain an unencrypted private key;

extracting the copy of the encrypted data encryption key included with the encrypted file that is associated with the first user;

decrypting the copy of the encrypted data encryption key to obtain an unencrypted copy of the data encryption key;

decrypting the encrypted file using the unencrypted copy of the data encryption key to obtain an unencrypted copy of the file; and

providing the first user with access to the unencrypted copy of the file.

8 . The method of claim 1 , wherein obtaining the data encryption key comprises generating the data encryption key.

9 . The method of claim 1 , wherein the file is one of a set of files and wherein each file from the set of files is associated with a unique data encryption key.

10 . The method of claim 1 , further comprising:

obtaining a system public key for the computing system, the system public key corresponding to a system private key with a one-to-one correspondence;

encrypting a system copy of the data encryption key using the system public key to obtain an encrypted system copy of the data encryption key for the computing system;

embedding the encrypted system copy of the data encryption key for the computing system with the encrypted file;

providing an identity of the computing system and the system private key to a storage manager, thereby enabling the storage manager to encrypt the system private key with a passphrase associated with the computing system;

receiving from the storage manager an encrypted system private key corresponding to the system private key; and

discarding the system copy of the data encryption key and the system private key.

11 . The method of claim 10 , further comprising:

receiving a request to access the encrypted file from a first user from the set of users;

determining whether the first user is authorized to access the encrypted file;

in response to determining that the first user is authorized to access the encrypted file, providing the encrypted system private key to the storage manager; and

in response to providing the encrypted system private key to the storage manager:

receiving the system private key from the storage manager;

extracting the encrypted system copy of the data encryption key from the encrypted file;

decrypting the encrypted system copy of the data encryption key using the system private key to obtain the system copy of the data encryption key;

decrypting the encrypted file using the system copy of the data encryption key to obtain an unencrypted copy of the file; and

providing the first user with access to the unencrypted copy of the file.

12 . The method of claim 1 , wherein said determining that file metadata associated with the file stored in the primary storage satisfies the set of encryption rules occurs during a backup to a secondary storage system of a set of files that includes the file.

13 . A system for automatically encrypting files, the system comprising:

a primary storage system configured to store a file;

an encryption rules system comprising computer hardware and configured to store a set of encryption rules; and

a data agent comprising computer hardware, the data agent associated with a file system of the system, the data agent configured to:

access the set of encryption rules from the encryption rules system;

determine based, at least in part, on the set of encryption rules that the file is to be encrypted;

generate a data encryption key;

encrypt the file with the data encryption key to obtain an encrypted file;

identify a set of users who are authorized to access the file; and

for each of the users from the set of users, the data agent is further configured to:

encrypt a copy of the data encryption key for the user to obtain an encrypted copy of the data encryption key; and

include the encrypted copy of the data encryption key with the encrypted file.

14 . The system of claim 13 , wherein the data agent is further configured to store the encrypted file with the encrypted copies of the data encryption keys at the primary storage system.

15 . The system of claim 13 , wherein the data agent is further configured to obtain a public key associated with each user from the set of users, wherein each user is associated with a different public key, and wherein encrypting the copy of the data encryption key for the user comprises using the public key associated with the user to encrypt the copy of the data encryption key.

16 . The system of claim 15 , wherein the data agent is further configured to:

obtain a passphrase for each user;

obfuscate the passphrase to obtain a modified passphrase for each user; and

encrypt a private key for each user corresponding to each user's associated public key using the modified passphrase.

17 . The system of claim 16 , wherein the data agent is further configured to obfuscate the passphrase by performing a hashing algorithm, and wherein the data agent performs the hashing algorithm a threshold number of times, thereby reducing the probability that unauthorized attempts to access the passphrase are successful.

18 . The system of claim 13 , wherein the data agent is further configured to:

obtain a system public key and a system private key corresponding to the system public key with a one-to-one correspondence;

encrypt a system copy of the data encryption key using the system public key to obtain an encrypted system copy of the data encryption key;

include the encrypted system copy of the data encryption key with the encrypted file;

provide the system private key to a storage manager, thereby enabling the storage manager to encrypt the system private key with a system passphrase;

receive from the storage manager an encrypted system private key corresponding to the system private key; and

discard the unencrypted system copy of the data encryption key and the unencrypted system private key.

19 . The system of claim 13 , wherein the data agent is further configured to:

receive a request to access the encrypted file from a first user from the set of users;

determine whether the first user is authorized to access the encrypted file;

provide the encrypted system private key to the storage manager in response to determining that the first user is authorized to access the encrypted file thereby enabling the storage manager to determine whether the system private key has been marked lost or stolen and to decrypt the encrypted system private key to provide to the data agent if the system private key has not been marked lost or stolen; and

in response to providing the encrypted system private key to the storage manager, the data agent is further configured to:

receive the system private key from the storage manager;

decrypt the encrypted data encryption key using the system private key to obtain the data encryption key;

decrypt the encrypted file using the data encryption key to obtain the file; and

provide the first user with access to the file.

20 . The system of claim 13 , wherein the data agent is further configured to:

receive a request to access the encrypted file from a first user from the set of users;

obtain a copy of a passphrase associated with the first user;

obfuscate the copy of the passphrase to obtain a modified copy of the passphrase;

use the modified copy of the passphrase to decrypt an encrypted private key associated with the first user to obtain an unencrypted private associated;

identify the encrypted data encryption key embedded with the encrypted file that is associated with the first user;

decrypt the encrypted data encryption key to obtain the data encryption key;

decrypt the encrypted file using the data encryption key to obtain an unencrypted copy of the file; and

provide the first user with access to the unencrypted copy of the file.