Encryption for a distributed filesystem

1. A system comprising:

a computing device comprising a frontend and a backend, wherein the frontend is a virtual frontend filesystem that is configured to encrypt data as it enters the system, and wherein the backend is a virtual backend filesystem that comprises a plurality of buckets; and

a plurality of storage devices, wherein:

each bucket of the plurality of buckets is configured to build a failure-protected stripe that comprises a plurality of failure resilient address spaces across a plurality of storage blocks,

each storage block of a failure-protected stripe is located in a different storage device of the plurality of storage devices,

the encrypted data is stored in a file in one or more failure-protected stripes,

the computing device is in a cluster of computing devices,

the cluster of computing devices is associated with a cluster key,

the computing device registers a long-term key with a leader of the cluster when the computing device joins the cluster of computing devices, and

prior to a transfer of the data, a session key is negotiated using an ephemeral key pair signed with the long-term key.

2. The system of claim 1 , wherein the frontend is operable to decrypt data as it leaves the system.

3. The system of claim 1 , wherein the frontend encrypts the data according to a file key.

4. The system of claim 3 , wherein the file key is rotated when the file is copied.

5. The system of claim 3 , wherein all failure-protected stripes built by the plurality of buckets in the backend are associated with a filesystem key.

6. The system of claim 5 , wherein the file key is encrypted by the filesystem key.

7. The system of claim 5 , wherein the file key is re-encrypted when the filesystem key is rotated.

8. A method comprising:

opening a data file for a write access to a filesystem on a computing device, wherein:

the computing device comprises a frontend, a backend and a plurality of storage devices,

the frontend is a virtual frontend filesystem,

the backend is a virtual backend filesystem that comprises a plurality of buckets,

each bucket of the plurality of buckets is configured to build a failure-protected stripe that comprises a plurality of failure resilient address spaces across a plurality of storage blocks,

each storage block of the plurality of storage blocks in a failure-protected stripe is located in a different storage device of the plurality of storage devices,

the computing device is in a cluster of computing devices, and

the cluster of computing devices is associated with a cluster key;

registering a long-term key, of the computing device, with a leader of the cluster when the computing device joins the cluster of computing devices,

negotiating a session key using an ephemeral key pair signed with the long-term key;

encrypting data in the frontend using the session key;

transferring the data encrypted by the session key to the computing device;

writing the encrypted data to the data file in one or more failure-protected stripes built by one or more buckets of the plurality of buckets; and

closing the data file.

9. The method of claim 8 , wherein the frontend is operable to decrypt data as it is read.

10. The method of claim 8 , wherein the frontend encrypts the data according to a file key; and the method comprises purging the file key from memory after the data file is closed.

11. The method of claim 10 , wherein the method comprises rotating the file key by copying the data file.

12. The method of claim 10 , wherein all failure-protected stripes built by the plurality of buckets in the backend are associated with a filesystem key.

13. The method of claim 12 , wherein the file key is encrypted by the filesystem key.

14. The method of claim 12 , wherein the method comprises re-encrypting the file key when the filesystem key is rotated.