Abstract: A processing device may generate a data encryption key configured to encrypt unique data within a clone of an encrypted data set and associated with a set of transaction identifiers of a transaction based file system. The processing device may further wrap the data encryption key with a wrapping key, create a cloned encrypted data set with the data encryption key, and store the wrapped data encryption key with the cloned encrypted data set indexed by at least one of the set of transaction identifiers.

Abstract: A method for verifying an Executable and Linking File (ELF) object, that includes receiving a request for an ELF object from a client, obtaining the ELF object, determining whether a signature associated with the ELF object is valid, determining whether a usage restriction is associated with the ELF object, if the signature is valid, and restricting access to the ELF object, if the usage restriction is associated with the ELF object.

Abstract: A method for processing a request for a cryptographic function that includes calling into a user-level encryption framework to process the request, wherein calling into the encryption framework comprises sending the request from a user-level application, and processing the request and returning a result to the user-level application, wherein processing the request includes selecting a user-level cryptographic provider from available user-level providers and processing the request using the user-level cryptographic provider selected from the available user-level providers, if the request comprises a metaslot provider request, and selecting the user-level cryptographic provider specified in the request and processing the request using the specified user-level cryptographic provider, if the request is not the metaslot provider request.

Abstract: A processing device may generate a data encryption key configured to encrypt unique data within a clone of an encrypted data set and associated with a set of transaction identifiers of a transaction based file system. The processing device may further wrap the data encryption key with a wrapping key, create a cloned encrypted data set with the data encryption key, and store the wrapped data encryption key with the cloned encrypted data set indexed by at least one of the set of transaction identifiers.

Abstract: A system including an application configured to request a key, a keystore configured to provide the key, wherein the keystore comprises a non-application specific directory, and an application-specific subdirectory.

Abstract: One embodiment of the present invention provides a system that facilitates specifying a repository containing authentication information to a plugin in a plugable authentication system. When the system receives a command that requires the repository to be accessed, the system populates a data structure with information including a specifier for the repository. The system passes this data structure into a plugin framework. This enables one or more plugins within the framework to access the specified repository.

Abstract: A method for performing a cryptographic function including calling into an encryption framework to perform the cryptographic function, wherein calling into the encryption framework comprises sending a request to perform the cryptographic function from a kernel consumer, and processing the request and returning the result to the kernel consumer, wherein processing the request comprises determining whether the request is synchronous or asynchronous, and determining which cryptographic provider to use to perform the cryptographic function.

Abstract: One embodiment of the present invention provides a system that implements a pluggable password obscuring mechanism. During operation, the system receives a request to obscure a password to produce an obscured version of the password. If the request specifies a customized technique for obscuring the password, the system loads a dynamic library that performs the customized technique, and then uses the dynamic library to obscure the password. If the request does not specify a customized technique, the system uses a default technique to obscure the password. In this way, the customized technique for obscuring the password can be used without having to modify source code.

Abstract: One embodiment of the present invention provides a system that facilitates specifying a repository containing authentication information to a plugin in a plugable authentication system. When the system receives a command that requires the repository to be accessed, the system populates a data structure with information including a specifier for the repository. The system passes this data structure into a plugin framework. This enables one or more plugins within the framework to access the specified repository.