Abstract: Using a computer system, an instruction is received to define or modify a permission constraint corresponding to one or more files. A permission-instruction data set representing the permission constraint is stored in a data store. Subsequent to storing the permission-instruction data, a user request to access a particular file is intercepted. The data store is queried to determine whether any pending permission-instruction data set corresponds to the particular file. In response to the query, it is determined that the permission-instruction data set corresponds to the particular file. A permission constraint of the particular file is added or modified based on the permission-instruction data set. Based on the modified or added permission constraint, it is determined whether and/or an extent to which the user request is authorized. A response to the user request based on the determination as to whether and/or an extent to which the user request is authorized.

Abstract: An instruction is received to define or modify a permission constraint corresponding to one or more file. A period of time is determined, where the period is one during which the defined or modified permission constraint is to apply to the one or more files. It is determined that the one or more files are to be deleted following completion of the period of time. A permission-instruction data set representing the permission constraint and a flag indicating that the one or more files are to be deleted following completion of the period of time are stored in a data store. It is detected that the period of time has ended. The one or more files are deleted in response to the detection.

Abstract: Using a computer system, an instruction is received to define or modify a permission constraint corresponding to one or more files. A permission-instruction data set representing the permission constraint is stored in a data store. Subsequent to storing the permission-instruction data, a user request to access a particular file is intercepted. The data store is queried to determine whether any pending permission-instruction data set corresponds to the particular file. In response to the query, it is determined that the permission-instruction data set corresponds to the particular file. A permission constraint of the particular file is added or modified based on the permission-instruction data set. Based on the modified or added permission constraint, it is determined whether and/or an extent to which the user request is authorized. A response to the user request based on the determination as to whether and/or an extent to which the user request is authorized.

Abstract: Information in a data set of a copy-on-write file system may be made inaccessible. A first key for encrypting a data set of a copy-on-write file system is generated and wrapped with a second key. An encrypted data set is created with the first key. The wrapped first key is stored with the encrypted data set. A command to delete the encrypted data set is received and the second key is altered or changed to make information in the encrypted data set of the copy-on-write file system inaccessible.

Abstract: A method for encrypting data includes receiving a block of plaintext for a data set at one or more computers, acquiring a cryptographic key for the data set, generating an initialization vector for the block of plaintext based on the block of plaintext, and encrypting the block of plaintext using the cryptographic key and the initialization vector.

Abstract: A method for encrypting data includes receiving a block of plaintext for a data set at one or more computers, acquiring a cryptographic key for the data set, generating an initialization vector for the block of plaintext based on the block of plaintext, and encrypting the block of plaintext using the cryptographic key and the initialization vector.

Abstract: Information in a data set of a copy-on-write file system may be made inaccessible. A first key for encrypting a data set of a copy-on-write file system is generated and wrapped with a second key. An encrypted data set is created with the first key. The wrapped first key is stored with the encrypted data set. A command to delete the encrypted data set is received and the second key is altered or changed to make information in the encrypted data set of the copy-on-write file system inaccessible.