Abstract: A method, system and a computer program product for encrypting files and storing the encrypted files in a storage file system. A software encryption layer is configured to be located between a caller application and the storage file system. Unencrypted file names and file content are exposed by the software encryption layer to the caller application. The software encryption layer encrypts, authenticates and stores file names, file modification and creation timestamps, and file contents obtained from the caller application and controls file access by allocating different encryption keys to at least one of different groups of files or different portions of file contents.