Filesystem-level encryption

This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Filesystem-level encryption" – news · newspapers · books · scholar · JSTOR (October 2024) (Learn how and when to remove this message)

Filesystem-level encryption,^[1] often called file-based encryption, FBE, or file/folder encryption, is a form of disk encryption where individual files or directories are encrypted by the file system itself.

This is in contrast to the full disk encryption where the entire partition or disk, in which the file system resides, is encrypted.

Types of filesystem-level encryption include:

• the use of a 'stackable' cryptographic filesystem layered on top of the main file system
• a single general-purpose file system with encryption

The advantages of filesystem-level encryption include:

• flexible file-based key management, so that each file can be and usually is encrypted with a separate encryption key^{[citation needed]}
• individual management of encrypted files e.g. incremental backups of the individual changed files even in encrypted form, rather than backup of the entire encrypted volume^{[clarification needed]}
• access control can be enforced through the use of public-key cryptography, and
• the fact that cryptographic keys are only held in memory while the file that is decrypted by them is held open.