Filesystem-level encryption

Filesystem-level encryption, often called file-based encryption, FBE, or file/folder encryption, is a form of <a href="/facts/Disk_encryption/v7E50jGw">disk encryption</a> where individual files or directories are <a href="/facts/Encryption/16q29Fdv">encrypted</a> by the <a href="/facts/File_system/FdPm90uc">file system</a> itself.
This is in contrast to the <a href="/facts/Full_disk_encryption/v7E50jGw">full disk encryption</a> where the entire partition or disk, in which the file system resides, is encrypted.
Types of filesystem-level encryption include:

<ul><li>the use of a 'stackable' cryptographic filesystem layered on top of the main file system</li>
<li>a single general-purpose file system with encryption</li></ul>
The advantages of filesystem-level encryption include:

<ul><li>flexible file-based <a href="/facts/Key_management/1l6mSswW">key management</a>, so that each file can be and usually is encrypted with a separate encryption key</li>
<li>individual management of encrypted files e.g. incremental backups of the individual changed files even in encrypted form, rather than backup of the entire encrypted volume</li>
<li><a href="/facts/Access_control/08zE5Pz8">access control</a> can be enforced through the use of <a href="/facts/Public-key_cryptography/gowoFTxS">public-key cryptography</a>, and</li>
<li>the fact that <a href="/facts/Key_(cryptography)/5W5PAmT4">cryptographic keys</a> are only held in memory while the file that is decrypted by them is held open.</li></ul>

Filesystem-level encryption open-in-new

Filesystem-level encryption