Devices and methods of managing data

A computing device managing data stored within a container, the container being associated with at least one registered user, the data within the container being encrypted by a data encryption key (DEK) and stored as encrypted data, the computing device comprising:

• a security module including a crypto-processor;
• a main processor coupled to the security module;
• and
• a memory coupled to the processor and the crypto-processor, the memory storing instructions that, when executed, configure at least one of the main processor or the crypto-processor to:
• authenticate a user based on a user secret associated with the container;
• generate a soft key based on the user secret;
• generate, by the crypto-processor, secure generator output including a crypto key component associated with the authenticated user;
• generate, by the crypto-processor, a hardened user key based on a key agreement protocol using the soft key and the crypto key component associated with the authenticated user;
• construct an unencrypted DEK associated with the hardened user key for accessing a subset of the data stored within the container;
• and
• decrypt the subset of the data using the unencrypted DEK.

A non-transitory computer-readable storage medium storing instructions for managing data stored within a container, the container being associated with at least one registered user, the data within the container being encrypted by a data encryption key (DEK) and stored as encrypted data, the instructions, when executed by at least one of a main processor or a crypto-processor of a computing device, cause the computing device to:

• authenticate a user based on a user secret associated with the container;
• generate a soft key based on the user secret;
• generate, by the crypto-processor, secure generator output including a crypto key component associated with the authenticated user;
• generate, by the crypto-processor, a hardened user key based on a key agreement protocol using the soft key and the crypto key component associated with the authenticated user;
• construct an unencrypted DEK associated with the hardened user key for accessing a subset of the data stored within the container;
• and
• decrypt the subset of the data using the unencrypted DEK.