Multi-user storage volume encryption via secure processor
AssigneeApple Inc.
InventorsPierre Olivier Martel, Arthur Mesh, Wade Benson
Life of this patent
Estimating the term…
Abstract
Embodiments described herein enable multi-user storage volume encryption via a secure enclave processor. One embodiment provides for a computing device comprising a first processor to execute a first operating system having one or more user accounts; a second processor to execute a second operating system, the second processor to receive a first encrypted key from the first processor and decrypt a volume encryption key via a key encryption key derived from the first encrypted key, the first encrypted key derived via the secure enclave without user-provided entropy; and a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.
Claims20
A computing device comprising:
- a first processor to execute a first operating system having one or more user accounts;
- a second processor to execute a second operating system, the second processor to:
- receive a first encrypted key from the first processor, the first encrypted key derived and encrypted via the second processor without user-provided entropy and transmitted to the first operating system on the first processor;
- decrypt the first encrypted key into a decrypted first encryption key;
- derive a key encryption key via the decrypted first encrypted key;
- decrypt a volume encryption key via the key encryption key;
- and
- a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.
A non-transitory machine-readable medium storing instructions to cause one or more processors to perform operations including:
- first and second processor and first and second operating system;
- generating, via a second operating system on a second processor, a volume encryption key within the second processor, the volume encryption key to enable access to data on a storage volume of a data processing system including the second processor and a first processor;
- encrypting the volume encryption key within the second processor, the volume encryption key encrypted using a first encryption key;
- generating first system entropy data within the second processor;
- generating a second encryption key based on the first system entropy data, the second encryption key to enable access to the first encryption key;
- and
- requesting a first operating system on the first processor to store an encrypted second encryption key within a storage device on the data processing system, the encrypted second encryption key to enable access to the volume encryption key by a user account without use of entropy associated with credentials of the user account.
A data processing system comprising:
- a first set of processors to execute a first set of instructions, the first set of instructions to cause the first set of processors to provide a first operating system, the first operating system having multiple user accounts;
- a second set of processors to execute a second set of instructions, the second set of processors including a secure processor, the secure processor to receive a first encrypted key from a processor in the first set of processors and decrypt a volume encryption key via a key encryption key derived from the first encrypted key, the first encrypted key derived and encrypted via the secure processor without user-provided entropy and provided to the first operating system of the first set of processors by the secure processor;
- and
- a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.
Dependencies are inferred from the claim text.