Virtualized protected storage

A method of operating an electronic circuit comprising:

• combining a master secret key with a plurality of key modifiers comprising at least an operating system tag specific to an operating system;
• deriving an encryption key from the combined master secret key and plurality of key modifiers;
• encrypting data using the encryption key;
• and
• generating a cryptographic binary large object (blob) that is tagged with a security state of the electronic circuit and the operating system tag for virtualized protected storage that is accessible only to the operating system specified by the operating system tag.

A virtualized protected storage system comprising:

• at least one memory management unit;
• a plurality of interface portals;
• a control operating system that runs a plurality of operating systems, and programs the at least one memory management unit for operating system separation and allocates ones of the plurality of interface portals respectively to ones of the plurality of operating systems;
• and
• a cryptographic circuit comprising:
• a key derivation function that combines a master secret key with a plurality of key modifiers comprising at least an operating system tag specific to an operating system, and derives an encryption key from the combined master secret key and plurality of key modifiers;
• and
• encryption logic coupled to the key derivation function that encrypts data using the derived encryption key to generate a cryptographic binary large object (blob) that is tagged with a security state of the electronic circuit and the operating system tag and that is accessible only to the operating system specified by the operating system tag.