Cryptographic separation of users

1. A computing device, comprising:

a secure circuit configured to:

maintain key bags for a plurality of users, wherein each key bag is associated with a respective one of the plurality of users and includes a first set of keys usable to decrypt a second set of encrypted keys for decrypting data associated with the respective user;

receive, from a processor, an indication that an encrypted file of a first of the plurality of users is to be accessed;

use a key in a key bag associated with the first user to decrypt an encrypted key of the second set of encrypted keys; and

convey the decrypted key to a memory controller configured to decrypt the encrypted file with the decrypted key in response to the memory controller retrieving the file from a memory.

2. The computing device of claim 1 , wherein the secure circuit is configured to cause the memory to store data of the first user in a manner that is cryptographically isolated from others of the plurality of users; and

wherein the memory is a non-volatile memory.

3. The computing device of claim 1 , wherein the secure circuit is configured to:

prior to conveying the decrypted key, encrypt the decrypted key with a shared key known to the memory controller.

4. The computing device of claim 1 , further comprising:

the memory controller, wherein the memory controller is configured to:

receive a request to write data of another file to the memory;

encrypt the data with another encryption key of the second set; and

store the other encryption key with the encrypted data in the memory.

5. The computing device of claim 4 , wherein the memory controller is configured to store a respective encryption key of the second set for each file of the first user stored in the memory.

6. The computing device of claim 1 , wherein the secure circuit is configured to:

encrypt the key bag associated with the first user with an encryption key derived from a credential supplied by the first user; and

send the encrypted key bag to the memory controller for storage in the memory.

7. The computing device of claim 6 , wherein the credential is a passcode supplied by the first user.

8. The computing device of claim 6 , wherein the secure circuit is configured to:

store a unique identifier indicative of the computing device; and

derive the encryption key used to encrypt the key based on the supplied credential and the stored unique identifier.

9. The computing device of claim 6 , wherein the secure circuit is configured to:

retrieve the encrypted key bag from the memory in response to a restart of the computing device;

receive the credential from the first user; and

decrypt the encrypted key bag using an encryption key derived from the received credential.

10. The computing device of claim 1 , further comprising:

a biosensor configured to collect biometric information from the first user; and

wherein the secure circuit is configured to decrypt the encrypted key of the second set in response to the collected biometric information matching biometric information of the first user.

11. The computing device of claim 1 , wherein the secure circuit is configured to communicate with the memory controller via a mailbox mechanism configured to isolate a processor of the secure circuit from being accessed by circuitry external to the secure circuit.

12. A computing device, comprising:

a processor;

a memory controller configured to store encrypted data for a plurality of users in a memory such that data of a first of the plurality of users is cryptographically isolated from a second of the plurality of users; and

a secure circuit configured to:

maintain a plurality of key bags, wherein each key bag is a collection of keys associated with a respective one of the plurality of users and is usable, by the memory controller, to decrypt the encrypted data of the respective user;

derive, in response to a request from the processor, an encryption key for the key bag of the first user based on credential information supplied by the first user;

encrypt the key bag of the first user with the derived encryption key;

receive a request to decrypt an encrypted key used to encrypt a file of the first user;

decrypt the encrypted key with a key from the key bag of the first user; and

provide the decrypted key to the memory controller, wherein the memory controller is configured to decrypt the file with the provided key.

13. The computing device of claim 12 , wherein the secure circuit is configured to send the encrypted key bag to the memory controller to cause the memory controller to store the encrypted key bag in the memory.

14. The computing device of claim 12 , further comprising:

a biosensor configured to:

collect biometric information from a user of the computing device; and

provide a token to the secure circuit in response to the biometric information matching biometric information of the first user, wherein the secure circuit is configured to use the token to obtain the encryption key for the key bag of the first user.

15. The computing device of claim 12 , wherein the secure circuit is isolated from access by the memory controller except through a mailbox mechanism included in the secure circuit.

16. A computing device, comprising:

a direct memory access (DMA) controller configured to communicate data associated with a plurality of users over a system bus and from a memory configured to store the data;

a processor configured to operate on the communicated data; and

a secure circuit configured to:

store a set of keys associated with a first of the plurality of users;

receive a request from the processor to decrypt an encryption key used to encrypt a file of the first user in the memory;

use a key in the set of keys to decrypt the encryption key used to encrypt the file; and

provide the decrypted encryption key to the DMA controller, wherein the DMA controller is configured to decrypt the file with the provided encryption key.

17. The computing device of claim 16 , wherein the secure circuit is configured to:

encrypt the set of keys with an encryption key derived from a credential provided by the first user; and

request that the DMA controller provide the encrypted set of keys to a memory configured to store the encrypted set of keys.

18. The computing device of claim 17 , further comprising:

a touch screen configured to:

receive a passcode from the first user; and

provide the passcode to the secure circuit as the credential.

19. The computing device of claim 16 , wherein the secure circuit is isolated from access by the processor except through a mailbox mechanism accessible by an application programming interface (API).