Multi-user storage volume encryption via secure processor

1. A computing device comprising:

a first processor to execute a first operating system having one or more user accounts;

a second processor to execute a second operating system, the second processor to:

receive a first encrypted key from the first processor, the first encrypted key derived and encrypted via the second processor without user-provided entropy and transmitted to the first operating system on the first processor;

decrypt the first encrypted key into a decrypted first encryption key;

derive a key encryption key via the decrypted first encrypted key;

decrypt a volume encryption key via the key encryption key; and

a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.

2. The computing device as in claim 1 , wherein the volume encryption key is to be received from the second processor via an encrypted connection established via a secret key shared by the non-volatile memory controller and the second processor.

3. The computing device as in claim 1 , wherein the second processor is to derive one or more derived encryption keys based on the first encrypted key, the one or more derived encryption keys to decrypt the key encryption key.

4. The computing device as in claim 1 , the second processor including an entropy generator to generate first system entropy and derive the first encrypted key based on the first system entropy.

5. The computing device as in claim 4 , the first operating system to receive a request to transition storage encryption from system entropy encryption to user entropy encryption and, in response to the request, generate a set of keys based on user entropy derived from user credentials.

6. The computing device as in claim 5 , the first operating system to request the second operating system to cryptographically invalidate the first encrypted key.

7. The computing device as in claim 6 , the second operating system to cryptographically invalidate the first encryption key via the second processor.

8. The computing device as in claim 7 , wherein the second processor, to cryptographically invalidate the first encrypted key, is to generate a second system entropy and generate a second system key based on the second system entropy.

9. The computing device as in claim 8 , the second processor to generate the second system key based on the second system entropy and a root key, the root key generated via a root entropy and an at least quasi-unique identifier associated with the computing device.

10. The computing device as in claim 9 , wherein the at least quasi-unique identifier associated with the computing device is stored within the second processor.

11. A non-transitory machine-readable medium storing instructions to cause one or more processors to perform operations including:

first and second processor and first and second operating system;

generating, via a second operating system on a second processor, a volume encryption key within the second processor, the volume encryption key to enable access to data on a storage volume of a data processing system including the second processor and a first processor;

encrypting the volume encryption key within the second processor, the volume encryption key encrypted using a first encryption key;

generating first system entropy data within the second processor;

generating a second encryption key based on the first system entropy data, the second encryption key to enable access to the first encryption key; and

requesting a first operating system on the first processor to store an encrypted second encryption key within a storage device on the data processing system, the encrypted second encryption key to enable access to the volume encryption key by a user account without use of entropy associated with credentials of the user account.

12. The non-transitory machine-readable medium as in claim 11 , the operations additionally including encrypting the second encryption key within the second processor to generate the encrypted second encryption key.

13. The non-transitory machine-readable medium as in claim 12 , the operations additionally including encrypting the second encryption key within the second processor using a device specific key associated with the data processing system.

14. The non-transitory machine-readable medium as in claim 13 , wherein the device specific key is stored within the second processor.

15. The non-transitory machine-readable medium as in claim 11 , the operations additionally including:

receiving a request to enable user entropy based storage encryption;

invalidating the second encryption key;

generating a third encryption key based on one or more credentials of the user account; and

requesting storage of an encrypted third encryption key within the storage device on the data processing system, the encrypted third encryption key to enable access to the volume encryption key by the user account.

16. The non-transitory machine-readable medium as in claim 15 , the operations additionally including encrypting the encrypted third encryption key within the second processor using a device specific key associated with the data processing system, the device specific key stored within the second processor.

17. A data processing system comprising:

a first set of processors to execute a first set of instructions, the first set of instructions to cause the first set of processors to provide a first operating system, the first operating system having multiple user accounts;

a second set of processors to execute a second set of instructions, the second set of processors including a secure processor, the secure processor to receive a first encrypted key from a processor in the first set of processors and decrypt a volume encryption key via a key encryption key derived from the first encrypted key, the first encrypted key derived and encrypted via the secure processor without user-provided entropy and provided to the first operating system of the first set of processors by the secure processor; and

a non-volatile memory controller to access encrypted data within non-volatile memory using the volume encryption key.

18. The data processing system as in claim 17 , wherein the volume encryption key is to be received from the secure processor in the second set of processors via an encrypted connection established via a secret key shared by the non-volatile memory controller and the secure processor.

19. The data processing system as in claim 17 , wherein the secure processor is to derive one or more derived encryption keys based on the first encrypted key, the one or more derived encryption keys to decrypt the key encryption key.

20. The data processing system as in claim 19 , the secure processor including an entropy generator to generate first system entropy and derive the first encrypted key based on the first system entropy.