Devices and methods of managing data
Devices and methods of managing data stored within a container. The container may be associated with at least one registered user. The data within the container may be encrypted by a data encryption key (DEK). A computing device includes: a security module including a crypto-processor, a main processor, and memory. The memory stores instructions that, when executed, configure a processor to: authenticate a user based on a user secret associated with the container and generate a soft key based on the user secret. The instructions cause a crypto-processor to generate a secure generator output including a crypto key component and generate a hardened user key based on a key agreement protocol using the soft key and the crypto key component. The instructions cause a processor to construct an unencrypted DEK associated with the hardened user key and decrypt the subset of data using the unencrypted DEK.
1. A method of managing data stored within a container on a computing device, the container being associated with at least one registered user, the data within the container being encrypted by a data encryption key (DEK) and stored as encrypted data, the method comprising:
authenticating a user based on a user secret associated with the container;
generating a soft key based on the user secret;
generating, by a crypto-processor other than a main processor of the computing device, secure generator output including a crypto key component associated with the authenticated user;
generating, by the crypto-processor, a hardened user key based on a key agreement protocol using the soft key and the crypto key component associated with the authenticated user;
constructing an unencrypted DEK associated with the hardened user key for accessing a subset of the data stored within the container; and
decrypting the subset of the data using the unencrypted DEK.
2. The method of claim 1 , wherein the secure generator output includes a first elliptic curve cryptography (ECC) key pair and a second ECC key pair.
3. The method of claim 2 , further comprising:
discarding, by the crypto-processor, a public key of the first ECC key pair and a private key of the second ECC key pair, and wherein the crypto key component includes the private key of the first ECC key pair and the public key of the second ECC key pair.
4. The method of claim 1 , wherein the key agreement protocol is based on elliptic curve cryptography.
5. The method of claim 1 , wherein the key agreement protocol includes Elliptic-Curve Diffie-Hellman (ECDH).
6. The method of claim 1 , wherein the soft key includes a specified length and is generated using Password-Based Key Derivation Function 2 (PBKDF2).
7. The method of claim 6 , wherein the PBKDF2 operations include Hash-based Message Authentication Code (HMAC) operations.
8. The method of claim 1 , wherein constructing the unencrypted DEK includes decrypting a hardened DEK using an Advanced Encryption Standard (AES) protocol and the hardened user key, wherein the hardened DEK is stored in an un-migratable portion of the computing device.
9. The method of claim 1 , further comprising securing additional data associated with the authenticated user using the unencrypted DEK.
10. The method of claim 1 , wherein the secure generator output is based on a secure random number generator output.
11. A computing device managing data stored within a container, the container being associated with at least one registered user, the data within the container being encrypted by a data encryption key (DEK) and stored as encrypted data, the computing device comprising:
a security module including a crypto-processor;
a main processor coupled to the security module; and
a memory coupled to the processor and the crypto-processor, the memory storing instructions that, when executed, configure at least one of the main processor or the crypto-processor to:
authenticate a user based on a user secret associated with the container;
generate a soft key based on the user secret;
generate, by the crypto-processor, secure generator output including a crypto key component associated with the authenticated user;
generate, by the crypto-processor, a hardened user key based on a key agreement protocol using the soft key and the crypto key component associated with the authenticated user;
construct an unencrypted DEK associated with the hardened user key for accessing a subset of the data stored within the container; and
decrypt the subset of the data using the unencrypted DEK.
12. The computing device of claim 11 , wherein the secure generator output includes a first elliptic curve cryptography (ECC) key pair and a second ECC key pair.
13. The computing device of claim 12 , wherein the instructions, when executed, further configure the crypto-processor to discard a public key of the first ECC key pair and a private key of the second ECC key pair, and wherein the crypto key component includes the private key of the first ECC key pair and the public key of the second ECC key pair.
14. The computing device of claim 11 , wherein the key agreement protocol is based on elliptic curve cryptography.
15. The computing device of claim 11 , wherein the key agreement protocol includes Elliptic-Curve Diffie-Hellman (ECDH).
16. The computing device of claim 11 , wherein the soft key includes a specific length and is generated using Password-Based Key Derivation Function 2 (PBKDF2).
17. The computing device of claim 11 , wherein constructing the unencrypted DEK includes decrypting a hardened DEK using an Advanced Encryption Standard (AES) protocol and the hardened user key, wherein the hardened DEK is stored in an un-migratable portion of the computing device.
18. The computing device of claim 11 , wherein the instructions, when executed, further configure the main processor to secure additional data associated with the authenticated user using the unencrypted DEK.
19. The computing device of claim 11 , wherein the secure generator output is based on a secure random number generator output.
20. A non-transitory computer-readable storage medium storing instructions for managing data stored within a container, the container being associated with at least one registered user, the data within the container being encrypted by a data encryption key (DEK) and stored as encrypted data, the instructions, when executed by at least one of a main processor or a crypto-processor of a computing device, cause the computing device to:
authenticate a user based on a user secret associated with the container;
generate a soft key based on the user secret;
generate, by the crypto-processor, secure generator output including a crypto key component associated with the authenticated user;
generate, by the crypto-processor, a hardened user key based on a key agreement protocol using the soft key and the crypto key component associated with the authenticated user;
construct an unencrypted DEK associated with the hardened user key for accessing a subset of the data stored within the container; and
decrypt the subset of the data using the unencrypted DEK.