Abstract: A device and method for switching to an encrypted domain requiring authentication in an operating system which implements a plurality of secure domains. An intermediate domain different from the encrypted domain and a current domain is provided. Upon receiving a request to switch to the encrypted domain, the system switches to the intermediate domain. An authentication challenge for access to the encrypted domain is displayed in the intermediate domain. Receiving authentication information is used to decrypt filesystem keys for providing access to the encrypted filesystem. The encrypted filesystem is then mounted, and the encrypted domain started.