Patent ID: 8891773

Claim:
A method for key wrapping via a storage system to allow secure access to media of the system by multiple authorities with modifiable permissions, the method comprising: establishing access to the system for a first administrator, wherein establishing access to the system for the first administrator includes: based on a first input received by the system, randomly generating a global administrator key; wrapping a first copy of the global administrator key with a first set of credentials associated with the first administrator to provide a wrapped first copy of the global administrator key; storing the wrapped first copy of the global administrator key in a drive of the system; randomly generating a plurality of range keys, the plurality of range keys being associated with ranges of logical block addresses of the drive; randomly generating a plurality of range key encrypting keys, the plurality of range encrypting keys corresponding to the plurality of range keys; wrapping first copies of the plurality of range keys with first copies of the plurality of range key encrypting keys and storing the wrapped first copies of the plurality of range keys on the drive; and wrapping second copies of the plurality of range key encrypting keys with a second copy of the global administrator key and storing the wrapped second copies of the plurality of range key encrypting keys on the drive; establishing access to the system for a non-administrator user, including: randomly generating a user key, wrapping a first copy of the user key with the first copy of the global administrator key and storing the wrapped first copy of the user key on the drive; wrapping a second copy of the user key with a first set of credentials associated with the user and storing the wrapped second copy of the user key on the drive; and wrapping a third copy of the user key with a subset of the first copies of the range key encrypting keys; and granting user permissions by the first administrator to the user for a user-requested range of the drive, including: unwrapping the first copy of the global administrator key via the first set of credentials associated with the first administrator; accessing a selected range key encrypting key included in the plurality of first copies of range key encrypting keys via the first copy of the global administrator key, the selected range key encrypting key being associated with the user-requested range of the drive; unwrapping the wrapped first copy of the user key, via the first copy of the global administrator key; wrapping the selected range key encrypting key with a fourth copy of the user key and storing the wrapped selected range key encrypting key on the drive.