System and method for key wrapping to allow secure access to media by multiple authorities with modifiable permissions

A non-transitory computer-readable medium having computer-executable instructions for performing a method for key wrapping via a storage system to allow secure access to media of the system by multiple authorities with modifiable permissions, the method comprising:

• establishing access to the system for a first administrator, wherein establishing access to the system for the first administrator includes:
• based on a first input received by the system, randomly generating a global administrator key;
• wrapping a first copy of the global administrator key with a first set of credentials associated with the first administrator to provide a wrapped first copy of the global administrator key;
• storing the wrapped first copy of the global administrator key in a drive of the system;
• randomly generating a plurality of range keys, the plurality of range keys being associated with ranges of logical block addresses of the drive;
• randomly generating a plurality of range key encrypting keys, the plurality of range encrypting keys corresponding to the plurality of range keys;
• wrapping first copies of the plurality of range keys with first copies of the plurality of range key encrypting keys and storing the wrapped first copies of the plurality of range keys on the drive;
• and wrapping second copies of the plurality of range key encrypting keys with a second copy of the global administrator key and storing the wrapped second copies of the plurality of range key encrypting keys on the drive.

A storage system, comprising:

• a controller, the controller including a processor, a network interface and a memory;
• a non-volatile memory, the non-volatile memory being connected to the controller;
• and
• control programming for performing a method for key wrapping for promoting secure access to media of the storage system by multiple authorities with modifiable permissions, the method including:
• establishing access to the system for a first administrator, wherein establishing access to the system for the first administrator includes:
• based on a first input received by the system, randomly generating a global administrator key;
• wrapping a first copy of the global administrator key with a first set of credentials associated with the first administrator to provide a wrapped first copy of the global administrator key;
• storing the wrapped first copy of the global administrator key in the non-volatile memory of the system;
• randomly generating a plurality of range keys, the plurality of range keys being associated with ranges of logical block addresses of the non-volatile memory;
• randomly generating a plurality of range key encrypting keys, the plurality of range encrypting keys corresponding to the plurality of range keys;
• wrapping first copies of the plurality of range keys with first copies of the plurality of range key encrypting keys and storing the wrapped first copies of the plurality of range keys on the non-volatile memory;
• and wrapping second copies of the plurality of range key encrypting keys with a second copy of the global administrator key and storing the wrapped second copies of the plurality of range key encrypting keys on the non-volatile memory.