Computer system, storage system and management computer for backing up and restore encryption key for storage system incorporating therein a stored data encryption function

To protect data from corruption due to restoration of an encryption key to a wrong storage system, there is provided a computer system including a first storage system and a second storage system, wherein: the first storage system, upon receiving a request to write first data to a first area in the first storage system, encrypts the first data by using a first key and writes the first data in the first area, and, upon receiving a request to write second data to a third area, encrypts the second data by using a second key and transmits a request to write the encrypted second data in a second area in the second storage system; and the computer system holds the first key, an identifier of the first storage system associated with the first key, the second key, and an identifier of the second storage system associated with the second key.

CLAIM OF PRIORITY

The present application claims priority from Japanese application JP2007-266665 filed on Oct. 12, 2007, the content of which is hereby incorporated by reference into this application.

BACKGROUND

A technology disclosed herein relates to a computer system including a storage apparatus for storing data to be used by a computer. In particular, a technology disclosed herein relates to a technology applicable to a storage apparatus having a function of encrypting data to be stored in a storage medium and decrypting data read from the storage medium, for performing backup and restoration of an encryption key to be used for the encryption and the decryption of data.

In recent years, along with a proliferation of a storage area network (SAN), in which a storage apparatus, a computer, and a management computer are coupled to one another via a dedicated line such as Fibre Channel, a computer system has been increased in size, and there has been developed a technology of efficiently managing ever-increasing enormous amount of data in the computer system described above.

For example, JP 2005-11277 A discloses a storage virtualization technology. According to this technology, a first storage apparatus is coupled to at least one second storage apparatus, and a storage area in the second storage apparatus is provided, as a storage area of the first storage apparatus, to a computer.

According to the technology disclosed in JP 2005-11277 A, the storage area of the second storage apparatus is managed by the first storage apparatus in a unified manner, to thereby reduce a management cost of the computer system.

Also, along with an increase of information leaks due to disk theft or the like in recent years, there is a growing interest in storing and managing data with ensured security. For example, JP 2007-28502 A discloses a storage apparatus which includes an encryption function for encrypting a storage area, and is capable of encrypting data to be read from or written to the storage area.

According to the technology disclosed in JP 2007-28502 A, even in a case where a disk is stolen or the like, data leakage can be prevented.

In the storage apparatus having an encryption function as described above, the management of the encryption key is important. For example, a loss of the encryption key due to a failure in the storage apparatus or an operational error of a user makes it impossible for the storage apparatus to decrypt data in an encrypted storage area. In order to deal with this situation, the encryption keys may be backed up outside or inside of the storage apparatus, and in a case where the encryption key is lost, the encryption keys thus backed up may be restored to the storage apparatus.

However, in restoring encryption keys, the following things need to be taken into consideration. Of the backed-up encryption keys, when an incorrect encryption key is restored to the storage apparatus to read or write data, the data is corrupted. For this reason, it is important to prevent an improper restoration of an encryption key, that is, to verify whether or not a right encryption key is actually restored to the storage apparatus.

JP 2007-148762 A discloses a conventional technology related to the above-mentioned verification. According to JP 2007-148762 A, data in an external storage medium such as a USB memory is allowed to be used when a connection destination of the storage medium is an authorized computer, while the data is not allowed to be used when the connection destination is an unauthorized computer.

According to the technology disclosed in JP 2007-148762 A for determining whether data is allowed to be used or not based on a use destination of the data, for example, in the case of restoring an encryption key in a storage apparatus having an encryption function, the restoration of the encryption key is permitted when the encryption key is of the own apparatus and the restoration is rejected when the encryption key is of any other storage apparatus than the own apparatus, to thereby determine whether or not to restore the encryption key.

SUMMARY

According to JP 2007-148762 A, in a case where an administrator has registered an incorrect use destination of the data, it is not possible to prevent the improper restoration of an encryption key. Accordingly, it is necessary to provide a storage apparatus side, to which an encryption key is restored, with a mechanism for preventing the improper restoration of an encryption key.

Further, according to a storage apparatus having a virtualization function, there arise following problems. In this case, there is taken, as an example, a computer system having a hierarchical structure, in which a first storage apparatus virtualizes a storage area of a second storage apparatus. The first storage apparatus has an encryption key for each storage apparatus or each storage area, and encrypts the storage area of the own apparatus by using an encryption key for the own apparatus. Further, the first storage apparatus encrypts a storage area of the second storage apparatus by using an encryption key for the second storage apparatus. When a storage area is encrypted, data stored (and to be stored) in the storage area is encrypted.

In this example, when the first storage apparatus fails, a connection destination of the second storage apparatus may be switched from the first storage apparatus to a third storage apparatus, and the third storage apparatus may decrypt data in an encrypted storage area of the second storage apparatus. In this case, it is necessary to restore an encryption key that has been used in the first storage apparatus, to the third storage apparatus. However, in a case where the third storage apparatus already has an own encryption key (that is, an encryption key to be used for a storage area of the third storage apparatus) set thereto, when the encryption key backed up from the first storage apparatus is restored to the third storage apparatus, the own encryption key of the third storage apparatus is overwritten with the encryption key of the first storage apparatus (that is, an encryption key to be used for a storage area in the first storage apparatus). As a result, data which has been read from the storage area of the third storage apparatus is decrypted by the encryption key that has been used in the first storage apparatus, with the result that the data thus decrypted is corrupted.

In order to protect data from the above-mentioned corruption, it may be prohibited to restore any other encryption key than the encryption key backed up in the own storage apparatus. In this case, however, in the computer system having the hierarchical structure as described above, when the first storage apparatus fails, it is not possible to decrypt data in an encrypted storage area of the virtualized second storage apparatus.

In view of the above-mentioned problems, this invention has been made, and it is therefore an object of this invention to provide a computer system having the hierarchical function as described above, which is capable of correctly restoring, in a case where the first storage apparatus has failed, an encryption key that has been backed up, to thereby decrypt data in an encrypted storage area of the second storage apparatus without corrupting the data.

According to a representative invention disclosed in this application, there is provided a computer system comprising: a plurality of computers; a plurality of storage systems; and a network coupled to at least one of the plurality of computers and the plurality of storage systems, wherein: the plurality of computers include a first computer and a second computer; the plurality of computers each comprise a first interface coupled to the network, a first processor coupled to the first interface, and a first memory coupled to the first processor; the plurality of storage systems include a first storage system and a second storage system; the plurality of storage systems each comprise a second interface coupled to the network, a second processor coupled to the second interface, and a second memory coupled to the second processor; the first storage system comprises a first storage area for storing data written by the second computer; the second storage system comprises a second storage area for storing data written by the second computer; the first storage system is configured to: encrypt, when a request to write first data in the first storage area is received from the second computer, the first data by using a first encryption key held by the first storage system, and write the encrypted first data in the first storage area; and encrypt, when a request to write second data in a third storage area is received from the second computer, the second data by using a second encryption key held by the first storage system, and transmit, to the second storage system, a request to write the encrypted second data in the second storage area; the computer system holds backup information including encryption keys and identifiers of the plurality of storage systems associated with the encryption keys; and the backup information includes at least the first encryption key, an identifier of the first storage system associated with the first encryption key, the second encryption key, and an identifier of the second storage system associated with the second encryption key.

According to an embodiment of this invention, even when a storage apparatus having a virtualization function fails, it is possible to correctly restore an encryption key to another storage apparatus having a virtualization function. As a result, it is possible to decrypt data in an encrypted storage area without corrupting the data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Hereinbelow, first, second, and third embodiments of this invention will be described. The embodiments to be described below are merely examples, and this invention is not limited thereto.

The first embodiment will be described with reference toFIGS. 1 to 17.

FIG. 1is a block diagram illustrating a hardware configuration of a computer system according to the first embodiment of this invention.

The computer system includes at least one computer100, a fibre channel switch (hereinafter, referred to as FC switch)110, storage apparatuses120A and120B (hereinafter, also collectively referred to as storage apparatus120), at least one virtual destination storage apparatus130, and a management computer140.

The computer100, the storage apparatus120, and the virtual destination storage apparatus130are each coupled, through FC interfaces (hereinafter, each referred to as FC I/F)103,121, and131, respectively, to the FC switch110. The FC switch110, the storage apparatus120, and the virtual destination storage apparatus130are each coupled, through management I/Fs111,126, and136, respectively, to the management computer140via an IP network, and managed by the management computer140.

The computer100includes a CPU101and a memory102coupled to the CPU101. The memory102stores programs to be executed by the CPU101and data to be read and written by the storage apparatus120. The computer100further includes at least one FC I/F103coupled to the FC switch110, and at least one management I/F104coupled to the management computer140via the IP network. Each FC I/F103and each management I/F104are coupled to the CPU101.

The storage apparatus120includes at least one FC I/F121coupled to the FC switch110, at least one CPU122, at least one cache memory123, at least one control memory124, at least one storage area125, and at least one management I/F126. Those units are coupled to one another through, for example, an internal bus.

The FC I/F121includes at least one port, which is not shown, coupled to the FC switch110.

The CPU122of the storage apparatus120receives a data read/write request from the computer100through the FC I/F121, and reads or writes the requested data in the storage area125. The storage area125is a logical device managed by the CPU122in association with a physical device such as a disk drive of the storage apparatus120. The computer100recognizes the storage area125, and requests the storage apparatus120to read or write data in the storage area125.

The storage apparatus120can virtualize a storage area135of each virtual destination storage apparatus130as the storage area125of the own storage apparatus120.

In a case where the storage area135is not virtualized as the storage area125by the storage apparatus120, the storage area125is associated with a physical storage area (for example, a storage area of a hard disk drive, which is not shown) in the storage apparatus120. In this case, upon receiving a data read/write request from the computer100with respect to the storage area125, the storage apparatus120executes data write or data read with respect to a physical storage area that is associated with the storage area125in the storage apparatus120, and returns the result of the data write or data read as a response to the computer100.

On the other hand, in the case where the storage area135is virtualized as the storage area125by the storage apparatus120, the storage area125is associated with the storage area135of the virtual destination storage apparatus130, instead of being associated with the physical storage area in the storage apparatus120. In this case, upon receiving a data read/write request from the computer100with respect to the storage area125, the storage apparatus120converts the received request into a data read/write request with respect to the storage area135, and transmits the request thus converted, to the virtual destination storage apparatus130.

According to the request received from the storage apparatus120, the virtual destination storage apparatus130executes data read or data write with respect to the physical storage area in the virtual destination storage apparatus130, the physical storage area being associated with the storage area135, and returns the result of the data read or data write as a response to the storage apparatus120. Upon receiving the response from the virtual destination storage apparatus130, the storage apparatus120converts the response into a response from the storage apparatus120, and transmits the response thus converted to the computer100.

In the case where the storage area135is virtualized by the storage apparatus120as described above, the storage area135is also referred to as a virtual destination storage area (or virtual destination LU). On the other hand, the storage area125virtualizing the storage area135is also referred to as a virtual storage area (or virtual LU). Meanwhile, when the storage area125is associated with the physical storage area in the storage apparatus120, the storage area125is also referred to as a real storage area (or real LU).

The example ofFIG. 1includes only one storage area125and only one storage area135. However, the storage apparatus120and the virtual destination storage apparatus130each may include a plurality of the storage areas125and a plurality of the storage areas135, respectively. In this case, for example, at least one of the plurality of storage areas125may be the real storage area125, and the rest of the storage areas125may be the virtual storage areas125virtualizing the storage areas135.

Also, the CPU122of the storage apparatus120receives an operation management manipulation request with respect to the storage apparatus120, from the management computer140through the management I/F126, and executes the requested management manipulation. The CPU122transmits the result of the management manipulation, configuration information on the storage apparatus120, or the like, to the management computer140.

The cache memory123stores data received from the computer100and data frequently read from the storage area125.

The control memory124stores configuration information of the storage area125, attributes of the storage area125(for example, information as to whether the storage area125is encrypted or in plain text), and information on an encryption key or the like. Hereinafter, a state where the storage area125or the like is encrypted is also referred to as “encryption On”, and a state where the storage area125or the like is not encrypted (that is, plain text data is stored) is also referred to as “encryption Off.”

The storage apparatus120has a data encryption/decryption function. In other words, the storage apparatus120, upon receiving a data write request with respect to the encrypted storage area, can encrypt the requested data and writes the data in the storage area. Then, when the storage apparatus120receives a data read request with respect to the encrypted storage area, from the computer100, the storage apparatus120reads the requested data, decrypts the data thus read, and returns the decrypted data as a response to the computer100.

The virtual destination storage apparatus130includes at least one FC I/F131coupled to the FC switch110, at least one CPU132, at least one cache memory133, at least one control memory134, at least one storage area135, and at least one management I/F136. Those units are coupled to one another through, for example, an internal bus.

The CPU132of the storage apparatus130receives a data read/write request from the computer100or from the storage apparatus120through the FC I/F131, and reads or writes the requested data in the storage area135. Also, the CPU132receives an operation management manipulation request with respect to the virtual destination storage apparatus130, from the management computer140through the management I/F136, and executes the requested management manipulation.

The virtual destination storage apparatus130is not limited to the one illustrated inFIG. 1, and may include, for example, a storage apparatus different in function, performance, or configuration, such as a storage apparatus which has a data encryption/decryption function and a storage apparatus which does not have a data encryption/decryption function.

The management computer140includes a CPU141, a memory142, and a management I/F143. The management I/F143is coupled to the computer100and the FC switch110via the IP network.

The management computer140, when activated, loads programs for managing storage apparatuses and computers, into the memory142. The programs are stored in a non-volatile medium, such as a hard disk drive which is not shown, in the management computer140. The CPU141executes the programs thus loaded, to thereby obtain configuration information on the storage apparatus120and on the virtual destination storage apparatus130, detect a failure occurring in the storage apparatuses, and monitor the performance of the storage apparatuses. The management computer140enables an administrator to perform operation management of the computer system as a whole.

It should be noted that the above-mentioned programs may be stored in any other storage medium (such as a CD-ROM or a floppy disk) than the hard disk drive. The above-mentioned programs may be loaded from the storage medium into the management computer140to be executed, or may be loaded from further another storage medium via a network.

Next, software configurations of the storage apparatus120, the virtual destination storage apparatus130, and the management computer140according to this embodiment will be described.

FIG. 2is an explanatory diagram illustrating examples of the software configurations in the computer system according to the first embodiment of this invention.

The control memory124of the storage apparatus120stores configuration information for performing configuration management on the storage apparatus120, encryption key management information, and program information including a program for data read/write and a program for making encryption settings. The configuration information includes an identifier and a capacity of the storage area125. First, the configuration information will be described. After that, the encryption key management program and the program information will be described.

The control memory124stores, as the configuration information, storage area (hereinafter, also referred to as LU: Logical Unit) management information201, virtual LU mapping information202, storage apparatus model/production number management information203, and encryption key management information204.

First, the LU management information201will be described.

FIG. 3is an explanatory diagram illustrating an example of the LU management information201according to the first embodiment of this invention.

The LU management information201includes seven data items including items301to307.

The item301stores a port number of each storage apparatus120. The port number has a uniquely-identifiable value, and is allocated to each port, which is not shown, provided to the FC I/F121of each storage apparatus120. The storage apparatus120can define an LU for each port. The computer100accesses the LU through the port thus defined. Each storage apparatus120may include a plurality of the ports.

The item302stores an LU number for identifying the storage area (LU)125or135. The LU number can be defined for each port. The computer100designates an access destination by using the port number and the LU number.

The item303stores a capacity of each LU.

The item304stores identification information for identifying each computer100that is allowed to access each LU. The item304stores, for example, a value such as a world wide name (WWN) allocated to a port of each computer100that is allowed to access the LU.

The item305stores information indicating whether each LU is an LU that uses the physical device in the storage apparatus120(that is, a real LU) or an LU that is created by virtualizing an LU in the virtual destination storage apparatus130(that is, a virtual LU).

The item306stores information indicating encryption On/Off of each LU. When a certain LU is encrypted, “On” is stored in the item306of each entry corresponding to the LU. When the LU is not encrypted, “Off” is stored in the item306.

The item307stores a key ID corresponding to each LU. The key ID is for identifying, when encrypting a certain LU, an encryption key to be used for the encryption, and has a value for uniquely identifying each encryption key in each storage apparatus120. When the LU is not encrypted, no value is defined in the item307.

The key ID is synonymous with a key ID601which will be described later. Detailed information on an encryption key can be obtained based on the key ID.

Next, the virtual LU mapping information202will be described.

FIG. 4is an explanatory diagram illustrating an example of the virtual LU mapping information202according to the first embodiment of this invention.

The virtual LU mapping information202includes five data items including items401to405.

The item401stores a port number of each storage apparatus120.

The item402stores an LU number of each virtual LU defined in each port of each storage apparatus120.

The item403stores a virtual destination storage apparatus model/production number for uniquely identifying each virtual destination storage apparatus130.

The item404stores a port number of each virtual destination storage apparatus130which is associated with each virtual LU in each storage apparatus120. The storage apparatus120designates the port number and the LU number of an LU virtualized by the storage apparatus120, to thereby access the LU in the virtual destination storage apparatus130.

The item405stores an LU number in the virtual destination storage apparatus for identifying each LU in the virtual destination storage apparatus130, which has been virtualized by each storage apparatus120. The LU number corresponds to an LU number defined in the virtual destination storage apparatus130.

Next, the storage apparatus model/production number management information203will be described.

FIG. 5is an explanatory diagram illustrating an example of the storage apparatus model/production number management information203according to the first embodiment of this invention.

The storage apparatus model/production number management information203includes four data items including items501to504.

The item501stores an apparatus model/production number of each storage apparatus120.

The item502stores an IP address or a host name for identifying each storage apparatus120, which is set to the management I/F126of each storage apparatus120.

The item503stores information indicating an operation mode of each storage apparatus120. Under normal conditions, a normal mode is set to the item503. When a system option mode, which will be described later, is set, “system option mode” is set to the item503.

The item504stores an apparatus model/production number of each virtual destination storage apparatus130which includes an LU virtualized by each storage apparatus120. When the computer system includes at least one storage apparatus120and at least one virtual destination storage apparatus130, each one of the storage apparatuses120and the virtual destination storage apparatuses130can be uniquely identified by the apparatus model/production number.

The storage apparatus120manages the above-mentioned three kinds of information as the configuration information, and uses the information for performing configuration management on the storage apparatus120. Further, the configuration information may include any other information than the above, such as information indicating a status of each LU (copy status or the like).

Next, the encryption key management information204of the storage apparatus120will be described.

FIG. 6is an explanatory diagram illustrating an example of the encryption key management information204according to the first embodiment of this invention.

The encryption key management information204includes seven data items including items601to607.

The item601stores a key ID which is used for identifying each encryption key in each storage apparatus120.

The item602stores data on each encryption key (that is, a data string used as an encryption key).

The item603stores a value indicating a length of each encryption key.

The item604stores algorithmic information indicating which encryption algorithm or mode is used by each encryption key. For example, when data is encrypted in ECB mode of AES, “AES-ECB” is stored in the item604.

The item605stores information indicating an application destination apparatus to which each encryption key is applied. For example, when the encryption key is used for encrypting a real LU in a storage apparatus120, a value indicating that the encryption key is for an own apparatus (“own” in the example ofFIG. 6) is stored in the item605corresponding to the encryption key. On the other hand, the encryption key is used for encrypting a virtual destination LU in a virtual destination storage apparatus130, a value indicating that the encryption key is for a virtual destination storage apparatus (“virtual destination” in the example ofFIG. 6) is stored in the item605corresponding to the encryption key.

The item606stores an apparatus model/production number of each virtual destination storage apparatus130.

The item607stores information indicating an application range of the encryption key. For example, a certain encryption key is used for encrypting all the LUs135which are set to “encryption On” in a certain storage apparatus120or a certain virtual destination storage apparatus130, “apparatus” is stored in the item607of an entry corresponding to the encryption key and the storage apparatus. On the other hand, when a certain encryption key is used for encrypting one LU, the LU number of the LU to which the encryption key is applied is stored in the item607corresponding to the encryption key.

In this embodiment, a description is given mainly of a case where an encryption key to be used for the LUs125in the storage apparatus120is different from an encryption key to be used for the LUs135in the virtual destination storage apparatus130. The reason for using different encryption keys for different storage apparatuses is as follows. When the same encryption key is used for all the storage apparatuses, in a case where the encryption key has leaked out from one of the storage apparatuses, the encryption keys for the other storage apparatuses are also made to be known, which is not preferable in terms of security. However, this invention is not limited to the above-mentioned embodiment, and this embodiment can also be applied to a case where the same encryption key is used for all storage apparatuses.

Next, program information of the storage apparatus120will be described. As illustrated inFIG. 2, the program information of the storage apparatus120includes five programs including: an I/O processing program205; an encryption setting program206; an encryption key/encryption setting information backup program207; an encryption key/encryption setting information restoration program208; and a storage management program209. Those programs are executed by the CPU122. Accordingly, in the following description, the processes to be executed by those programs are actually executed by the CPU122.

The I/O processing program205is executed in response to an instruction from the computer100. On the other hand, the other four programs are executed in response to an instruction from an administrator using the management computer140.

Upon receiving a data read/write request from the computer100, the I/O processing program205reads or writes data with respect to a storage area of the storage apparatus120or of the virtual destination storage apparatus130.

The encryption setting program206makes encryption settings in a storage area of the storage apparatus120or of the virtual destination storage apparatus130. For example, when the encryption setting of a storage area is set to be On, an encryption key is set for the storage area. After that, by using the encryption key, the I/O processing program encrypts data from the computer100and writes the encrypted data in the storage area, and decrypts data read from the storage area.

The encryption key/encryption setting information backup program207backs up an encryption key and configuration information (specifically, information held as the LU management information201, the virtual LU mapping information202, and the encryption key management information204) held by the storage apparatus120, to the management computer140. In the following description, the information is also referred to as encryption key/encryption setting information.

The encryption key/encryption setting information restoration program208determines whether it is possible or not to restore a backup file received from the management computer140, to the storage apparatus120, and permits or prohibits the restoration.

The storage management program209executes other functions provided to the storage apparatus120, including a function of setting a path between the storage apparatus120and the computer100, and a function of copying the storage area. Described above is the software configuration of the storage apparatus120.

Next, the software configuration of the virtual destination storage apparatus130will be described.

The control memory134of the virtual destination storage apparatus130stores LU management information221, which is similar to the LU management information201of the storage apparatus120. The LU management information221manages information on the LU number, the capacity, and an accessible computer in the virtual storage apparatus130.

Further, the control memory134stores, as program information, an I/O processing program223and a storage management program224. Those programs are executed by the CPU132. Accordingly, in the following description, the processes to be executed by those programs are actually executed by the CPU132.

The I/O processing program223processes a data read/write request from the computer100or from the storage apparatus120. According to an instruction received from the management computer140, the storage management program224executes a function in the virtual destination storage apparatus130, such as a function of setting a path between the virtual destination storage apparatus130and the computer100. The software configuration of the virtual destination storage apparatus130may be the same as the software configuration of the storage apparatus120.

Next, the software configuration of the management computer140will be described. The memory142of the management computer140stores encryption key/encryption setting information backup information241, storage management information242, and administrator authentication information243.

The encryption key/encryption setting information backup information241includes information related to an encryption key and encryption settings backed up from the storage apparatus120.

The storage management information242includes information for managing the storage apparatus120and the virtual destination storage apparatus130. In general, the management computer140manages the storage apparatus120or the like based on the storage management information242. The storage management information242is updated according to the update in configuration information in the storage apparatus120or in the virtual destination storage apparatus130. As a result, the configuration information is synchronized between the management computer140and the storage apparatus120or the like.

The administrator authentication information243includes information to be used for authenticating an administrator using the management computer140.

Next, the administrator authentication information243will be described.

FIG. 7is an explanatory diagram illustrating an example of the administrator authentication information243according to the first embodiment of this invention.

The administrator authentication information243includes three data items including items701to703.

The item701stores a user ID for uniquely identifying each administrator.

The item702stores a password of each administrator.

The item703stores role information for controlling an operation to be performed by each administrator using the management computer140. For example, an administrator having a role of account administrator is allowed to create and delete account information in the management computer140. An administrator having a role of security administrator is allowed to make encryption settings in the storage apparatus120, to manage the encryption key/encryption setting information backup information241stored in the management computer140. For example, only an administrator having a role of security administrator is allowed to give an instruction to backup and restore the encryption key/encryption setting information, which will be described later.

Next, the program information of the management computer140will be described. The program information of the management computer140includes five programs including: an encryption setting instruction program244; an encryption key/encryption setting information backup instruction program245; an encryption key/encryption setting information restoration instruction program246; a storage management instruction program247; and an access control program248. Those programs are executed by the CPU141. Accordingly, in the following description, the processes to be executed by those programs are actually executed by the CPU141.

The encryption setting instruction program244instructs the storage apparatus120to make encryption settings including the encryption of the storage area.

The encryption key/encryption setting information backup instruction program245instructs the storage apparatus120to backup an encryption key and encryption setting information.

The encryption key/encryption setting information restoration instruction program246transmits the encryption key/encryption setting information backup information241stored in the management computer140to the storage apparatus120, and instructs the storage apparatus120to restore the encryption key/encryption setting information.

The storage management instruction program247instructs the storage apparatus120and the virtual destination storage apparatus130to execute any other function than the encryption setting function, such as a function of setting a path between the computer100and the storage apparatuses120and130.

The access control program248authenticates an administrator using the management computer140, based on the administrator authentication information243, and permits or prohibits the execution of the management operation requested by the administrator.

Described above are the software configurations of the storage apparatus120, the virtual destination storage apparatus130, and the management computer140according to this embodiment.

In the following, a detailed description will be given of a series of processes to be performed from the backup to the restoration of the encryption key/encryption setting information according to this embodiment based on the above-mentioned software configurations. The series of processes includes five processes described below. The first process is to generate an encryption key and make encryption settings of the storage area in the storage apparatus120. The second process is to instruct the storage apparatus120, by the management computer140, to back up the encryption key/encryption setting information. The third process is to backup, by the storage apparatus120which has received the instruction, the encryption key/encryption setting information to the management computer140. The fourth process is to send, by the management computer140, the backed-up information to a restoration destination storage apparatus to instruct the restoration. The fifth process is to determine, by the storage apparatus which has received the restoration instruction, whether it is possible or not to restore the backed-up information and to restore the information. Hereinbelow, those processes will be described in detail

(Encryption Setting Process Performed by Storage Apparatus)

FIG. 9is a flowchart illustrating an example of the encryption setting process to be performed by the encryption setting program206of the storage apparatus120according to the first embodiment of this invention.

The encryption setting program206of the storage apparatus120receives, from the management computer140, an encryption request with respect to a storage area of the storage apparatus120or the virtual destination storage apparatus130(Step901).

Next, the encryption setting program206determines whether an encryption key to be applied to the storage area has already been generated or not (Step902). For example, the encryption setting program206refers to the information included in the item307of an entry corresponding to the storage area designated by the encryption request, and judges that, in a case where a key ID is not stored, the encryption key is yet to be generated.

In the case where the encryption key is yet to be generated, the encryption setting program206generates a new encryption key, and adds the new encryption key thus created, to the encryption key management information204. After that, the encryption setting program206encrypts or decrypts data stored in the designated storage area, by using the new encryption key thus generated (Step903).

In the case where the encryption key has already been generated, the encryption setting program206encrypts or decrypts data stored in the designated storage area125, by using the encryption key that has already been generated (Step904). The procedure for performing the encryption or the decryption is similar to that in Step903. According to this flowchart, an encryption key is set for each storage area, but an encryption key may be set for each storage apparatus. For example, there may be adopted a flowchart for setting two keys including a key to be used for encrypting the storage area125of the storage apparatus120and a key to be used for encrypting the storage area135of the virtual destination storage apparatus130.

As shown in Step903and Step904, after an encryption key is set to the storage area125, the I/O processing program205of the storage apparatus120, upon receiving a data write request with respect to the storage area125, encrypts the data by using the set encryption key and writes the encrypted data in the storage area125. Upon receiving a data read request to read data from the storage area125, the I/O processing program205reads the requested data and decrypts the read data by the set encryption key, and transmits the decrypted data to the transmission source of the request.

In a case where the storage area125is a virtual storage area virtualizing the storage area135, the I/O processing program205, which has received a data write request, encrypts data and transmits a request to write the encrypted data, to the virtual destination storage apparatus130. The virtual destination storage apparatus130stores the received data in the virtual destination storage area135. The I/O program205, which has received a data read request, reads the encrypted data from the virtual destination storage area135of the virtual destination storage apparatus130and decrypts the read data, and transmits the decrypted data to the transmission source of the request.

In a case where a physical disk drive (such as an HDD) corresponding to the storage area125or the storage area135is illegally taken outside and coupled to another storage apparatus which is not shown, the other storage apparatus cannot use the data stored in the HDD because the storage apparatus does not have an encryption key necessary for decrypting the data stored in the HDD. In this manner, it is possible to prevent data from being illegally taken out.

However, due to a failure which has occurred in the storage apparatus120, there may be a case where an encryption key or encryption setting information held by the storage apparatus120is lost. The failure in this case refers to a hardware failure, volatilization of a memory storing the encryption key or the encryption setting information, a software failure, or an operational error made by a user. In this case, even the storage apparatus120cannot use data stored in the storage area125. In the case where the storage area135in the virtual destination storage area130is virtualized by the storage apparatus120, the storage apparatus120cannot use the data stored in the storage area135despite that no failure is occurring in the virtual destination storage apparatus130.

In order to allow the storage apparatus120to use the data stored in the storage area125or135even in the above-mentioned cases, the encryption key and the encryption setting information are backed up by the management computer140, according to this embodiment. In the case where a failure has occurred in the storage apparatus120, the encryption key and the encryption setting information thus baked up are restored to an appropriate one of the storage apparatuses120. Hereinbelow, a description will be given of the backup and the restoration described above.

(Backup Instruction Process Performed by Management Computer)

FIG. 10is a flowchart illustrating an example of an encryption key/encryption setting information backup process performed by the encryption key/encryption setting information backup instruction program245of the management computer140according to the first embodiment of this invention.

The encryption key/encryption setting information backup instruction program245of the management computer140, upon receiving an encryption key/encryption setting information backup request from an administrator (Step1001), authenticates the administrator based on the administrator authentication information243(Step1002, Step1003). Specifically, the encryption key/encryption setting information backup instruction program245judges that the authentication of the administrator has succeeded, in a case where a user ID and a password received from the administrator each have been registered in the item701and the item702, respectively, of any one of the entries included in the administrator authentication information243and “security administrator” is set to the item703of the entry.

In the case where the authentication of the administrator has failed, the process is ended.

On the other hand, the authentication of the administrator has succeeded, the administrator instructs, from the management computer140, the storage apparatus120to backup the encryption key/encryption setting information (Step1004). For example, the administrator gives the backup instruction at any time point before a failure occurs in the storage apparatus120(for example, a time point at which the encryption key is generated or the encryption setting is changed). The storage apparatus120, which has received the backup instruction, transmits the encryption key/encryption setting backup information241to the management computer140. This process and the encryption key/encryption setting information backup information241will be described later in detail (with reference toFIGS. 11 and 8).

The management computer140, upon receiving the encryption key/encryption setting information backup information241from the storage apparatus120, stores the received information in the memory142of the management computer140or in a non-volatile recording medium such as a hard disk drive (HDD), which is not shown, of the management computer140(Step1005).

(Backup Process in Storage Apparatus)

FIG. 11is a flowchart illustrating an example of an encryption key/encryption setting information backup process performed by the encryption key/encryption setting information backup program207of the storage apparatus120according to the first embodiment of this invention.

The encryption key/encryption setting information backup program207of the storage apparatus120, upon receiving an encryption key/encryption setting information backup request from the management computer140(Step1101), creates encryption key/encryption setting information backup information241, and transmits the created information to the management computer140(Step1102). The backup of the encryption key/encryption setting information may also be performed in a case where no instruction is given by the management computer140. For example, the encryption key/encryption setting information backup program207may automatically back up the encryption key/encryption setting information to a predetermined location, when the encryption key or the encryption setting is changed in the storage apparatus120.

FIG. 8is an explanatory diagram illustrating an example of the encryption key/encryption setting information backup information241according to the first embodiment of this invention.

The encryption key/encryption setting information backup information241includes two kinds of information including data items801and810.

The data item801includes duplicate information of the LU management information201and the virtual LU mapping information202.

The data item810includes backup information of the encryption key management information204, and includes eight data items including items811to818.

The item811stores a model/production number of each backup source storage apparatus120. In this case, the backup source storage apparatus120corresponds to a storage apparatus120which is a copy source of the data item801and the items812to818to be described later.

The items812to818each correspond to the items601to607of the encryption key management information204, and therefore the description thereof will be omitted. The items811and817may store any other value than the apparatus model/production number, as long as the value is capable of uniquely identifying each backup source storage apparatus120or each virtual destination storage apparatus130in the computer system.

(Restoration Instruction Process Performed by Management Computer)

FIGS. 12A and 12Bare flowcharts illustrating an example of a restoration instruction process to be performed by the encryption key/encryption setting information restoration instruction program246of the management computer140with respect to the storage apparatus120or the virtual destination storage apparatus130, according to the first embodiment of this invention.

The procedure illustrated inFIGS. 12A and 12Bare an example of a process to be performed, in a case where the encryption key/encryption setting information stored in the storage apparatus120has been lost due to a failure in the storage apparatus120, the process being for restoring the encryption key/encryption setting information by using the encryption key/encryption setting information which has been backed up in the management computer140.

Types of the restoration according to this embodiment will now be described.

Hereinbelow, with reference toFIG. 1, a description will be given of a case, by way of example, where the storage apparatus120A virtualizes the virtual destination storage apparatus130. The storage apparatus120A includes a plurality of storage areas125, and at least one of the storage areas125is a real storage area, and the rest of the storage areas125include virtual storage areas virtualizing the storage areas135. In other words, data written into each virtual storage area is actually stored in the storage area135corresponding to the virtual storage area. In this case, the storage apparatus120A stores an encryption key and encryption setting information (in this case, referred to as encryption key or the like) to be used for the real storage area of the storage apparatus120A and an encryption key or the like for each virtual storage area of the storage apparatus120A.

When the storage apparatus120A fails, the encryption key or the like stored in the storage apparatus120A is lost. Accordingly, it is necessary to restore the encryption key or the like which has been backed up in the management computer140to any of the storage apparatuses.

First, a description will be given of the restoration of the encryption key or the like to be used for each virtual storage area in a case where the storage apparatus120A has not been recovered from the failure.

Even in the case where the storage apparatus120A has not been recovered from the failure, data stored in a virtual storage area is actually stored in the storage area135corresponding thereto. Accordingly, when the virtual destination storage apparatus130is newly coupled externally to the storage apparatus120B (in other words, when the storage apparatus120B newly virtualizes the virtual destination storage apparatus130), the computer100can access the data stored in the virtual storage area. Alternatively, the computer100may access the virtual destination storage apparatus130without through the storage apparatus120B.

Accordingly, an administrator may designate, as a destination to which the encryption key or the like to be used for the virtual storage area is restored, the storage apparatus120B or the virtual destination storage apparatus130itself.

In the case where the storage apparatus120B is designated as the restoration destination, the encryption key or the like set to the virtual storage area is restored to the storage apparatus120B. Then, in place of the storage apparatus120A, the storage apparatus120B virtualizes the virtual destination storage apparatus130. The storage apparatus120B can correctly decrypt data read from the storage area135, by using the restored encryption key.

On the other hand, in the case where the virtual destination storage apparatus130itself is designated as the restoration destination, the encryption key or the like set to the virtual storage area is restored to the virtual destination storage apparatus130. In this case, the virtual destination storage apparatus130is no longer virtualized by any other storage apparatuses120. In other words, the virtual destination storage apparatus130receives a data read/write request with respect to the storage area135from the computer100without through the storage apparatus120, and processes the request. In this case, the virtual destination storage apparatus130can correctly decrypt data read from the storage area135, by using the restored encryption key, and return the decrypted data as a response to the computer100.

However, in order to process, by the virtual destination storage apparatus130, an access request transmitted without through the storage apparatus120, it is necessary to provide the virtual destination storage apparatus130with a function of encrypting and decrypting data and a function of managing an encryption key. Specifically, the virtual destination storage apparatus130needs to be provided with at least such information and programs as to correspond to the encryption key management information204, the encryption setting program206, the encryption key/encryption setting information backup program207, and the encryption key/encryption setting information restoration program208. Further, the I/O processing program223needs to be provided with a function of executing encryption and decryption.

Next, a description will be given of the restoration of the encryption key or the like to be used for the real storage area in a case where the storage apparatus120A has not been recovered from the failure.

Even when the storage apparatus120A has failed, as long as data stored in a disk drive of the storage apparatus120A has not been lost, it is possible to access the data stored in the disk drive (that is, data stored in a real storage area corresponding to the disk drive) by coupling the disk drive to the storage apparatus120B or to the virtual destination storage apparatus130. In this case, after the disk drive is coupled to the storage apparatus120B or to the virtual destination storage apparatus130, the restoration similar to the above-mentioned restoration of the encryption key or the like of the virtual storage area is executed, to thereby correctly decrypt data stored in the disk drive.

Next, a description will be given of the restoration of the encryption key or the like in the case where the storage apparatus120A has already been recovered from the failure.

There is a case where the storage apparatus120A has already been recovered from the failure at a point in time of restoring the encryption key or the like which has been lost from the storage apparatus120A. For example, the case corresponds to a case where the encryption key has been lost due to a restart or a temporary failure of the storage apparatus120A, or an operational error of a user. In this case, an administrator can designate the recovered storage apparatus120A itself as the restoration destination, rather than designating the storage apparatus120B or the virtual destination storage apparatus130as the restoration destination of the encryption key or the like as described above. As a result, the lost encryption key or the like is restored to the storage apparatus120A that has originally stored the same encryption key (in other words, the storage apparatus120A as a backup source).

The processes to be performed in each of the above-mentioned cases will be described below in detail.

It should be noted that, according to this embodiment, a restoration instruction procedure to be performed by the management computer140includes three different restoration instruction procedures. First, the restoration instruction procedure illustrated inFIGS. 12A and 12Bwill be described. Other restoration instruction procedures illustrated inFIGS. 15 and 16will be described in the end of this embodiment, as modification examples.

The encryption key/encryption setting information restoration instruction program246of the management computer140receives a restoration request from an administrator (Step1201).

Next, the encryption key/encryption setting information restoration instruction program246authenticates the administrator who has made the restoration request (Step1202), and judges whether the authentication has succeeded or failed (Step1203). The authentication and the judgment may be performed similarly to those in Step1002and Step1003ofFIG. 10.

In the case where the authentication has failed, the process is ended. On the other hand, in the case where the authentication has succeeded, the administrator designates a failed storage apparatus (hereinafter, also referred to as failed apparatus), by using the management computer140, and instructs the management computer140to read the encryption key/encryption setting information backup information241of the failed apparatus (Step1204).

Next, the administrator identifies, based on the information read by the management computer140, which one of the virtual destination storage apparatuses130has been virtualized by the failed apparatus (Step1205), and judges whether the failed apparatus has virtualized or not any of the virtual destination storage apparatuses130(Step1206). For example, the administrator refers to the data in the item403included in the encryption key/encryption setting information backup information241, to thereby identify which one of the virtual destination storage apparatuses130has been virtualized by the failed apparatus.

In the case where the failed apparatus has not virtualized any of the virtual destination storage apparatuses130, the administrator determines whether or not to restore the encryption key/encryption setting information of the failed apparatus itself, rather than the encryption key/encryption setting information of the virtual destination storage apparatus130(Step1207).

In the case of restoring the encryption key/encryption setting information of the failed apparatus itself, the administrator designates the restoration destination storage apparatus (hereinafter, also referred to as restoration destination apparatus). The restoration destination corresponds to a copy destination to which the backed-up encryption key/encryption setting information is copied for restoration. For example, in a case where a failure has occurred in the storage apparatus120A ofFIG. 1, the storage apparatus120B which has not failed may be designated as the restoration destination apparatus. Then, the administrator sets the system option mode to the restoration destination apparatus before transmitting the encryption key/encryption setting information backup information241of the failed apparatus, and instructs restoration of the information (Step1208).

The system option mode will now be described.

When the system option mode is set to the storage apparatus120, the encryption key/encryption setting information is allowed to be restored to the storage apparatus120even in the case where the backup source apparatus number included in the encryption key/encryption setting information backup information241is different from that of the own storage apparatus120, or in the case where an encryption key has already been set to the storage apparatus120.

In a case where the normal mode is set (that is, in a case where the system option mode is not set), of the encryption keys backed up from the storage apparatus120, only an encryption key for the virtual destination storage apparatus130can be restored to the restoration destination apparatus. However, the storage apparatus120cannot restore an encryption key for the storage apparatus120unless the backup source apparatus and the restoration destination apparatus of the encryption key are the same. The reason for the above is to prevent a situation where the encryption key that has already been set to the restoration destination storage apparatus120is overwritten with another encryption key due to the restoration, with the result that it is made impossible to use data that has been stored in the storage area125by the storage apparatus120before the restoration.

However, there may be a case where, even when the storage apparatus120has failed, the disk drive storing data has not failed. In this case, the disk drive of the failed apparatus is transferred to the restoration destination apparatus, and the backed-up encryption key of the failed apparatus is restored to the restoration destination apparatus, to thereby make it possible to decrypt encrypted data in the disk drive.

Alternatively, in the case where an encryption key in the storage apparatus120has corrupted even when the storage apparatus120has not failed (for example, in the case where an encryption key is deleted by mistake), the corrupted encryption key is overwritten with another encryption key which has been backed up, to thereby make it possible to decrypt encrypted data in the storage system120.

The system option mode is set to permit the overwriting of the encryption key for the purposes as described above. Accordingly, it is unnecessary, in general, to set the system option mode, except for the above-mentioned cases.

Next, the restoration destination apparatus receives the encryption key/encryption setting information backup information241of the failed apparatus, restores the information, and notifies the management computer140of the completion of the restoration (Step1209). Specifically, when the restoration is executed, the LU management information201, the LU mapping information202, and the encryption key management information204of the restoration destination apparatus are overwritten with data included in the encryption key/encryption setting information backup information241.

After the restoration in the restoration destination apparatus is completed, the administrator consults the encryption key/encryption setting information backup information241of the failed apparatus, and sets a path (that is, a route available for communication) between the storage area of the restoration destination apparatus and the computer100, with reference to the path which has been set between the storage area of the failed apparatus and the computer100(Step1210).

For example, in the case where the failed apparatus has set a path between an LU corresponding to the LU number “3” shown in the item302and the computer100identified by the WWN of “20:00:00:00:00:00:A1:7A” shown in the item304, the administrator sets a path between the LU125of the restoration destination apparatus, which corresponds to the above-mentioned LU (that is, the LU125virtualizing the LU135of the virtual destination storage apparatus130which is the same as the LU135virtualized by the failed apparatus) and the computer100identified by the WWN of “20:00:00:00:00:00:A1:7A”.

Specifically, “20:00:00:00:00:00:A1:7A” is stored in the item304of each entry corresponding to the value “3” in the item302of the LU management information201of the restoration destination apparatus. When the setting is made as described above, it is indicated that the restoration destination apparatus allows the computer100identified by “20:00:00:00:00:00:A1:7A” to access the LU “3”.

Alternatively, it is also possible, after a failure or the like, to newly set a path different from the path that has been originally set. Further, the process in Step1210may be performed by the restoration destination apparatus itself, rather than by the administrator, with reference to the encryption key/encryption setting information backup information241of the failed apparatus received from the management computer140.

In the case where the encryption key/encryption setting information of the failed apparatus itself is not to be restored in Step1207, the process is ended.

In the case where, in Step1206, the failed apparatus has virtualized the virtual destination storage apparatus130, the administrator cancels the setting of “LUN Security” set in the storage area of the virtual destination storage apparatus130which has been virtualized by the failed apparatus (Step1211). As a result, other storage apparatuses120are allowed to access the virtual destination storage apparatus130. For example, the item304limits the computer100that can access each LU in the storage apparatus120. The access restriction similar to the above is also considered to be set in the virtual destination storage apparatus130. However, the process of Step1211is not necessarily performed. When the “LUN Security” has not originally been set in the storage area of the virtual destination storage apparatus130, it is not necessary to perform Step1211.

Next, the administrator selects, from the encryption key/encryption setting information backup information241, the information backed up from the failed apparatus, designates the encryption key/encryption setting information of the virtual destination storage apparatus130to be restored (in other words, designates which one of the virtual destination storage apparatuses130is subjected to the restoration of the encryption key/encryption setting information), further designates the restoration destination apparatus to which the encryption key/encryption setting information is to be restored, and requests the restoration (Step1212).

When the management computer140backs up the encryption key/encryption setting information of the storage apparatus120virtualizing a plurality of the virtual destination storage apparatuses130, the management computer140may back up all the encryption key/encryption setting information of the storage apparatus120and the plurality of the virtual destination storage apparatuses130as a single file, or may back up the encryption key/encryption setting information for each virtual destination storage apparatus130as a single file. When the encryption key/encryption setting information is backed up for each virtual destination storage apparatus130, the encryption key/encryption setting information is backed up as a plurality of items of information. In this case, in Step1212, the information backed up from the failed apparatus is selected from the plurality of items of the encryption key/encryption setting information.

Also, in the case of the encryption key/encryption setting information backup information241ofFIG. 8, when the administrator has designated, of the apparatuses registered in the item817, only the apparatus having the number of “D600-100”, the restoration of the encryption key and the encryption setting information of the virtual destination storage apparatus130indicated by the number (that is, information included in the items813,814, and815of the entries corresponding to the key IDs “2” to “4”) is merely requested, while the restoration of the encryption key and the encryption setting information corresponding to the apparatus having the number “D700-110” is not requested. On the other hand, when the apparatuses having the numbers of “D600-100” and “D700-100” have been designated, the restoration of the encryption keys and the encryption setting information of the entries corresponding to the key IDs of “2” to “5” is requested.

Next, the management computer140judges whether or not at least one virtual destination storage apparatus130which has been designated by the administrator in Step1212includes an apparatus which is the same as the restoration destination apparatus (Step1213). In other words, it is judged whether or not the encryption key and the encryption setting information of the virtual destination storage apparatus130which has been virtualized by the failed apparatus are restored to the same virtual destination storage apparatus130itself.

For example, in the case where it is designated in Step1212that the encryption keys and the encryption setting information of the virtual destination storage apparatuses having the numbers of “D600-100” and “D700-110” are to be restored to the virtual destination storage apparatus having the number of “D600-100”, it is judged in Step1213that the encryption key and the encryption setting information of the virtual destination storage apparatus130that has been virtualized by the failed apparatus (that is, the virtual destination storage apparatus having the number of “D600-100”) are to be restored to the same virtual destination storage apparatus130itself.

In the case where at least one virtual destination storage apparatus130which has been designated by the administrator does not include an apparatus which is the same as the restoration destination apparatus, the management computer140externally couples the designated virtual destination storage apparatuses130to the restoration destination apparatus, to thereby virtualize the LU135of each of the designated virtual destination storage apparatuses130(Step1214). In other words, the storage area135of each of the designated virtual destination storage apparatuses130is virtualized by the restoration destination apparatus. For example, the management computer140makes each of the virtual destination storage apparatuses130be externally coupled based on the information included in the item404.

Next, the management computer140transmits, of the encryption key/encryption setting information backup information241designated by the administrator, only the encryption key/encryption setting information of the virtual destination storage apparatus130designated by the administrator, to the restoration destination apparatus and instructs restoration of the information (Step1215).

The restoration destination apparatus, upon receiving the encryption key/encryption setting information of the virtual destination storage apparatus130from the management computer140, executes the restoration process (Step1216). Specifically, the restoration destination apparatus judges whether it is possible or not to restore the received encryption key/encryption setting information. In the case where the restoration is possible, the restoration destination apparatus adds the received encryption key/encryption setting information to the LU management information201, the virtual LU mapping information202, and the encryption key management information204held by the restoration destination apparatus. Then, the restoration destination apparatus notifies the management computer140of the result of the restoration. The restoration process in the storage apparatus130will be described later in detail.

Next, the administrator consults the encryption key/encryption setting information backup information241of the failed apparatus, and, with respect to each of the restored virtual LUs of the virtual LUs (that is, virtualized LUs of the virtual destination storage apparatuses130) of the failed apparatus and the computer100, with reference to the path which has been set between the corresponding LU and the computer100, sets a path between the virtual LU (LU virtualized in Step1214) of the restoration destination apparatus and the computer100(Step1217).

For example, inFIG. 1, in the case where a failure has occurred in the storage apparatus120A which virtualizes the virtual destination storage apparatus130and the encryption key or the like which has been set to the storage area125of the storage apparatus120A is restored to the storage apparatus120B, the administrator sets a path between the virtual storage area, which is not shown, of the storage apparatus120B which is the restoration destination and the computer100. When the path is set as described above, it is indicated that the storage apparatus120B allows the computer100to access the virtual storage area of the storage apparatus120B. The path may be set in the same manner as in, for example, Step1210.

In the case where it is determined in Step1213that at least one virtual destination storage apparatus130designated by the administrator includes an apparatus which is the same as the restoration destination apparatus, the process proceeds to Step1218to restore the encryption key/encryption setting information of the apparatus same as the restoration destination apparatus, and then proceeds to Step1214to restore the encryption key/encryption setting information of an apparatus different from the restoration destination apparatus (Step1218).

The processes in Steps1214to1217have already been described, and therefore the processes to be performed in and after Step1218will be described below.

The management computer140maps the virtual LU of the virtual storage apparatus130(that is, the restoration destination apparatus) designated by the administrator, as the real LU of the restoration destination apparatus (Step1219).

For example, an LU corresponding to the LU number “3” in the item402corresponds to a virtual LU having the LU number “1” in the virtual destination storage apparatus130, which has been virtualized by the failed apparatus. A description will be given of a case where the encryption setting information of the LU having the LU number “3” (for example, information included in the items306and307) is to be restored to the virtual storage apparatus130itself. In this case, the management computer140does not instruct the virtual destination storage apparatus130to virtualize the LU having the LU number “1” in the own apparatus. As a result, the virtual destination storage apparatus130recognizes the LU having the LU number “1” as a real LU which actually exists in the own apparatus. Specifically, in the LU management information201held by the failed apparatus, the LU having the LU number “3” has the item305set to “virtual”. However, when the backup information shown inFIG. 8of the LU management information201is restored to the virtual destination storage apparatus130, the LU number “3” is changed to the LU number “1”, and “real” is set to the item305. Further, the virtual LU mapping information which has been registered in correspondence with the LU number “3” in the item402of the virtual LU mapping information202is deleted.

Next, the management computer140transmits, of the encryption key/encryption setting information backup information241selected by the administrator, only the encryption key/encryption setting information of the virtual destination storage apparatuses130designated by the administrator, and instructs restoration of the information (Step1220).

The restoration destination apparatus, upon receiving the encryption key/encryption setting information of the virtual destination storage apparatus130from the management computer140, restores the information (Step1221). Specifically, the restoration destination apparatus adds the received encryption key/encryption setting information to the LU management information201, the virtual LU mapping information202, and the encryption key management information204held by the restoration destination apparatus. At this time, the restoration destination apparatus changes the values in the information as described in Step S1219. Then, the restoration destination apparatus notifies the management computer140of the result of the restoration.

Next, the administrator consults the encryption key/encryption setting information backup information of the failed apparatus, and sets a path between the real LU mapped in the restoration destination apparatus and the computer100, with reference to the path which has been set between the virtual LU of the failed apparatus and the computer100(Step1222).

For example, inFIG. 1, in the case where a failure has occurred in the storage apparatus120A which virtualizes the virtual destination storage apparatus130and the encryption key or the like which has been set to the storage area125of the storage apparatus120A is restored to the virtual destination storage apparatus130, the administrator sets a path between the storage area135of the virtual destination storage apparatus130and the computer100. When the path is set as described above, it is indicated that the virtual destination storage apparatus130allows the computer100to access the storage area135. The path is set in the same manner as in, for example, Step1210.

Described above is the process flow of giving a restoration instruction from the management computer140to the restoration destination storage apparatus.

It should be noted that, in Step1219, the management computer140may directly instruct the restoration destination apparatus to change the encryption settings in the encryption key/encryption setting information of the virtualized restoration destination apparatus itself, apart from the restoration instruction which is also to be given by the management computer140by sending the encryption key/encryption setting information backup information241.

Also, in Step1219, the management computer140may create, as regards the encryption key/encryption setting information of the restoration destination apparatus itself, new encryption key/encryption setting information backup information241based on the encryption key/encryption setting information backup information241, and transmit the new encryption key/encryption setting information backup information241, to thereby instruct restoration of the information. In this case, the apparatus model/production number of the restoration destination apparatus is set as the backup source apparatus model/production number (item811) in the encryption key/encryption setting information backup information241, and the LU number in the item302in the restoration destination apparatus is replaced by the LU number in the item405, and the item305of the corresponding LU is changed from “virtual” to “real”, to thereby create the new encryption key/encryption setting information backup information241.

After the restoration has succeeded, in order to prevent the LU of the virtual destination storage apparatus130from being accessed by any other storage apparatuses120than the restoration destination apparatus, the LUN security may be set to restrict the access.

(Restoration Process Executed by Storage Apparatus)

FIGS. 13A and 13Bare flowcharts illustrating an example of a restoration process executed by a storage apparatus which has received a restoration instruction from the management computer140according to the first embodiment of this invention.

As has already been described, the storage apparatus120or the virtual destination storage apparatus130is designated as the restoration destination apparatus. The process illustrated inFIGS. 13A and 13Bis executed by the storage apparatus120or the virtual destination storage apparatus130which has received the restoration instruction. The “storage apparatus” which executes each of the steps ofFIGS. 13A and 13Bis the storage apparatus120or the virtual destination storage apparatus130which has received the restoration instruction. The same applies to the modification examples shown inFIGS. 14 and 17.

The storage apparatus receives, together with the restoration instruction, at least one item of the encryption key/encryption setting information backup information241of the failed apparatus, from the management computer140(Step1301). In this case, the received restoration instruction and the received encryption key/encryption setting information backup information241are those transmitted in one of Steps1208,1215, and1220ofFIGS. 12A and 12B.

Next, the storage apparatus judges whether or not the system option mode is set to the own apparatus (Step1302). The judgment is, for example, made based on the information in the item503of the storage apparatus model/production number management information203.

In the case where the system option mode is not set, the storage apparatus refers to the backup source apparatus model/production number (item811) in the encryption key/encryption setting information backup information241received from the management computer140(Step1303).

Next, the storage apparatus judges whether the backup source apparatus model/production number referred to in Step1303matches the apparatus model/production number (item501) of the own storage apparatus (Step1304).

In the case where the backup source apparatus model/production number matches the apparatus model/production number of the own storage apparatus, it has been instructed to restore the encryption key or the like backed up from the storage apparatus120to the same storage apparatus120itself. In this case, the storage apparatus120judges whether or not the restoration target has already had an encryption key set thereto (Step1305). The judgment is made based on the information in the item307of the LU management information201.

It should be noted that in the case where an encryption key is set for each storage area (LU)125, the restoration target corresponds to a storage area125to which the encryption key or the like to be restored is to be set. In the case where an encryption key is set for each storage apparatus, the restoration target corresponds to the storage apparatus120or the virtual destination storage apparatus130, to which the encryption key or the like to be restored is to be set.

In the case where the encryption key has already been set, the storage apparatus ends the process, and notifies the management computer140of the ending of the restoration (Step1309).

In the case where no encryption key is set, the storage apparatus judges whether or not the encryption key included in the received encryption key/encryption setting information backup information241(that is, the encryption key/encryption setting information backup information backed up from the storage apparatus120which has been designated as the restoration destination) is set for each LU (Step1306). For example, when the item818stores an LU number, the encryption key is set for each LU. On the other hand, when the item818stores “apparatus”, the encryption key is set for each apparatus.

In the case where the encryption key is not set for each LU, the storage apparatus restores the encryption key corresponding to each apparatus and the encryption setting information corresponding to the LU of each apparatus (Step1308). For example, in the case where the encryption key is set for each apparatus and no encryption key is set to the restoration destination apparatus, the storage apparatus sets, to the restoration destination apparatus (that is, to the own storage apparatus), the encryption key (item813) included, as the encryption key of the corresponding restoration destination apparatus, in the encryption key/encryption setting information backup information241, and the encryption setting information of the corresponding restoration destination apparatus. The encryption setting information of the corresponding restoration destination apparatus includes at least On/Off information (item306) of each LU of the corresponding restoration destination apparatus.

In the case where it has been judged in Step1306that the encryption key is set for each LU, the encryption key and the encryption setting information of each LU in each apparatus are restored to the own storage apparatus (Step1307).

In the case where it has been judged in Step1304that the backup source apparatus model/production number is different from the apparatus model/production number of the own storage apparatus, it has been instructed to restore the encryption key or the like backed up from the storage apparatus120to any other storage apparatus than the storage apparatus120(that is, the backup source apparatus). In this case, the storage apparatus judges whether the encryption key/encryption setting information backup information241received from the management computer140includes the encryption key/encryption setting information of the real LU in the backup source apparatus (Step1310). In the case ofFIG. 8, for example, a value “real” is set to the item305of each entry corresponding to the key ID “1” in the data item801(that is, the item305of the backed-up LU management information201). In this case, the encryption key identified by the key ID “1” in the item812is an encryption key of a real LU in the backup source apparatus, and the encryption On/Off and the key ID identified by the LU number “1” correspond to the encryption setting information of the real LU in the backup source apparatus.

In the case where the received information includes the encryption key/encryption setting information of the real LU in the backup source apparatus, the storage apparatus does not restore the encryption key/encryption setting information of the backup source apparatus, and proceeds to Step1311(Step1318). In other words, in this case, in the processes after Step1311, the storage apparatus does not restore the encryption key/encryption setting information of the real LU in the backup source apparatus.

As a result of Steps1310and1318, the encryption key/encryption setting information set to a real LU is prevented from being restored to any other apparatus than the storage apparatus120that is a backup source of the information.

In the case where it has been judged in Step1310that the received information does not include the encryption key/encryption setting information of the real LU in the backup source apparatus, the storage apparatus judges whether or not the virtual destination apparatus model/production numbers in the encryption key/encryption setting information backup information241include the apparatus model/production number of the own storage apparatus or the apparatus model/production number (item504) of the virtual destination storage apparatus130that is virtualized by the own storage apparatus (Step1311).

In the case where the virtual destination apparatus model/production numbers do not include the apparatus model/production number of the own storage apparatus or the apparatus model/production number of the virtual destination storage apparatus130that is virtualized by the own storage apparatus, the process proceeds to Step1309.

On the other hand, in the case where the virtual destination apparatus model/production numbers include the apparatus model/production number of the own storage apparatus or the apparatus model/production number of the virtual destination storage apparatus130that is virtualized by the own storage apparatus, the storage apparatus judges whether the apparatus model/production number which has been judged as being “included” in Step1311matches the apparatus model/production number of the own storage apparatus (Step1312). In other words, the storage apparatus judges, with respect to the virtual destination storage apparatus130having the apparatus model/production number which is the same as the apparatus model/production number of the own storage apparatus, or with respect to the virtual storage apparatus130having the apparatus model/production number which is the same as the apparatus model/production number of the virtual destination storage apparatus130that is virtualized by the own storage apparatus, whether the apparatus model/production number of any of those virtual destination storage apparatuses130matches the apparatus model/production number of the own storage apparatus.

In the case where it has been judged that the apparatus model/production numbers match each other, the storage apparatus judges whether an encryption key has already been set to the restoration target (Step1313).

In the case where the encryption key has already been set, the process proceeds to Step1317.

On the other hand, in the case where no encryption key is set, the storage apparatus judges whether or not the encryption key of the received encryption key/encryption setting information backup information is set for each LU (Step1314).

In the case where the encryption key is set for each LU, the storage apparatus restores the encryption key of each LU and the encryption setting information of each LU in the virtual destination storage apparatus130, as the encryption key and the encryption setting information of the real LU in the own storage apparatus, and proceeds to Step1317(Step1315). In other words, the encryption key and the encryption setting information allocated to each virtual LU by the storage apparatus as the backup source are allocated, in the virtual destination storage apparatus130that is a restoration destination, as the encryption key and the encryption setting information of each real LU in the own apparatus.

In the case where it has been judged in Step1314that the encryption key is not set for each LU, the storage apparatus restores the encryption key of the virtual destination storage apparatus130and the encryption setting information of each LU, as the encryption key of the own apparatus and the encryption setting information of each real LU of the own apparatus (Step1316).

Next, the storage apparatus judges whether the received encryption key/encryption setting information backup information still includes, as the virtual destination apparatus model/production number, the apparatus model/production number that matches the apparatus model/production number of the own storage apparatus or the apparatus model/production number of the virtual destination storage apparatus130that is virtualized by the own storage apparatus, which is yet to be subjected to the processes in and after Step1312(Step1317).

In the case where there still remains the apparatus model/production number satisfying the condition of Step1317, the process returns to Step1312. Otherwise, the process proceeds to Step1309.

In the case where it has been judged in Step1312that the apparatus model/production number of the corresponding virtual destination storage apparatus130does not match the apparatus model/production number of the own storage apparatus, the storage apparatus judges whether an encryption key has already been set to the restoration target (Step1319).

In the case where the encryption key has already been set, the process proceeds to Step1317. In the case where the encryption key is yet to be set, the storage apparatus judges whether or not the encryption key in the received encryption key/encryption setting information backup information241is set for each LU (Step1320).

In the case where the encryption key is set for each LU, the storage apparatus restores the encryption key of each LU of the virtual destination storage apparatus130and the encryption setting information of each LU of the virtual destination storage apparatus130, as the encryption key and the encryption setting information for each virtual LU of the own apparatus, and proceeds to Step1317(Step1321).

In the case where it has been judged in Step1320that the encryption key is not set for each LU, the storage apparatus restores the encryption key of the virtual destination storage apparatus130and the encryption setting information for each LU of the virtual destination storage apparatus130, as the encryption key of the own apparatus and the encryption setting information for each virtual LU of the own apparatus, and proceeds to Step1317(Step1322). Steps1321and1322are executed similarly to Steps1315and1316.

Described above is the process flow to be performed by the storage apparatus for restoring the encryption key/encryption setting information backup information241.

It should be noted that, the above-mentioned process ofFIGS. 13A and 13Bis based on the premise that a process of virtualizing and mapping, by the storage apparatus120as a restoration destination, each LU in the virtual destination storage apparatus130has already been executed before the restoration process ofFIGS. 13A and 13Bis executed. In other words, the restoration destination storage apparatus120first virtualizes and maps each LU in the virtual destination storage apparatus130, and then receives the encryption key/encryption setting information backup information241. However, the restoration may not necessarily be executed in this order. For example, the encryption key/encryption setting information may be restored after the encryption key/encryption setting information backup information241is transmitted by the management computer140to the restoration destination storage apparatus120and the virtual destination storage apparatus130is virtualized and mapped by the restoration destination storage apparatus. Hereinbelow, the latter process flow will be described with reference toFIGS. 14A and 14B, as a modification example of the flow of the restoration process executed by the storage apparatus which has been described with reference toFIGS. 13A and 13B.

Modification Example 1 of Restoration Process Executed by Storage Apparatus

FIGS. 14A and 14Bare flowcharts illustrating a first modification example of the restoration process executed by the storage apparatus which has received a restoration instruction from the management computer140according to the first embodiment of this invention.

Of the processes illustrated inFIGS. 14A and 14B, Steps1301to1310and1312to1322are similar to those illustrated inFIGS. 13A and 13B, and therefore the description thereof will be omitted. In Step1311ofFIG. 14B, the judgment similar to that in Step1311ofFIG. 13Bis made. However, the process to be executed when the result of the judgment made in Step1311ofFIG. 14Bis “No” is different from the process inFIG. 13B.

In the case where it has been judged in Step1311that the virtual destination storage apparatus model/production numbers in the encryption key/encryption setting information backup information241do not include the apparatus model/production number of the own storage apparatus or the apparatus model/production number of the virtual destination storage apparatus130that is virtualized by the own storage apparatus, the storage apparatus temporarily stores the encryption key/encryption setting information backup information241received from the management computer140, in the control memory124or the HDD, which is not shown, of the own apparatus. After that, when the administrator has virtualized the LU in the virtual destination storage apparatus130or the administrator has mapped the LU in the virtual destination storage apparatus130as a real LU, the storage apparatus sets the stored encryption key/encryption setting information to the LU which has been virtualized or mapped (Step1323).

Described above is the first modification example of the restoration process in the storage apparatus.

Next, a modification example 2, which is another modification example of the restoration process, will be described with reference toFIG. 17. This modification example is different from the above-mentioned restoration process, in that the storage apparatus120which has received the encryption key/encryption setting information backup information241automatically virtualizes the virtual destination storage apparatus130and restores the encryption key/encryption setting information, based on the received backup information241.

Modification Example 2 of Restoration Process Executed by Storage Apparatus

FIG. 17is a flowchart illustrating the second modification example of the restoration process executed by the storage apparatus which has received a restoration instruction from the management computer140according to the first embodiment of this invention.

According to the second modification example, the processes of Steps1301to1308,1310, and1318ofFIGS. 13A and 13Bare executed. Those Steps has already been described with reference toFIGS. 13A and 13B, and therefore are omitted inFIG. 17.

Of the processes illustrated inFIG. 17, Steps1309,1313to1317, and1320to1322are similar to those illustrated inFIGS. 13A and 13B, and therefore the description thereof will be omitted.

In the case where the result of the judgment made in Step1310is “No”, and in the case where Step1318has been executed, the storage apparatus makes the judgment in Step1701.

The judgments to be made in Steps1701and1702ofFIG. 17each are similar those in Steps1311and1312ofFIG. 13B, respectively. However, the process to be executed in the case where the result of the judgment made in each of those Steps is “No” is different from the process inFIG. 13B.

In Step1701, the storage apparatus judges whether the virtual destination apparatus numbers included in the encryption key/encryption setting information backup information241received from the management computer140include the apparatus model/production number of the own apparatus or the apparatus model/production number of the apparatus which is virtualized by the own apparatus. In the case where the result of the judgment is “No”, the process proceeds to Step1703. On the other hand, in the case where the result of the judgment is “Yes”, the storage apparatus judges whether the apparatus model/production number matches the apparatus model/production number of the own storage apparatus (Step1702).

In the case where the result of the judgment in Step1702is “Yes”, the process proceeds to Step1313. On the other hand, in the case where the result of the judgment is “No”, the process proceeds to Step1703.

In the case where the result of the judgment in Step1701or Step1702is “No”, the storage apparatus120tries to access, in Step1703, the LU135of the virtual destination storage apparatus130corresponding to the virtual destination apparatus model/production number included in the encryption key/encryption setting information backup information241received from the management computer140, in order to virtualize the LU135of the virtual destination storage apparatus130(Step1703), and judges whether it is possible or not to access the corresponding LU135(Step1704).

For example, in the case where the setting in the item304has not been canceled in advance of the execution of the restoration process by the storage apparatus120, the storage apparatus120cannot access the corresponding LU135. In the case where the storage apparatus120cannot access the corresponding LU135, the process proceeds to Step1317.

On the other hand, in the case where the storage apparatus120can access the corresponding LU135, the storage apparatus120creates a new virtual LU125in the own storage apparatus, and virtualizes the corresponding LU135(Step1705).

For example, the storage apparatus120may consult the administrator, or map a free port in the own storage apparatus to an arbitrary LU, to thereby virtualize the LU135.

Next, the process proceeds to Step1320. Described above is the second modification example of the restoration process executed by the storage apparatus120.

Modification Example 1 of Restoration Instruction Process executed by Management Computer

Next, a first modification example of the flow of the restoration instruction process executed by the management computer140will be described.

FIGS. 15A to 15Care flowcharts illustrating the first modification example of the restoration instruction process executed by the encryption key/encryption setting information restoration instruction program246of the management computer140according to the first embodiment of this invention, with respect to the storage apparatus120or the virtual destination storage apparatus130.

Of the processes ofFIGS. 15A to 15C, Steps1201to1211,1216,1217,1221, and1222are similar to those illustrated inFIGS. 12A and 12B, and therefore the description of those Steps will be omitted.

After the process of Step1211has been completed, the administrator selects the virtual destination storage apparatus130that has been virtualized by the failed apparatus and the restoration destination apparatus, and instructs the management computer140to restore the encryption key/encryption setting information of the corresponding virtual destination storage apparatus130(Step1501).

The management computer140checks whether the designated virtual destination storage apparatus130is encrypted or not (Step1502).

Next, the management computer140judges whether the restoration destination apparatus designated by the administrator is identical with the virtual destination storage apparatus130(Step1503).

In the case where the restoration destination apparatus designated by the administrator is different from the virtual destination storage apparatus130, the management computer140externally couples the virtual destination storage apparatus130designated by the administrator to the restoration destination apparatus, and virtualizes the LU135of the designated virtual destination storage apparatus130(Step1504). For example, the administrator may designate which one of the LUs125of the restoration destination apparatus is to virtualize the LU135of the virtual destination storage apparatus130, or the management computer140may automatically create an arbitrary LU in a free port of the restoration destination apparatus so as to associate the created LU125with the LU135.

Next, the management computer140judges, based on the encryption key/encryption setting information backup information241in the management computer140, whether the virtual destination storage apparatus130designated by the administrator is encrypted or not (Step1505).

In the case where the virtual destination storage apparatus130designated by the administrator is encrypted, the management computer140obtains, from the encryption key/encryption setting information backup information241in the management computer140, the encryption key/encryption setting information of the virtual destination storage apparatus130designated by the administrator, and transmits the obtained information to the restoration destination apparatus, to thereby instruct restoration of the information (Step1506).

For example, in the case where the item817does not include information corresponding to the virtual destination storage apparatus130designated by the administrator, it can be identified that the corresponding virtual destination storage apparatus130is not encrypted.

On the other hand, in the example ofFIG. 8, for example, in the case where the entry having “D700-110” in the Item817corresponds to the virtual destination storage apparatus130designated by the administrator, an encryption key having the ID number “5” in the item812is obtained as the encryption key for the virtual destination storage apparatus130.

In the case where it has been judged in Step1505that the virtual destination storage apparatus130designated by the administrator is not encrypted, the management computer140does not transmit the encryption key/encryption setting information to the restoration destination apparatus, and the process proceeds to Step1217.

In the case where it has been judged in Step1503that the restoration destination apparatus designated by the administrator is identical with the virtual destination storage apparatus130, the management computer140maps the LU135of the virtual destination storage apparatus130designated by the administrator as the real LU of the restoration destination apparatus (Step1507).

Next, the management computer140judges, in a manner similar to that in the process of Step1505, whether the virtual destination storage apparatus130designated by the administrator is encrypted or not (Step1508).

In the case where the virtual destination storage apparatus130designated by the administrator is encrypted, the management computer140obtains, from the encryption key/encryption setting information backup information241in the management computer140, the encryption key/encryption setting information of the virtual destination storage apparatus130designated by the administrator, and transmits the obtained information to the restoration destination apparatus, to thereby instruct restoration of the information (Step1509).

In the case where it has been judged in Step1508that the virtual destination storage apparatus130designated by the administrator is not encrypted, the management computer140does not transmit the encryption key/encryption setting information to the restoration destination apparatus, and the process proceeds to Step1222.

Described above is the first modification example of the restoration instruction process executed by the management computer140.

Next, a second modification example, which is another modification example of the restoration instruction process, will further be described. According to the above-mentioned restoration instruction process, the management computer140is provided with sophisticated functions, such as a function of extracting in part the encryption key/encryption setting information backup information241of the storage apparatus120. However, in the second modification example described below, the above-mentioned function is not provided to the management computer140, and the administrator simply restores, directly to the storage apparatus120, the encryption key/encryption setting information backup information241backed up from the storage apparatus120.

Modification Example 2 of Restoration Instruction Process Executed by Management Computer

The second modification example of the flow of the restoration instruction process executed by the management computer140will be described.

FIGS. 16A and 16Bare flowcharts illustrating the second modification example of the restoration instruction process executed by the encryption key/encryption setting information restoration instruction program246of the management computer140according to the first embodiment of this invention, with respect to the storage apparatus120or the virtual destination storage apparatus130.

Of the processes ofFIGS. 16A and 16B, Steps1201to1211,1216,1217,1221, and1222are similar to those illustrated inFIGS. 12A and 12B, and therefore the description of those Steps will be omitted.

After the process of Step1211has been completed, the administrator determines the restoration destination apparatus, and further determines which one of the virtual destination storage apparatuses130of the failed apparatus is subjected to the restoration of the encryption key/encryption setting information (Step1601).

The administrator judges whether the determined restoration destination apparatus is the same storage apparatus as the virtual destination storage apparatus130(Step1602).

In the case where the restoration destination apparatus is different from the virtual destination storage apparatus130, the administrator externally couples the determined virtual destination storage apparatus130to the restoration destination apparatus by using the management computer140, and virtualizes the LU135of the virtual destination storage apparatus130(Step1603).

Next, the administrator selects the encryption key/encryption setting information backup information241of the failed apparatus, directly transmits the selected information to the restoration destination apparatus, and instructs restoration of the information (Step1604).

On the other hand, in the case where it has been judged in Step1602that the restoration destination apparatus is identical with the virtual destination storage apparatus130, the administrator maps the virtual LU of the virtual destination storage apparatus130determined as described above, as the real LU of the restoration destination apparatus (Step1605). It should be noted that, when the administrator maps the virtual LU in this case, the administrator merely regards that the corresponding virtual LU and the entity of the real LU are identical with each other, rather than performing any special operation.

Next, similarly in Step1604, the administrator selects the encryption key/encryption setting information backup information241of the failed apparatus, transmits the selected information as it is to the restoration destination apparatus, and instructs restoration of the information (Step1606).

Described above is the second modification example of the restoration instruction process executed by the management computer140.

Next, a second embodiment of this invention will be described.

The system configuration of the second embodiment of this invention is similar to that of the first embodiment shown inFIG. 1. Therefore, the description of the system configuration will be omitted.

According to the first embodiment of this invention, the encryption key/encryption setting information of the failed apparatus itself or of the virtual destination storage apparatus130that has been virtualized by the failed apparatus is restored. In contrast to this, according to the second embodiment of this invention, the management computer140executes the restoration of the encryption key/encryption setting information in an integrated manner, with consideration given to the possibilities that the encryption key/encryption setting information backup information241of the storage apparatus120that has not necessarily failed is transmitted by mistake, and that, in a case where the encryption key or the like has been lost due to, for example, a failure in the memory of the storage apparatus120, the encryption key/encryption setting information backup information241is transmitted to the backup source storage apparatus120itself.

The following description of this embodiment will be given based on the premise that the encryption key/encryption setting information of the storage apparatus120shown inFIG. 3,4, or6has already been set by using the encryption setting instruction program244and the backup shown inFIG. 8of the information has already been obtained. Further, the description of the processes similar to those in the first embodiment of this invention will be omitted. Hereinbelow, the second embodiment of this invention will be described with reference toFIGS. 18 and 19.

In this embodiment, the management computer140executes two processes described below. In the first process, the management computer140monitors the storage apparatus120shown inFIG. 18. In the second process, upon receiving a restoration request from the administrator after the administrator has recognized the failure in the storage apparatus120, the management computer140transmits, to the restoration destination apparatus designated by the administrator, the encryption key/encryption setting information backup information designated by the administrator, and instructs restoration of the information shown inFIGS. 19A and 19B.

(Monitoring Process Executed by Management Computer to Monitor Storage Apparatus)

FIG. 18is a flowchart illustrating an example of the monitoring process executed by the storage management instruction program247of the management computer140according to the second embodiment of this invention to monitor the storage apparatus120.

The management computer140periodically transmits a predetermined signal (so called heart beat) to the storage apparatus120, and monitors whether there is a response to the signal or not (Step1801).

In the case where the response as described above cannot be received from the storage apparatus120, the management computer140notifies the administrator of the fact that no response has been received. For example, the management computer140transmits a heart beat to the storage apparatus120and waits for a predetermined period. In the case where no response has been received with respect to the heart beat after a lapse of the predetermined period, the management computer140may alert the administrator to the fact that no response with respect to the heart beat has been received.

The administrator checks whether a failure has occurred or not in the storage apparatus120(Step1802). The administrator may perform this checking operation by executing, for example, a maintenance operation for checking the status of the storage apparatus120through the management computer140or the management terminal, which is not shown, of the storage apparatus120.

In the case where a failure has occurred in the storage apparatus120, the administrator decouples the storage apparatus120from the FC switch110(Step1803).

(Restoration Instruction Process Executed by Management Computer)

FIGS. 19A and 19Bare flowcharts illustrating an example of the restoration instruction process executed by the encryption key/encryption setting information restoration instruction program246of the management computer140, with respect to the storage apparatus120, according to the second embodiment of this invention.

The processes ofFIGS. 19A and 19Bmay be executed when it has been determined by the process ofFIG. 18that a failure has occurred in the storage apparatus120, or may be executed in any other cases than the above.

The management computer140receives a restoration request for restoring the encryption key/encryption setting information, from the administrator (Step1901), and authenticates the administrator (Steps1902and1903). The authentication is performed in a manner similar to that in Steps1202and1203.

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the management computer140accepts the designation of the restoration destination apparatus and the encryption key/encryption setting information backup information241to be restored, from the administrator (Step1904).

Next, the management computer140judges whether or not a failure has occurred in the backup source apparatus indicated by the designated encryption key/encryption setting information backup information241(Step1905). For example, the management computer140transmits a heart beat to the IP address of the backup source apparatus indicated by the designated encryption key/encryption setting information backup information241, and judges whether a response with respect to the heart beat is received or not. Alternatively, the management computer140may execute discovery. Still alternatively, the management computer140may check whether the management information140includes or not the configuration information of the backup source apparatus.

The IP address of the backup source apparatus can be obtained, for example, based on the information in the item502or from the storage management information242. In the case where the backup source apparatus is decoupled from the FC switch110due to a failure occurring in the apparatus, the configuration information of the backup source apparatus (that is, the failed apparatus) is deleted from the management computer140, and therefore the management computer140may not be able to obtain the IP address of the corresponding backup source apparatus. However, in the case where the configuration information of the backup source apparatus is not found, the management computer140can determine that the failed apparatus does not exist in the computer system (that is, the failed apparatus has been decoupled due to a failure or the like).

The management computer140judges, through the process illustrated, for example, in Step1905described above, whether or not the backup source apparatus has failed (Step1906).

In the case where it has been judged that the backup source apparatus has not failed, the management computer140judges whether the backup source apparatus is identical with the restoration destination apparatus (Step1913).

In the case where the backup source apparatus is different from the restoration destination apparatus, it is requested to restore, to another apparatus, the encryption key or the like backed up from the backup source apparatus, in spite of the fact that the backup source apparatus has not failed. The restoration in the above-mentioned case is not permitted in this embodiment, and therefore the process is ended.

On the other hand, in the case where the backup source apparatus is identical with the restoration destination apparatus, it is requested to restore the encryption key or the like backed up from the backup source apparatus, to the same backup source apparatus. The request as described above may be made in the case where the backup source apparatus has lost the encryption key or the like due to a temporary failure or the like. In this case, the management computer140transmits the encryption key/encryption setting information backup information241to the restoration destination apparatus, and instructs restoration of the information (Step1914).

Next, the management computer140judges whether or not a path between the storage area of the restoration destination apparatus and the computer100has already been set (Step1915).

In the case where the path has already been set, the process is ended.

In the case where the path is yet to be set, the management computer140waits until a notification that the restoration has been completed is received from the restoration destination apparatus. When the notification is received, the management computer140sets a path between the LU of the restoration destination apparatus and the computer100(Step1916). For example, in the case of setting a path which is the same as that before the restoration, the management computer140sets the path according to the setting in the item304.

In the case where it has been judged in Step1906that the backup source apparatus has failed, the management computer140judges whether or not the encryption key/encryption setting information backup information241designated by the administrator includes the encryption key/encryption setting information of the virtual destination storage apparatus130(Step1907).

In the case where the encryption key/encryption setting information backup information241designated by the administrator does not include the encryption key/encryption setting information of the virtual destination storage apparatus130, the process proceeds to Step1914.

In the case where the encryption key/encryption setting information backup information241designated by the administrator includes the encryption key/encryption setting information of the virtual destination storage apparatus130, the management computer140cancels the LUN Security set in the storage area of the virtual destination storage apparatus130(Step1908). As a result, other storage apparatuses120are allowed to access the virtual destination storage apparatus130. However, the process in Step1908is not necessarily performed. In the case where the LUN Security has not been originally set in the storage area of the virtual destination storage apparatus130, it is not necessary to perform Step1908.

Next, the management computer140judges whether or not the restoration destination apparatus is identical with the virtual destination storage apparatus130included in the encryption key/encryption setting information backup information241(Step1909).

In the case where the restoration destination apparatus is different from the virtual destination storage apparatus130included in the encryption key/encryption setting information backup information241, the management computer140externally couples the virtual destination storage apparatus130included in the encryption key/encryption setting information backup information241designated by the administrator to the restoration destination apparatus, and virtualizes the LU135of the virtual destination storage apparatus130(Step1910).

Next, the management computer140transmits the encryption key/encryption setting information backup information241to the restoration destination apparatus, and instructs restoration (Step1911).

Upon receiving the notification that the restoration has been completed, from the restoration destination apparatus, the management computer140sets a path between the computer100, which has been communicably coupled to the virtual LU of the backup source apparatus through a path, and the virtual LU of the restoration destination apparatus (Step1912). For example, in the case where the restoration destination apparatus newly virtualizes and restores the LU135identified by the LU number “1” in the virtual storage apparatus130that has been virtualized by the LU125identified by the LU number “3” in the item402ofFIG. 4, a path is set between the computer in the item304set to the LU identified by the LU number “3” inFIG. 3and a new virtualized LU of the restoration destination apparatus. Alternatively, it is also possible, after a failure or the like, to newly set a path different from the path that has been originally set.

Next, the management computer140judges whether or not the encryption key/encryption setting information backup information241designated by the administrator includes the encryption key/encryption setting information of another virtual destination storage apparatus130(Step1920).

In the case where the encryption key/encryption setting information of the other virtual destination storage apparatus130is included, the process proceeds to Step1908.

On the other hand, in the case where the encryption key/encryption setting information of the other virtual destination storage apparatus130is not included, the process is ended.

In the case where it has been judged in Step1909that the restoration destination apparatus is identical with the virtual destination storage apparatus130included in the encryption key/encryption setting information backup information241, the management computer140maps a virtual LU virtualizing the LU135of the virtual destination apparatus130included in the encryption key/encryption setting information backup information241designated by the administrator, as the real LU of the restoration destination apparatus (Step1917).

Next, the management computer140transmits the encryption key/encryption setting information backup information241designated by the administrator, to the restoration destination apparatus, and instructs restoration of the information (Step1918).

Upon receiving the notification of the result of the restoration from the restoration destination apparatus, the management computer140sets a path between the computer100, which has been communicably coupled to the virtual LU of the backup source apparatus through the path, and the real LU of the restoration destination apparatus (Step1919). After that, the process proceeds to Step1920.

Next, a third embodiment of this invention will be described.

FIG. 20is a block diagram illustrating a hardware configuration of a computer system according to the third embodiment of this invention.

According to the third embodiment, an encryption management server150, which integrally manages the encryption key/encryption setting information of the storage apparatuses120, is additionally provided to the computer system configuration of the first and second embodiments.

An outline of the process according to this embodiment will be described.

In the case of backing up the encryption key/encryption setting information, an administrator instructs the storage apparatus120to backup the information to the encryption management server150. The storage apparatus120, which has received the instruction, backs up the encryption key/encryption setting information to the encryption management server150. On the other hand, in the case of restoring the encryption key/encryption setting information, the administrator instructs the encryption management server150to transmit the encryption key/encryption setting information in the encryption management server150to the storage apparatus120. The encryption management server150, which has received the instruction, transmits the encryption key/encryption setting information to the storage apparatus120. The storage apparatus120, which has received the encryption key/encryption setting information, restores the information.

The encryption management server150will be described.

The encryption management server150includes a CPU151, a memory152, and a management I/F153. The management I/F153is coupled to the computer100and the management computer140via the IP network. The management computer140is capable of managing the encryption management server150through the management I/F153. The encryption management server150may also be coupled to the storage apparatus120and to the virtual destination storage apparatus130via the FC network.

The encryption management server150loads, for example, when activated, programs and the like for managing the encryption key/encryption setting information backup information241of the storage apparatus120, into the memory152. The programs and the like are recorded in a non-volatile recording medium such as a hard disk drive, which is not shown, of the encryption management server150. The CPU151executes the programs and the like thus loaded, to thereby, for example, transmit or receive the encryption key/encryption setting information backup information241to and from the storage apparatus120.

Next, software configurations of the storage apparatus120and the encryption management server150according to the this embodiment will be described.

FIG. 21is an explanatory diagram illustrating an example of the software configuration of the computer system according to the third embodiment of this invention.

The memory152of the encryption management server150stores encryption key/encryption setting information backup information integrated management information2101, administrator authentication information2102, an encryption key/encryption setting information backup information integrated management program2103, and an access control program2104.

FIG. 22is an explanatory diagram illustrating an example of the encryption key/encryption setting information backup information integrated management information2101according to the third embodiment of this invention.

The encryption key/encryption setting information backup information integrated management information2101includes three data items including items2201to2203.

The item2201stores an IP address or a host name of each storage apparatus120or each virtual destination storage apparatus130that transmits the encryption key setting information backup information to the encryption management server150. However, the value for this item is not limited thereto, and another value such as a port name (WWN) or the like of, for example, each storage apparatus120or the like may also be stored as long as the value is capable of uniquely identifying each storage apparatus120or the like.

The item2202stores an identifier of the encryption key/encryption setting information backup information241which has been backed up from the storage apparatus120or the like identified by the information in the item2201.

The item2203stores information for identifying an administrator who is allowed to access data identified by the information in the item2202. For example, the administrator can request the encryption management server150to transmit, of the data items identified by the information in the item2202, only the data item accessible to the administrator, to the storage apparatus120or the like.

FIG. 23is an explanatory diagram illustrating an example of the administrator authentication information2102according to the third embodiment of this invention.

The administrator authentication information2102includes three data items including items2301to2303.

The item2301stores a user ID for uniquely identifying each administrator using the encryption management server150.

The item2302stores a password of each administrator to be used to login the encryption management server150.

The item2303stores role information for controlling an operation to be executed on the encryption management server150by each administrator. For example, in the case where the role information corresponding to a user ID of “ABC” stores “an instruction to transmit the encryption key/encryption setting information backup information”, an administrator identified by the user ID of “ABC” can instruct the encryption management server150to transmit data identified by the information in the item2202, to the storage apparatus120or the like.

Next, with reference again toFIG. 21, the program information of the encryption management server150will be described. The memory152stores the encryption key/encryption setting information backup information integrated management program2103and the access control program2104.

The encryption key/encryption setting information backup information integrated management program2103transmits, in response to an instruction from an administrator, data in the item2202to the storage apparatus120or the like. Further, encryption key/encryption setting information backup information integrated management program2103manages the encryption key/encryption setting information backup information241received from the storage apparatus120or the like, in the form as illustrated inFIG. 22, so as to associate each item of the information with each storage apparatus120or the like.

The access control program2104performs authentication and access control of an administrator making an access request to the encryption management server150. Further, the access control program2104performs authentication and access control of a storage apparatus120making an access request to the encryption management server150. Described above is the software configuration of the encryption management server150.

Next, the software configuration of the storage apparatus120according to this embodiment will be described. Of the information and programs illustrated inFIG. 21, the LU management information201, the virtual LU mapping information202, the storage apparatus model/production number management information203, the encryption key management information204, the I/O processing program205, the encryption setting program206, and the storage management program209are similar to those illustrated inFIG. 2. Therefore, the description thereof will be omitted.

The control memory124of the storage apparatus120stores, in addition to the above-mentioned information, encryption management server information2121.

FIG. 24is an explanatory diagram illustrating an example of the encryption management server information2121according to the third embodiment of this invention.

The encryption management server information2121includes an item2401. The item2401stores an IP address or a host name of each encryption management server150which is a transmission destination of the encryption key/encryption setting information backup information241transmitted by the storage apparatus120. Alternatively, the item2401may store any other information than the IP address or the host name, which is capable of uniquely identifying each encryption management server150.

InFIG. 20, only one encryption management server150is illustrated. However, the computer system according to this embodiment may actually be provided with a plurality of the encryption management servers150. In the case where the storage apparatus120transmits the encryption key/encryption setting information backup information241to the plurality of encryption management servers150, the item2401stores identification information for identifying each of the plurality of encryption management servers150.

Next, the program information of the storage apparatus120will be described. The control memory124stores, in addition to the above-mentioned programs, an encryption key/encryption setting information backup program207, an encryption key/encryption setting information restoration program208, and an encryption management server authentication program2122.

According to this embodiment, the encryption key/encryption setting information backup program207backs up the encryption key/encryption setting information backup information241to the encryption management server150. The encryption key/encryption setting information restoration program208receives the encryption key/encryption setting information backup information241from the encryption management server150and executes restoration of the information.

The encryption management server authentication program2122authenticates, when the storage apparatus120is to receive the encryption key/encryption setting information backup information241from the encryption management server150, the encryption management server150.

Described above is the software configuration of the storage apparatus120according to this embodiment. Next, a backup/restoration process for the encryption key/encryption setting information according to this embodiment will be described. In this case, the information items illustrated inFIGS. 22 to 24, such as account information of each administrator, information on the encryption management server150, and information on the transmission source storage apparatus, have already been registered.

(Backup Process Using Encryption Management Server)

FIG. 25is a flowchart illustrating an example of a process of backing up the encryption key/encryption setting information to the encryption management server150from the storage apparatus120according to the third embodiment of this invention.

The management computer140receives a login request from an administrator (Step2501), authenticates the administrator (Step2502), and judges whether the authentication of the administrator has succeeded or not (Step2503).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the administrator instructs the storage apparatus120to back up the encryption key/encryption setting information (Step2504).

The storage apparatus120, which has received the instruction, backs up the encryption key/encryption setting information backup information241to the encryption management server150(that is, transmits the encryption key/encryption setting information backup information241to the encryption management server150) (Step2505). For example, the encryption key/encryption setting information backup information241is transmitted to the address of the encryption management server150stored in the item2401.

The encryption management server150, which has received the encryption key/encryption setting information backup information241, authenticates the storage apparatus120of the transmission source (Step2506), and judges whether the authentication has succeeded or not (Step2507).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the encryption management server150integrally manages the encryption key/encryption setting information backup information241received from the storage apparatus120(Step2508).

(Restoration Process Using Encryption Management Server)

FIG. 26is a flowchart illustrating an example of a process of transmitting the encryption key/encryption setting information to the storage apparatus120from the encryption management server150according to the third embodiment of this invention, and restoring the encryption key/encryption setting information.

The management computer140receives a login request from an administrator (Step2601), authenticates the administrator (Step2602), and judges whether the authentication has succeeded or not (Step2603).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the administrator makes a login request from the management computer140to the encryption management server150(Step2604).

The encryption management server150authenticates the administrator who has made the login request (Step2605), and judges whether the authentication has succeeded or not (Step2606).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the administrator designates the encryption key/encryption setting information backup information241in the encryption management server150, and instructs the encryption management server150to transmit the designated information to the restoration destination apparatus designated by the administrator (Step2607). For example, in the example ofFIG. 22, the administrator designates a data item from among the data items included in the item2202, while designating the restoration destination apparatus, and instructs the encryption management server150to transmit the designed data item in the item2202to the restoration destination apparatus.

The encryption management server150transmits the encryption key/encryption setting information backup information designated by the administrator, to the designated restoration destination apparatus (Step2608).

The restoration destination apparatus, which has received the information, authenticates the encryption management server150of the transmission source (Step2609), and judges whether the authentication has succeeded or not (Step2610).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the restoration destination apparatus receives the encryption key/encryption setting information backup information241transmitted from the encryption management server150, and executes, by using the received information, the restoration processes in and after Step1302ofFIGS. 13A and 13B(Step2611).

Described above is the process of backing up and restoring the encryption key/encryption setting information according to this embodiment.

Next, a first modification example of this embodiment will be described. According to this modification example, in restoring the encryption key/encryption setting information, rather than the administrator making a request with respect to the encryption management server150to transmit the encryption key/encryption setting information, the storage apparatus120directly transmits, to the encryption management server150, an acquisition request for acquiring the encryption key/encryption setting information. In the following, a description will be given only of the restoration process of restoring the encryption key/encryption setting information that is different from the process described above. In other words, the backup process of backing up the encryption key/encryption setting information is similar to that illustrated inFIG. 25, and therefore the description thereof will be omitted.

Modification Example 1 of Restoration Process Using Encryption Management Server

FIG. 27is an explanatory diagram illustrating a first modification example of the encryption key/encryption setting information backup information integrated management information2101according to the third embodiment of this invention.

The encryption key/encryption setting information backup information integrated management information2101illustrated inFIG. 27includes three data items including items2201,2202, and2701.

The items2201and2202are similar to those illustrated inFIG. 22, and therefore the description thereof will be omitted.

The item2701stores an IP address or a host name of a storage apparatus120or a virtual destination storage apparatus130that is allowed to access data identified by the information in the item2202. The data in the item2701is used for authenticating each storage apparatus. Accordingly, the item2701stores may store any other information than the IP address or the host name, as long as the information is capable of uniquely identifying each storage apparatus.

FIG. 28is an explanatory diagram illustrating a first modification example of the administrator authentication information2102according to the third embodiment of this invention.

The administrator authentication information2101includes three data items including items2301to2303. Those items are similar to those illustrated inFIG. 23, and therefore the description thereof will be omitted.

However, according to this modification example, there may be a case where “registration of a storage apparatus that is capable of accessing a management server” may be stored as the role information. For example, in the case where the “registration of a storage apparatus that is capable of accessing a management server” is stored as the role information corresponding to the user ID of “ABC”, an administrator identified by the user ID “ABC” is allowed to newly store, in the item2701, information for identifying a storage apparatus that is allowed to access data identified by the information included in the item2202.

FIG. 29is a flowchart illustrating a first modification of the process of transmitting and restoring the encryption key/encryption setting information by the encryption management server150to the storage apparatus120according to the third embodiment of this invention.

The management computer140receives a login request from an administrator (Step2901), authenticates the administrator (Step2902), and judges whether the authentication has succeeded or not (Step2903).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the administrator makes a login request from the management computer140to the encryption management server150(Step2904).

The encryption management server authenticates the administrator who has made the login request (Step2905), and judges whether the authentication has succeeded or not (Step2906).

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the administrator designates the encryption key/encryption setting information backup information241in the encryption management server150, and newly adds a restoration destination apparatus, as the storage apparatus120that is allowed to access the designated information (Step2907).

For example, in the example ofFIG. 22, in the case where a failure has occurred in the storage apparatus120identified by “10.1.1.1” stored in the item2201of a first entry and an administrator desires to restore the information backed up from the failed apparatus to the restoration destination apparatus identified by the address “A1”, the administrator adds, to the item2701of the first entry, the address “A1” of the restoration destination apparatus to be newly added. As a result, two addresses of “10.1.1.1” and “A1” are stored in the item2701of the first entry.

Next, the administrator instructs the storage apparatus120, from the management server140, to obtain the encryption key/encryption setting information backup information241of the storage apparatus120designated by the administrator, from the encryption management server150, and to restore the information (Step2908).

The storage apparatus120requests the encryption management server150to obtain the encryption key/encryption setting information backup information241of the storage apparatus120designated by the administrator (Step2909).

The encryption management server150authenticates the storage apparatus120that has made the request to obtain the encryption key/encryption setting information backup information241(that is, the restoration destination apparatus) (Step2910, Step2911), and judges whether the authentication has succeeded or not.

In the case where the authentication has failed, the process is ended.

In the case where the authentication has succeeded, the encryption management server150transmits the encryption key/encryption setting information backup information241to the restoration destination apparatus (Step2912). The storage apparatus120receives the encryption key/encryption setting information backup information241transmitted from the encryption management server150, and executes the restoration processes in and after Step1302ofFIGS. 13A and 13Bby using the received information (Step2913).

According to the above-mentioned embodiment of this invention, for example, in a computer system including a computer, a management computer, first and second storage apparatuses each having a virtualizing function and an encryption function (hereinafter, also referred to as virtualization control storage apparatuses), and at least one third storage apparatus (hereinafter, also referred to as virtual destination storage apparatuses) which is virtualized by the virtualization control storage apparatus, the storage area of the third storage apparatus is virtualized and encrypted by the first storage apparatus. An encryption key for the first storage apparatus is backed up in a manner that the encryption key for the first storage apparatus and the encryption key for the virtual destination storage apparatus can be discriminated from each other.

When the first storage apparatus fails, the third storage apparatus is newly coupled to the second storage apparatus, and an encryption key backed up from the first storage apparatus is restored to the second storage apparatus. In this case, the second storage apparatus performs the following process.

It is judged whether the encryption keys which have been requested to be restored include an encryption key backed up from the second storage apparatus or not. In the case where the encryption keys include an encryption key backed up from the second storage apparatus and no encryption key is set to the second storage apparatus, the second storage apparatus restores the encryption key.

In the case where the encryption keys which have been requested to be restored do not include an encryption key backed up from the second storage apparatus, the second storage apparatus judges whether the encryption keys which have been requested to be restored include or not an encryption key for the own apparatus of the backup source storage apparatus (first storage apparatus). In the case where it has been judged the encryption key for the own apparatus is included, the restoration of the encryption key for the own apparatus of the first storage apparatus is not executed.

Of the encryption keys which have been requested to be restored, it is judged whether the rest of the encryption keys include an encryption key to be used in the case where the second storage apparatus itself has been virtualized, or an encryption key for the third storage apparatus virtualized by the second storage apparatus. In the case where it has been judged that any of the above-mentioned encryption keys is included, the encryption key is restored to the second storage apparatus.

According to the above-mentioned embodiment of this invention, in a computer system including a storage apparatus having a function of encrypting/decrypting data, a function of backing up/restoring the encryption key/encryption setting information, and a function of virtualizing the encryption key/encryption setting information, even when the storage apparatus fails, the encryption key of the failed storage apparatus can be correctly restored to another storage apparatus. Accordingly, it is possible to decrypt data in an encrypted storage area without damaging the data.