A computer system adapted to facilitate storage encryption and decryption, the system comprising: a key management device; and a security device comprising a processor; and a memory coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising: receiving a first request from a user to encrypt data, wherein the first request indicates the data to be encrypted; encrypting the data based on a key; determining a key label for the key; and transmitting the encrypted data and the key label to a remote device for storage, wherein the method further comprises updating the key based on a dynamic key refreshment protocol, which comprises: obtaining a first new key from a first key pool; transmitting a first synchronization request to a key-managing device, which causes the key-managing device to obtain from a second key pool of the key-managing device a second new key which is the same as the first new key; and obtaining a first new key label for the first new key, wherein the first new key label is the same as a second new key label obtained for the second new key, wherein the first new key is the key used to encrypt the data, and wherein the first new key label is the determined key label; the method further comprising: receiving a first request from the remote device to decrypt encrypted data, wherein the first decryption request indicates the encrypted data and the key label for a first key used to encrypt the data; transmitting a second request for the first key to a key-managing device, wherein the second request includes the key label; receiving the first key from the key-managing device; and decrypting the encrypted data based on the received first key; wherein prior to transmitting the second request to the key-managing device: obtaining a second key from a first key pool; and transmitting a synchronization request to the key-managing device, which causes the key-managing device to obtain from a second key pool of the key-managing device a third key which is the same as the second key; encrypting, based on the second key, the key label included in the second request, wherein the received first key is encrypted based on the third key; and decrypting, based on the second key, the encrypted received first key. a key management device; and a security device comprising a processor; and a memory coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising: receiving a first request from a user to encrypt data, wherein the first request indicates the data to be encrypted; encrypting the data based on a key; determining a key label for the key; and transmitting the encrypted data and the key label to a remote device for storage, wherein the method further comprises updating receiving a first request from a user to encrypt data, wherein the first request indicates the data to be encrypted; encrypting the data based on a key; determining a key label for the key; and transmitting the encrypted data and the key label to a remote device for storage, wherein the method further comprises updating the key based on a dynamic key refreshment protocol, which comprises: obtaining a first new key from a first key pool; transmitting a first synchronization request to a key-managing device, which causes the key-managing device to obtain from a second key pool of the key-managing device a second new key which is the same as the first new key; and obtaining a first new key label for the first new key, wherein the first new key label is the same as a second new key label obtained for the second new key, receiving a first request from the remote device to decrypt encrypted data, wherein the first decryption request indicates the encrypted data and the key label for a first key used to encrypt the data; transmitting a second request for the first key to a key-managing device, wherein the second request includes the key label; receiving the first key from the key-managing device; and decrypting the encrypted data based on the received first key; wherein prior to transmitting the second request to the key-managing device: obtaining a second key from a first key pool; and transmitting a synchronization request to the key-managing device, which causes the key-managing device to obtain from a second key pool of the key-managing device a third key which is the same as the second key; obtaining a second key from a first key pool; and transmitting a synchronization request to the key-managing device, which causes the key-managing device to obtain from a second key pool of the key-managing device a third key which is the same as the second key; encrypting, based on the second key, the key label included in the second request, wherein the received first key is encrypted based on the third key; and decrypting, based on the second key, the encrypted received first key.