A non-transitory computer readable medium storing computer readable instructions that, when executed, cause an apparatus to: encrypt a storage area provisioned for a virtual or actual machine with a first encryption key to form an encrypted storage area; store the first encryption key in a header of the storage area, wherein the header and the storage area are logically separate from one another; encrypt, using a second encryption key (H1VM1), the first encryption key stored in the header; store the second encryption key in the header; and responsive to a request to migrate the storage area from a first location to a second location: decrypt, using the second encryption key (H1VM1), the encrypted first encryption key; encrypt, using a third encryption key, the first encryption key, wherein the third encryption key is a transfer key; store the third encryption key in the header; after encrypting the first encryption key with the third encryption key, remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key; encrypt the first encryption key with a fourth encryption key (H2VM1); and store the fourth encryption key in the header. encrypt a storage area provisioned for a virtual or actual machine with a first encryption key to form an encrypted storage area; store the first encryption key in a header of the storage area, wherein the header and the storage area are logically separate from one another; encrypt, using a second encryption key (H1VM1), the first encryption key stored in the header; store the second encryption key in the header; and responsive to a request to migrate the storage area from a first location to a second location: decrypt, using the second encryption key (H1VM1), the encrypted first encryption key; encrypt, using a third encryption key, the first encryption key, wherein the third encryption key is a transfer key; store the third encryption key in the header; after encrypting the first encryption key with the third encryption key, remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key; encrypt the first encryption key with a fourth encryption key (H2VM1); and store the fourth encryption key in the header. decrypt, using the second encryption key (H1VM1), the encrypted first encryption key; encrypt, using a third encryption key, the first encryption key, wherein the third encryption key is a transfer key; store the third encryption key in the header; after encrypting the first encryption key with the third encryption key, remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key; encrypt the first encryption key with a fourth encryption key (H2VM1); and store the fourth encryption key in the header.