A non-transitory computer readable medium storing computer readable instructions that, when executed, cause an apparatus to: encrypt a storage area provisioned for a virtual or actual machine with a first encryption key (K1) to form an encrypted storage area; store the first encryption key (K1) in a header of the storage area, wherein the header and the storage area are logically separate from one another; encrypt, using a second encryption key (H1VM1), the first encryption key stored in the header; store the second encryption key in the header; and responsive to a request to migrate the storage area from a first location to a second location: decrypt, using the second encryption key (H1VM1), the encrypted first encryption key (K1); encrypt, using a third encryption key (TK1), the first encryption key (K1), wherein the third encryption key (TK1) is a transfer key; store the third encryption key in the header; after encrypting the first encryption key (K1) with the third encryption key (TK1), remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key (TK1); encrypt the first encryption key (K1) with a fourth encryption key (H2VM1); and store the fourth encryption key in the header. encrypt a storage area provisioned for a virtual or actual machine with a first encryption key (K1) to form an encrypted storage area; store the first encryption key (K1) in a header of the storage area, wherein the header and the storage area are logically separate from one another; encrypt, using a second encryption key (H1VM1), the first encryption key stored in the header; store the second encryption key in the header; and responsive to a request to migrate the storage area from a first location to a second location: decrypt, using the second encryption key (H1VM1), the encrypted first encryption key (K1); encrypt, using a third encryption key (TK1), the first encryption key (K1), wherein the third encryption key (TK1) is a transfer key; store the third encryption key in the header; after encrypting the first encryption key (K1) with the third encryption key (TK1), remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key (TK1); encrypt the first encryption key (K1) with a fourth encryption key (H2VM1); and store the fourth encryption key in the header. decrypt, using the second encryption key (H1VM1), the encrypted first encryption key (K1); encrypt, using a third encryption key (TK1), the first encryption key (K1), wherein the third encryption key (TK1) is a transfer key; store the third encryption key in the header; after encrypting the first encryption key (K1) with the third encryption key (TK1), remove the second encryption key (H1VM1) from the header; after the second encryption key is removed from the header, migrate the encrypted storage area and the header from the first location to the second location; decrypt the encrypted first encryption key with the third encryption key (TK1); encrypt the first encryption key (K1) with a fourth encryption key (H2VM1); and store the fourth encryption key in the header. <EOS>