A method, comprising: receiving a request to transfer a source data center key object from a source data center to a destination data center, the source data center key object corresponding to a data block maintained in a storage area network, SAN, wherein the source data center key object includes an encryption key in encrypted form for encrypting and/or decrypting data, a unique identifier for the source data center key object , and a wrapper unique identifier identifying a separate key object in a key database at a key management center, the separate key object having been used to encrypt the encryption key ; decrypting the encrypted encryption key using a source data center key hierarchy, wherein in a key hierarchy keys are encrypted using intermediate keys maintained at the key management center and the intermediate keys are encrypted with other intermediate keys or a master key, whereby the encryption key is decrypted using intermediate keys and/or a master key of the source data center key hierarchy having the separate key object identified in the wrapper unique identifier of the source data key center object; transmitting the wrapper unique identifier , key state information and the decrypted encryption key from the source data center to the destination data center; generating a destination data center key object using a destination data center key hierarchy, whereby the decrypted encryption key is encrypted using intermediate keys and/or a master key of the destination data center key hierarchy to form a destination data center key object having a new unique identifier for the destination data center key object, the encryption key in encrypted form, and a new wrapper unique identifier identifying another separate key object, the another separate key object having been used to encrypt the encryption key. receiving a request to transfer a source data center key object from a source data center to a destination data center, the source data center key object corresponding to a data block maintained in a storage area network, SAN, wherein the source data center key object includes an encryption key in encrypted form for encrypting and/or decrypting data, a unique identifier for the source data center key object , and a wrapper unique identifier identifying a separate key object in a key database at a key management center, the separate key object having been used to encrypt the encryption key ; decrypting the encrypted encryption key using a source data center key hierarchy, wherein in a key hierarchy keys are encrypted using intermediate keys maintained at the key management center and the intermediate keys are encrypted with other intermediate keys or a master key, whereby the encryption key is decrypted using intermediate keys and/or a master key of the source data center key hierarchy having the separate key object identified in the wrapper unique identifier of the source data key center object; transmitting the wrapper unique identifier , key state information and the decrypted encryption key from the source data center to the destination data center; generating a destination data center key object using a destination data center key hierarchy, whereby the decrypted encryption key is encrypted using intermediate keys and/or a master key of the destination data center key hierarchy to form a destination data center key object having a new unique identifier for the destination data center key object, the encryption key in encrypted form, and a new wrapper unique identifier identifying another separate key object, the another separate key object having been used to encrypt the encryption key. <EOS>