Patent ID: 8438403

Claim:
A storage apparatus coupled to a host system and configured to control writing of data in response to a write command from said host system, and to control reading of data in response to a read command from said host system, the storage apparatus comprising: a cache memory; a first controller configured to control the writing of data in said cache memory pursuant to said write command; a second controller configured to control the writing of said data written in said cache into said storage devices; and an encryption engine configured to encrypt data pursuant to said write command; wherein said first controller is further configured to: provide a first virtual volume corresponding to a first virtual storage area in said storage devices, said first virtual storage area is allocated to a storage area from a pool and the allocation of said first virtual storage area is managed by first mapping information; control writing of first data in said first virtual storage area pursuant to a write command to said first virtual volume, wherein said first data comprises data encrypted using a first key according to said write command sent from said encryption engine to said first virtual volume; and execute re-key processing by: creating a copy pair with said first virtual volume and a second virtual volume; changing said first data read from said first storage area corresponding to said first virtual volume to second data obtained by decrypting said first data using said first key; further changing said second data to third data obtained by encrypting said second data by said encryption engine using a second key; establishing a correspondence relationship between a second virtual storage area in said storage devices and said second virtual volume, said second virtual storage area is allocated to a storage area from said pool and the allocation of said second virtual storage area is managed b second mapping information; controlling writing of said third data in said second virtual storage area; switching between said first mapping information and said second mapping information; releasing said first virtual storage area from said first virtual volume; and further releasing said second virtual storage area from said second virtual volume; such that data corresponding to said first virtual volume is changed from said first data corresponding to said first key to said third data corresponding to said second key.