Patent ID: 7240220

Claim:
A storage system including a storage device to be coupled to a host computer and an administrative device via a network, the storage system comprising: a first region of a storage area configured by first data blocks in the storage device, storing data in a first data form encrypted with a first cryptographic criteria to be provided from the administrative device; a second region of the storage area configured by second data blocks in the storage device, storing data in a second data form encrypted with a second cryptographic criteria to be provided from the administrative device; and a controller configured to receive a request from the administrative device and in response thereto to convert, for each first data block of the first region, the data stored in said each first data block into data of the second data form thereby producing the second data blocks of the second region; wherein the controller is configured to receive, concurrently with the converting, a write request including data in a third data form from the host computer, the controller further being configured to receive, concurrently with the converting, a read request from the host computer, the third data form being different from the first data form and the second data form, whereby write requests and read requests are processed independently of the converting; wherein, in response to the write request, the controller determines if the data of the write request are to be stored in the first region of the storage area or in the second region of the storage area, encrypts the data in the third data form from the host computer with the first cryptographic criteria when the data are to be stored in the first region of the storage area, and encrypts the data in the third data form from the host computer with the second cryptographic criteria when the data are to be stored in the second region of the storage area; wherein, in response to the read request, the controller reads data from the storage device and performs decryption using either the first cryptographic criteria or the second cryptographic criteria depending on whether the data is read from the first storage area or the second storage area, whereby the controller decrypts data in the first data form stored in the first region of the data blocks with the first cryptographic criteria in order to return the data in the third form to the host computer and decrypts data in the second data form stored in the second region of the storage area with the second cryptographic criteria in order to return the data in the third form to the host computer, whereby write requests and read requests are processed independently of the converting.