Patent ID: 8526615

Claim:
A storage system comprising: a first interface coupled to a host computer; a disk device; a second interface coupled to the disk device and including a transfer controller; a plurality of microprocessors configured to control data transmissions between the first interface and the second interface; and a first memory, which is accessed by the plurality of microprocessors, including a cache memory for storing data to be read or written from or to the host computer of the disk device and a control memory for storing control information, wherein the first interface includes a second memory, wherein the second interface includes an encryption and decryption unit for decrypting data to be transmitted to the host computer and for encrypting data received from the host computer; wherein, upon receipt of a read command, the encryption and decryption unit decrypts data read from the disk unit, wherein the transfer controller in the second interface is configured to write the decrypted data in the first memory, and to read the decrypted data from the first memory to transmit the decrypted data to the second memory, and to read the decrypted data from the second memory to transmit the decrypted data to the host computer, wherein cryptographic key information to be used in the encryption and decryption unit is stored in the first memory, wherein the first interface is configured to determine whether access for allowing the cryptographic key information stored in the first memory to be read out satisfies predetermined conditions and to determine whether to permit the read of the cryptographic key information according to a result of the determination, wherein the predetermined conditions include a first condition in which only authorized persons are permitted to access the control memory, and a second condition in which only authorized persons are permitted to access the first memory to read the cryptographic key information, wherein, if the first interface determines the access satisfies the first condition and the second condition, the first interface permits access to the cryptographic key information, in the first memory, wherein, if the first interface determines the access satisfies the first condition and does not satisfy the second condition, the first interface permits to access the control information, which doesn't include the cryptographic key information, in the first memory, and wherein, if the first interface determines the access does not satisfy the first condition, the first interface does not permit access to the first memory.