Storage system, storage control apparatus, and storage control method

A storage system comprising:

• a management apparatus containing a first processor configured to perform a first procedure which includes sending to a storage control apparatus designation of one or more of divided areas and an instruction to invalidate data stored in the one or more of the divided areas, where the divided areas are defined by division of one or more storage areas in one or more storage devices, and the one or more of the divided areas are allocated as one or more physical storage areas for a virtual storage area to be invalidated;
• and
• the storage control apparatus containing,
• a memory configured to store encryption-key information including encryption keys respectively associated with the divided areas;
• and
• a second processor configured to perform a second procedure which includes,
• acquiring from the encryption-key information one of the encryption keys associated with one of the divided areas in which data is to be written, encrypting the data to be written, by use of the one of the encryption keys, to generate encrypted data, and writing the encrypted data in the one of the divided areas, and
• invalidating one or more of the encryption keys associated with one or more of the divided areas and included in the encryption-key information when the storage control apparatus receives, from the management apparatus, the designation of the one or more of the divided areas and the instruction to invalidate data stored in the one or more of the divided areas, and the one or more of the divided areas are allocated as one or more physical storage areas for a virtual storage area to be invalidated.

A storage control method comprising:

• performing, by a storage control apparatus, operations of referring to encryption-key information including encryption keys respectively associated with divided areas defined by division of one or more storage areas in one or more storage devices, acquiring from the encryption-key information one of the encryption keys associated with one of the divided areas in which data is to be written, encrypting the data to be written, by use of the one of the encryption keys, to generate encrypted data, and writing the encrypted data in the one of the divided areas;
• sending, by a management apparatus, to the storage control apparatus, designation of one or more of the divided areas and an instruction to invalidate data stored in the one or more of the divided areas, where the one or more of the divided areas are allocated as one or more physical storage areas for a virtual storage area to be invalidated;
• and
• invalidating, by the storage control apparatus, one or more of the encryption keys associated with the one or more of the divided areas and included in the encryption-key information, in response to the instruction from the management apparatus.