Method, apparatus and computer program product for managing encryption key in a storage system

An apparatus for managing an encryption key in a storage system, comprising:

• a processor;
• and
• a memory coupled to the processor and having instructions stored therein, which, when executed by the processor, cause the apparatus to perform acts of:
• transmitting an encryption key request from a storage management component to a key management service component;
• obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request;
• providing the obtained encrypted encryption key to the storage management component;
• maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device;
• and
• registering, according to the correspondence, an encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device.

A computer program product having a non-transitory computer readable medium which stores a set of instructions for managing an encryption key in a storage system;

• the set of instructions, when carried out by computerized circuitry of the storage system, causing the computerized circuitry to perform a method of:
• transmitting an encryption key request from a storage management component to a key management service component;
• obtaining, via the key management service component, an encryption key encrypted by the key management service component based on the encryption key request;
• providing the obtained encrypted encryption key to the storage management component;
• maintaining, in the storage management component, correspondence between the encrypted encryption key and a storage device;
• and
• registering, according to the correspondence, the encrypted encryption key corresponding to the storage device to an encryption hardware unit, such that the encryption hardware unit can decrypt the encrypted encryption key to obtain the encryption key corresponding to the storage device.