keys in a cache e g in a key cache 540 fig6 so it will not have to access the key server 20 on every io but periodically the storage system 10 will access the key server to get a new key policy and if a key was erased the storage system 10 will erase it from the cache in one example the storage system 10 stores encryption keys in the cache in a volatile memory e g volatile memory 524 fig6 because of the time based nature of updating the keys some keys may be valid but not the newest key and some keys are so old that there are invalid for example there are at least three types of encryption keys used to read encrypted data one type is a latest e g newest current type key available with the latest type key the encrypted data is decrypted using the latest key and provided for example to the user when the user requests a read another type key is a valid but older type key e g the key is valid for reading encrypted data but is older than allowed by a policy and is no longer used for encrypting new data in this case data is encrypted with the new key instead and stored but the unencrypted data is still provided for example to the user a still further type key is an invalid type key the invalid type key is a key that has been erased from the server 22 or has expired in this case using an invalid key will result in the read request.