one is set as a shelter in the external disk drive group 103 and the data dt 0 is stored in area one as a result write data received after the snapshot command is issued is encrypted with a different encryption key whereas data preceding the snapshot command is moved to a shelter area fig1 is a flow chart for data write processing in the storage system 101 of this embodiment the storage system judges whether a snapshot command has been issued or not s 1501 when it is judged that a snapshot command has been issued the processing moves to a step s 1504 when it is judged that a snapshot command has not been issued the processing moves to a step s 1502 where the volume management table is consulted to encrypt data with an encryption key that is assigned to a logical volume specified in the write request the encrypted data is stored in a cache memory area of the memory units 114 s 1503 in the step s 1504 a different encryption key is created the created encryption key is assigned to the logical volume specified in the write request then the created encryption key and the id of this logical volume are registered in the volume management table s 1505 at this point a new encryption key registration flag is.