RE-KEYING DURING ON-LINE DATA MIGRATION

1 . A method of migrating data, comprising:

migrating source encrypted data, by a migration device, from a source storage device to a target storage device;

re-keying, by the migration device, while migrating said source encrypted data; and

while re-keying and migrating said source encrypted data, performing, by the migration device, an access request to said source encrypted data apart from said migrating and re-keying.

2 . The method of claim 1 wherein re-keying while migrating said source encrypted data comprises:

decrypting, by the migration device, said source encrypted data to form unencrypted data; and

encrypting, by the migration device, said unencrypted data with a new key to form newly encrypted data, said new key being different than a key used to encrypt said source encrypted data.

3 . The method of claim 2 wherein migrating said source encrypted data comprises writing, by the migration device, said newly encrypted data to a target storage device.

4 . The method of claim 2 further comprising generating, by the migration device, said new key upon beginning to migrate.

5 . A device, comprising:

a migration module configured to migrate encrypted data from a first storage location device to a second storage device;

an encryption module coupled to said migration software, said encryption module configured to re-key said encrypted data as said encrypted data is being migrated; and

an access request controller coupled to said encryption module, said access request controller configured to receive write access requests for the encrypted data from a host while said data is being rekeyed and migrated and to send the write access requests to the first storage device and the second storage device.

6 . The device of claim 5 wherein the encryption module is configured to re-key said encrypted data by decrypting said encrypted data from the first storage device to form unencrypted data and encrypting said unencrypted data with a new key to form newly encrypted data, said new key being different than a key used to encrypt said encrypted data.

7 . The device of claim 6 wherein one of the access request controller or the encryption module generates the new key for use during migrating the encrypted data.

8 . The device of claim 5 wherein the access request controller acquires a lock on the encrypted data being migrated and holds a write access request that targets said encrypted data until migration of said encrypted data is complete.

9 . The device claim 5 wherein, upon said migration being complete, the access request controller is configured to release said lock and to send the write access request on hold to the first storage device and the second storage device.

10 . A method of migrating data, comprising:

migrating source encrypted data, by a migration device, from a source storage device to a target storage device;

re-keying, by the migration device, while migrating said source encrypted data; and

while re-keying and migrating said source encrypted data, receiving and holding write access requests to said source encrypted data.

11 . The method of claim 10 wherein re-keying while migrating said source encrypted data comprises:

decrypting, by the migration device, said source encrypted data to form unencrypted data; and

encrypting, by the migration device, said unencrypted data with a new key to form newly encrypted data, said new key being different than a key used to encrypt said source encrypted data.

12 . The method of claim 11 wherein migrating said source encrypted data comprises writing, by the migration device, said newly encrypted data to a target storage device.

13 . The method of claim 11 further comprising generating, by the migration device, said new key upon beginning to migrate.

14 . The method of claim 10 wherein, upon completing the migrating, releasing, by the migration device, any write access requests on hold.