According to one embodiment, an I/O command control device receives authorization information indicating whether execution of an I/O command is permitted. When the received authorization information is not modified and is issued from a known authorization server, the I/O command control device verifies whether the received authorization information permits execution of the I/O command. The I/O command control device permits or inhibits execution of the I/O command or a control command generated from the I/O command with respect to a logical area that is an execution target of the I/O command, in accordance with an authorization result indicating whether the received authorization information permits execution of the I/O command.