According to one embodiment, an I/O command control apparatus receives authorization information. The authorization information indicates whether or not to permit an execution of an I/O command. The apparatus verifies whether the received authorization information is not tampered with, and whether the received authorization information is issued from a known authorization server. In a case where the authorization information is not tampered with, and is issued from the known server, the apparatus verifies whether or not the authorization information permits to execution of the I/O command. The apparatus permits or prohibits the execution of the I/O command or execution of a control command generated from the I/O command, based on the authorization result.