Method of data transfer, a method of controlling use of data and cryptographic device

A method of controlling use of data, the data being stored in a service provider system in a manner which is accessible to a trusted second security context in the service provider system but secure from the rest of the service provider system, wherein an access control list specifying that a valid use credential must be presented in order to grant a first type of use of the data is stored with the data, wherein the data comprises a cryptographic key Ktenant, and wherein the access control list specifies that the cryptographic key, Ktenant can only be encrypted for storage outside of the second security context by a key which cannot leave the second security context, the method comprising:

• generating a use credential in a first security context, wherein the use credential comprises:
• information from which the data corresponding to the use credential can be identified;
• information from which the expiry of the use credential can be determined;
• issuing the use credential and information from which the origin of the use credential can be validated;
• validating the use credential with respect to the access control list, and validating that the use credential has not expired at the second security context;
• granting the first type of use of the data, in the second security context, on the condition that the use credential is valid and not expired.