A method of securely using a first tenant secret key stored under an encrypted form in a first token of a first tenant identified by a first tenant identifier (UID A) and having said first tenant secret key, wherein: each tenant identifier (UID T) for a tenant comprises a first value and, when said tenant is allowed to use a secret key of a parent tenant (T P) identified by a parent tenant identifier (UID TP), said parent tenant identifier, appended before said first value, the method comprising the following step performed by a secure device: - generating said first token from said first tenant identifier (UID A) and a first tenant secret key encrypted with said first tenant identifier (UID A) and with a first tenant customer master key (CMK A), said first tenant customer master key (CMK A) having been derived from said first tenant identifier (UID A) and a secure domain master key (SDMK), said method comprising further the following steps performed by the secure device storing said secure domain master key (SDMK), on request of a second tenant identified by a second tenant identifier (UID B): - getting said first tenant identifier (UID A) of said first tenant from said first token, - checking if the first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), - when said first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), recovering said first tenant secret key stored in said first token and using it for the second tenant. each tenant identifier (UID T) for a tenant comprises a first value and, when said tenant is allowed to use a secret key of a parent tenant (T P) identified by a parent tenant identifier (UID TP), said parent tenant identifier, appended before said first value, the method comprising the following step performed by a secure device: - generating said first token from said first tenant identifier (UID A) and a first tenant secret key encrypted with said first tenant identifier (UID A) and with a first tenant customer master key (CMK A), said first tenant customer master key (CMK A) having been derived from said first tenant identifier (UID A) and a secure domain master key (SDMK), - generating said first token from said first tenant identifier (UID A) and a first tenant secret key encrypted with said first tenant identifier (UID A) and with a first tenant customer master key (CMK A), said first tenant customer master key (CMK A) having been derived from said first tenant identifier (UID A) and a secure domain master key (SDMK), said method comprising further the following steps performed by the secure device storing said secure domain master key (SDMK), on request of a second tenant identified by a second tenant identifier (UID B): - getting said first tenant identifier (UID A) of said first tenant from said first token, - checking if the first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), - when said first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), recovering said first tenant secret key stored in said first token and using it for the second tenant. - getting said first tenant identifier (UID A) of said first tenant from said first token, - checking if the first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), - when said first tenant identifier (UID A) is a prefix of or is equal to said second tenant identifier (UID B), recovering said first tenant secret key stored in said first token and using it for the second tenant.