Secure management of keys using control vectors with multi-path checking.

摘要

An apparatus and method are disclosed for validating that a cryptographic function requested to be performed with a cryptographic key has been authorized by the originator of the key. The invention is used in a data processing system which processes cryptographic service requests for the performance of cryptographic functions with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform. The invention includes a cryptographic facility (4) characterized by a secure boundary through which passes an I/O path (8) for receiving a cryptographic key and its associated control vector (CVa, CVb,...CVm), and for providing a response thereto, there being included within the boundary a cryptographic processing means coupled to the I/O path (8) and a master key storage coupled to the processing means, for providing a secure location to execute a cryptographic function with the cryptographic key.