Conditional Access to Encrypted Media Content

Abstract

A method and apparatus for processing encrypted content distributed for end users in multiple services includes receiving entitlement information for a subset of at least two of the services separately from the encrypted content for the services and either calculating decryption key information for the subset of services from the entitlement information and storing the decryption key information in memory so that decryption key information for a selected service can subsequently be read from memory, or storing the entitlement information for the subset of services in memory so that the entitlement information for a selected service can subsequently be read from memory and decryption key information for the selected service can be calculated.

1 . A method of storing decryption key information, the method comprising:
 receiving entitlement information at a transport stream multiplexer for at least a subset of services separately from encrypted content for the subset of services, the subset of services including at least two services;   calculating decryption key information for the subset of services from the entitlement information; and   storing the decryption key information in machine memory.   
     
     
         2 . A method according to  claim 1 , further comprising:
 receiving the encrypted content for at least the subset of services;   receiving a service change request that identifies a selected service of the subset of services;   responding to the service change request by reading the decryption key information for the selected service from the memory; and   employing the selected decryption key information to decrypt the encrypted content for the selected service.   
     
     
         3 . A method according to  claim 1 , comprising receiving the encrypted content in transport stream packets and receiving the entitlement information in transport stream packets having a packet identifier different from packet identifiers associated with the encrypted content. 
     
     
         4 . A method according to  claim 1 , comprising receiving the encrypted content in a first transport stream and receiving the entitlement information in a second transport stream. 
     
     
         5 . A method of storing entitlement information, the method comprising:
 receiving entitlement information at a transport stream multiplexer for at least a subset of services separately from encrypted content for the subset of services, the subset of services including at least two services; and   storing the entitlement information for the subset of services in machine memory.   
     
     
         6 . A method according to  claim 5 , further comprising:
 receiving the encrypted content for at least the subset of services;   receiving a service change request that identifies a selected service of the subset of services;   responding to the service change request by reading the entitlement information for the selected service from the memory;   calculating decryption key information from the entitlement information and   employing the decryption key information to decrypt the encrypted content for the selected service.   
     
     
         7 . A method according to  claim 5 , comprising receiving the encrypted content in transport stream packets and receiving the entitlement information in transport stream packets having a packet identifier different from packet identifiers associated with the encrypted content. 
     
     
         8 . A method according to  claim 5 , comprising receiving the encrypted content in a first transport stream and receiving the entitlement information in a second transport stream. 
     
     
         9 . An apparatus for storing decryption key information, the apparatus comprising:
 at least one receiver for receiving the-encrypted content for at least a subset of all the services and for receiving entitlement information for the subset of services separately from the encrypted content for the services, the subset of services including at least two services;   a decryptor connected to receive the entitlement information and for calculating decryption key information for the subset of services from the entitlement information; and   a memory connected to receive and store the decryption key information.   
     
     
         10 . The apparatus according to  claim 9 , comprising a content decryptor connected to receive a selected service of encrypted content and the decryption key information associated with the selected service and operative to employ the decryption key information to decrypt the encrypted content of the selected service. 
     
     
         11 . The apparatus according to  claim 9 , comprising a transport stream demultiplexer for separating a transport stream conveying the entitlement information from a transport stream conveying the encrypted content based on packet identifiers and providing transport stream packets conveying the entitlement information to the decryptor. 
     
     
         12 . An apparatus for storing entitlement information, the apparatus comprising:
 at least one receiver for receiving encrypted content for at least a subset of services and for receiving entitlement information for the subset of services separately from the encrypted content for the services, the subset of services including at least two services; and   a memory connected to receive and store the entitlement information.   
     
     
         13 . The apparatus according to  claim 12 , the apparatus further comprising:
 a decryptor connected to read the stored entitlement information associated with a selected service from the memory and calculate decryption key information for selected service from the entitlement information;   receiving a service change request that identifies a selected service of the subset of services;   responding to the service change request by selecting the calculated decryption key information for the selected service;   employing the selected decryption key information to decrypt a control word; and   employing the control word to decrypt the encrypted content for the selected service.