Signaling conditional access system switching and key derivation

In a system of a plurality of client devices for receiving media programs from a service provider, each of the client devices having a securely executing conditional access system (CAS) client and a middleware module communicating with the CAS client, an apparatus for controlling a group of the plurality of client devices to switch at least one client device of the group of the client devices from a first conditional access system to a second conditional access system via a plurality of client device signaling messages, each of the client devices for receiving media programs from a service provider, comprising:

• a private data generator, comprising:
• a processor;
• a memory, the memory storing processor instructions comprising instructions for:
• generating a group identifier identifying the group of the client devices;
• a transmitter, communicatively coupled to the private data generator, the transmitter for:
• transmitting a first client device signaling message having the group identifier only to each client device of the identified group of the client devices, the first client device signaling message signaling an action to assign the client device receiving the message to the identified group of the client devices, the group identifier for storage in each client device of the group of the client devices in non-volatile memory;
• and
• transmitting a second client device signaling message to the plurality of client devices, the second client device signaling message comprising the group identifier and signaling each client device having the group identifier stored in the non-volatile memory to switch from the first conditional access system to the second conditional access system;
• wherein the first client device signaling message and the second device signaling message are transmitted on a conditional access switching message channel monitored by the middleware module of each of the plurality of client devices, the conditional access switching message channel identified by an identifier transmitted to each of the plurality of client devices as application specific data.

In a system of a plurality of client devices for receiving media programs from a service provider, each of the client devices having a securely executing conditional access system (CAS) client and a middleware module communicating with the CAS client, an apparatus for controlling a group of the plurality of client devices to switch from a first conditional access system to a second conditional access system via a plurality of client device signaling messages, each of the client devices for receiving media programs from a service provider, comprising:

• a private data generator, comprising:
• a processor;
• a memory, the memory storing processor instructions comprising instructions for:
• generating a group identifier identifying the group of the client devices;
• a transmitter, communicatively coupled to the private data generator, the transmitter for:
• transmitting a first client device signaling message having the group identifier only to each client device of the identified group of the client devices, the first client device signaling messages signaling an action to assign the client device receiving the message to the identified group of the client devices, the group identifier for storage in each client device of the group of the client devices in non-volatile memory;
• and
• transmitting a second client device signaling message to plurality of client devices, the second client device signaling message comprising the group identifier and signaling each of the group of client device having the group identifier stored in the non-volatile memory to switch from the first conditional access system to the second conditional access system
• wherein:
• the first client device signaling message and the second device signaling message are transmitted on a conditional access switching message channel monitored by the middleware module of each of the plurality of client devices, the conditional access switching message channel identified by an identifier transmitted to each of the plurality of client devices as application specific data
• each of the plurality of client devices comprises:
• a client device processor;
• a client device memory, storing client device processor instructions implementing the middleware module, the instructions including instructions for monitoring the conditional access switching message channel for the first client device signaling message and the second client device switching message;
• and
• the transmitter further transmits the an identifier of the conditional access switching message channel to the plurality of client devices as application specific data.