Method and apparatus for supporting multiple broadcasters independently using a single conditional access system

A system for brokering an enabling of communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers, each encrypted media program decryptable by a first receiver module securely communicating with a second receiver module according to a pairing key Kp associated with one of the plurality of receivers, the system comprising:

• a broker, having a server processor and a memory, the memory comprising broker processor instructions including instructions for providing a first encrypted version of the pairing key ES2[Kp] in response to a service enabling request from one of the plurality of broadcasters, the service enabling request having an identification of one of the plurality of receivers;
• and
• wherein:
• the first encrypted version of the pairing key ES1[Kp] is decryptable by first information S1 stored in the first receiver module;
• and
• the first information S1 is derived from a hardware root of trust stored in at least one of the first receiver module and the second receiver module.

An apparatus for brokering an enabling of communication of encrypted media programs from a plurality of independent broadcasters to a plurality of receivers, each encrypted media program decryptable by a first receiver module securely communicating with a second receiver module according to a pairing key associated with one of the plurality of receivers, the apparatus comprising:

• means for transmitting a service enabling request from one of the plurality of broadcasters to a broker independent from the one of the plurality of broadcasters, the request comprising an identification of the one of the plurality of receivers;
• means for receiving a first encrypted version of the pairing key ES1[Kp] from the broker, the first encrypted version of the pairing key ES1[Kp] decryptable by first information S1 securely stored in the first receiver module of the one of the plurality of receivers;
• means for encrypting the pairing key with second information S2 to generate a second encrypted version of the pairing key Kp, the second encrypted version of the pairing key ES2[Kp] decryptable by the second information S2 securely stored in the second receiver module;
• and
• means for transmitting the first encrypted version of the pairing key ES1[Kp] and the second encrypted version of the pairing key ES2[Kp] to the one of the plurality of receivers;
• wherein at least one of the first information S1 and the second information S2 is derived from a hardware root of trust stored in at least one of the first receiver module and the second receiver module.