Smartphone-based conditional access system

A headend system comprising:

• a non-transitory memory to store a security profile associated with a first device, a second device paired with the first device, and a user;
• a device key generator to locate a first device key for the first device and a second device key for the second device;
• a controller operable to regulate user access to a channel during an entitlement period, including:
• determining a first security ranking of the first device and a second security ranking of the second device based on the security profile,
• assigning a first subset of service keys to be encrypted with the first device key and a second subset of service keys to be encrypted with the second device key based on the first and the second security ranking,
• generating a first subset of encrypted service keys by encrypting the first subset of service keys with the first device key and generates a second subset of encrypted service keys by encrypting the second subset of service keys with the second device key;
• and
• causing a transmitter to transmit one or more of the first device key and the first subset of encrypted service keys to the first device and transmit one or more of the second device key and the second subset of encrypted service keys to the second device.

A non-transitory memory storing one or more programs, which, when executed by a controller of a server cause the server to:

• obtain, from the non-transitory memory, a security profile associated with a first device, a second device paired with the first device, and a user;
• locate a first device key for the first device and a second device key for the second device;
• and
• regulate user access to a channel during an entitlement period, including:
• determining a first security ranking of the first device and a second security ranking of the second device based on the security profile;
• assigning a first subset of service keys to be encrypted with the first device key and a second subset of service keys to be encrypted with the second device key based on the first security ranking and the second security ranking;
• generating a first subset of encrypted service keys by encrypting the first subset of service keys with the first device key and generating a second subset of encrypted service keys by encrypting the second subset of service keys with the second device key;
• and
• transmitting the first subset of encrypted service keys to the first device and the second subset of encrypted service keys to the second device.