Method and apparatus for a blackbox programming system permitting downloadable applications and multiple security profiles providing hardware separation of services in hardware constrained devices

In a system comprising at least one of a plurality of content providers providing media programs to consumers encrypted according to at least one of a plurality of conditional access systems provided by an associated conditional access system provider, an apparatus for providing a root key, comprising:

• a processor;
• a memory communicatively coupled to the processor, the memory storing instructions comprising instructions for:
• (a) receiving content provider data comprising a content provider key (Kcp) unique to the at least one content provider;
• (b) receiving conditional access system data comprising an identifier of the at least one conditional access system (CA_ID) and a customer product secret (CPS) unique to the associated conditional access system provider;
• (c) generating a profile key from the customer product secret (CPS) and the identifier of the at least one conditional access system (CA_ID);
• (d) receiving a chip key (SSK) [from stored data];
• and
• (e) generating a root key at least in part according to the profile key, the chip key (SSK), and the identifier of the at least one conditional access system (CA_ID).