In a system comprising at least one data provider of a plurality of data providers providing data to consumers encrypted according to at least one conditional access system of a plurality of conditional access systems provided by an associated conditional access system provider, a method of providing a root key, comprising:
- (a) receiving data provider data comprising a data provider key (Kcp) unique to the at least one data provider;
- (b) receiving conditional access system data comprising an identifier of the at least one conditional access system (CA_ID);
- (c) generating a profile key from a customer product secret (CPS) unique to the associated conditional access system provider and the identifier of the at least one conditional access system (CA_ID);
- and
- (d) generating a root key at least in part according to the profile key, and a chip key (SSK), and the identifier of the at least one conditional access system (CA_ID).