Secure provisioning, by a client device, cryptographic keys for exploiting services provided by an operator

A client device that descrambles a scrambled service, comprising:

• circuitry configured to
• transmit a first challenge to an operator server, the first challenge including at least a certificate corresponding to the device;
• receive, in response to the first challenge, a license from the operator server, the license including at least a service key encrypted with a unique device-derived key;
• determine the unique device-derived key by applying a predetermined algorithm on a global operator seed and unique device key corresponding to the client device;
• decrypt the service key with the calculated unique device-derived key;
• and
• receive and descramble the scrambled service using the service key.

A method of descrambling a scrambled service, comprising:

• receiving, by an operator server, a first challenge from a client device, the challenge including at least an identifier of the client device and an identifier of the operator server;
• determining entitlement of the client device to descramble the scrambled service;
• when the client device is entitled to descramble the scrambled service, retrieving, by the operator server, determining, by the operator server, a device-derived key by applying a predetermined algorithm to a unique device key corresponding to the client device and a global operator seed corresponding to the operator server;
• forming, by the operator server, a unique cryptogram by encrypting the device-derived key with the global operator seed;
• transmitting, from the operator server to the client device, a certificate corresponding to the client device, the certificate including the unique cryptogram;
• receiving, by the operator server, a second challenge from the client device, the second challenge including at least a certificate corresponding to the client device;
• and
• providing, from the operator server to the client device in response to the second challenge, a license from the operator server, the license including at least a service key encrypted with the device-derived key,
• wherein the client device uses the service key in the license to descramble the scrambled service.

An operator server, comprising:

• circuitry configured to
• receive a first challenge from a client device, the challenge including at least an identifier of the client device and an identifier of the operator server;
• determine entitlement of the client device to descramble the scrambled service;
• when the client device is entitled to descramble the scrambled service, determine a device-derived key by applying a predetermined algorithm to a unique device key corresponding to the client device and a global operator seed corresponding to the operator server;
• form a unique cryptogram by encrypting the device-derived key with the global operator seed;
• transmit, to the client device, a certificate corresponding to the client device, the certificate including the unique cryptogram;
• receive a second challenge from the client device, the second challenge including at least a certificate corresponding to the client device;
• and
• provide, to the client device in response to the second challenge, a license from the operator server, the license including at least a service key encrypted with the device-derived key,
• wherein the client device uses the service key in the license to descramble the scrambled service.