Methods and apparatus for conditional access of non real-time content in a distribution system

An apparatus comprising:

• a processor configured to distribute non real-time (NRT) content over a distribution network, the processor comprising:
• a synchronizer implemented at least partially in hardware and configured to provide a control word to a plurality of entitlement control message (ECM) generators, each of the plurality of ECM generators associated with a different conditional access system, each conditional access system encrypting the control word using a different long key generate one or more ECMs, and receive the one or more ECMs from each of the plurality of ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to any of the long term keys can decrypt the control word;
• and
• a management module configured to encrypt the NRT content with the control word to generate encrypted NRT content and provide the encrypted NRT content and the ECMs for transmission over the distribution network, wherein the management module is configured to encapsulate the encrypted NRT content and the ECMs into an encapsulated file, wherein a file format of the encapsulated file comprises a clip definition record that identifies the different conditional access systems associated with each of the plurality of ECM generators that generated the ECMs.

An apparatus configured to distribute non real-time (NRT) content over a distribution network, the apparatus comprising at least one processor, the at least one processor comprising one or more modules, the one or more modules comprising:

• means for encrypting the NRT content with a control word to generate encrypted NRT content;
• means for providing the control word to a plurality of entitlement control message (ECM) generators, wherein each of the plurality of ECM generators is associated with a different conditional access system, each conditional access system encrypting the control word using a different long term key to generate one or more ECMs;
• means for receiving one or more ECMs from the one or more ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to any of the long term keys can decrypt the control word;
• means for providing the encrypted NRT content and the ECMs for transmission over the distribution network;
• and
• means for encapsulating the encrypted NRT content and the ECMs into an encapsulated file, wherein the file format of the encapsulated file comprises a clip definition record that identifies the different conditional access systems associated with each of the plurality of ECM generators that generated the ECMs.

A non-transitory machine readable medium embodying instructions that, when executed by a processor, allow the processor to perform a method for distributing non real-time (NRT) content over a distribution network, the method comprising:

• providing a control word to one or more entitlement control message (ECM) generators, wherein the one or more ECM generators comprise a first ECM generator associated with a first conditional access system that encrypts the control word using a first long term key to generate a first ECM, and a second ECM generator associated with a second conditional access system, different than the first conditional access system, that encrypts the control word using a second long term key to generate a second ECM, wherein the first long term key and the second long term key are different;
• receiving one or more ECMs from the one or more ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to the first long term key or the second long term key can decrypt the control word;
• encrypting the NRT content with the control word to generate encrypted NRT content;
• encoding the encrypted NRT content and the one or more ECMs into an encapsulated file for transmission over the distribution network, wherein a file format of the encapsulated file comprises a clip definition record that identifies the first conditional access system that generated the first ECM and the second conditional access system that generated the second ECM;
• and
• providing the encapsulated file for transmission over the distribution network.

A server configured to distribute non real-time (NRT) content over a distribution network, the server comprising:

• a network interface;
• and
• a processor, the processor configured to communicate with the network interface, the processor comprising:
• a synchronizer implemented at least partially in hardware and configured to provide a control word to a plurality of entitlement control message (ECM) generators, each of the plurality of ECM generators associated with a conditional access system, each conditional access system encrypting the control word using a different long term key to generate one or more ECMs, and receive the one or more ECMs from each of the plurality of ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to any of the long term keys can decrypt the control word to provide separate conditional access to the control word by each of the conditional access systems;
• and
• a management module configured to encrypt the NRT content with the control word to generate encrypted NRT content and provide the encrypted NRT content and the one or more ECMs over the network interface for transmission over the distribution network, wherein the management module is configured to encapsulate the encrypted NRT content and the ECMs into an encapsulated file, wherein a file format of the encapsulated file comprises a clip definition record that identifies the conditional access systems associated with each of the plurality of ECM generators that generated the ECMs.

A machine-implemented method for receiving non real-time (NRT) content over a distribution network, the method comprising:

• receiving encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs comprises a first ECM having the control word encrypted using a first long term key by a first conditional access system, and a second ECM having the control word encrypted using a second long term key by a second conditional access system different than the first conditional access system, wherein the first long term key is different from the second long term key, wherein a file format of the encapsulated file comprises a clip definition record that identifies the first conditional access system that generated the first ECM and the second conditional access system that generated the second ECM;
• decrypting, by a processor, a selected ECM using the first long term key or the second long term key to obtain the control word;
• and
• decrypting the encrypted NRT content to obtain decrypted NRT content.

An apparatus comprising:

• a processor for receiving non real-time (NRT) content over a distribution network, the processor comprising:
• processing logic implemented at least partially in hardware and configured to receive encrypted NRT content that has been encrypted with a control word and receive a plurality of entitlement control messages (ECMs), each of the plurality of ECMs having the control word encrypted using a different long term key by a different conditional access system, wherein the processing logic is configured to receive the encrypted NRT content and the plurality of ECMs in an encapsulated file, wherein a file format of the encapsulated file comprises a clip definition record that identifies the different conditional access systems associated with each of the plurality of ECMs;
• key acquisition logic configured to decrypt a selected ECM of the plurality of ECMs using one of the different long term keys to obtain the control word;
• and
• decryption logic configured to decrypt the encrypted NRT content to obtain decrypted NRT content.

An apparatus for receiving non real-time (NRT) content over a distribution network, the apparatus comprising at least one a processor, the at least one processor comprising one or more modules, the one or more modules comprising:

• means for receiving encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs comprises a first ECM having the control word encrypted using a first long term key by a first conditional access system, and a second ECM having the control word encrypted using a first long term key by a second conditional access system different than the first conditional access system, wherein the first long term key and the second long term key are different, wherein a file format of the encapsulated file comprises a clip definition record that identifies the first conditional access system associated with the first ECM, and the second conditional access system associated with the second ECM;
• means for decrypting a selected ECM using the first long term key or the second long term key to obtain the control word;
• and
• means for decrypting the encrypted NRT content to obtain decrypted NRT content.

A non-transitory machine readable medium embodying instructions that, when executed by a processor, allow the processor to perform a method for receiving non real-time (NRT) content over a distribution network, the method comprising:

• receiving encrypted NRT content that has been encrypted with a control word;
• receiving a plurality of entitlement control messages (ECMs), wherein each of the plurality of ECMs has the control word encrypted using a different long term key by a different conditional access system, wherein the encrypted NRT content and the plurality of ECMs are received in an encapsulated file, wherein a file format of the encapsulated file comprises a clip definition record that identifies the different conditional access systems associated with each of the plurality of ECMs;
• decrypting a selected ECM of the plurality of ECMs with one of the different long term keys to obtain the control word;
• and
• decrypting the encrypted NRT content to obtain decrypted NRT content.

A device configured to distribute non real-time (NRT) content over a distribution network, the device comprising:

• an antenna;
• processing logic configured to receive, using the antenna, encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs comprises a first ECM having the control word encrypted using a first long term key by a first conditional access system, and a second ECM having the control word encrypted using a second long term key by a second conditional access system different than the first conditional access system, wherein the first long term key and the second long term key are different, wherein a file format of the encapsulated file comprises a clip definition record that identifies the first conditional access system associated with the first ECM, and the second conditional access system associated with the second ECM;
• key acquisition logic configured to decrypt a selected ECM using the first long term key or the second long term key to obtain the control word;
• and
• decryption logic configured to decrypt the encrypted NRT content to obtain decrypted NRT content.

A machine-implemented method for distributing non real-time (NRT) content over a distribution network, the method comprising:

• encrypting, by a processor, the NRT content with a control word to generate encrypted NRT content;
• providing the control word to one or more entitlement control message (ECM) generators to generate a first ECM encrypted with a first long term key and a second ECM encrypted with a second long term key, wherein the first long term key and the second long term key are different;
• receiving one or more ECMs from the one or more ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to the first long term key or the second long term key can decrypt the control word to provide conditional access to the control word;
• and
• encapsulating the encrypted NRT content and the one or more ECMs into an encapsulated file for transmission over the distribution network.

A non-transitory machine readable medium embodying instructions that, when executed by a processor, allow the processor to perform a method for distributing non real-time (NRT) content over a distribution network, the method comprising:

• providing a control word to one or more entitlement control message (ECM) generators to generate a first ECM encrypted with a first long term key and a second ECM encrypted with a second long term key, wherein the first long term key and the second long term key are different;
• receiving one or more ECMs from the one or more ECM generators, respectively, wherein each ECM comprises a unique encryption of the control word such that a user having access to the first long term key or the second long term key can decrypt the control word to provide conditional access to the control word;
• encrypting the NRT content with the control word to generate encrypted NRT content;
• encoding the encrypted NRT content and the one or more ECMs into a an encapsulated file for transmission over the distribution network, and
• providing the encapsulated file for transmission over the distribution network.

A machine-implemented method for receiving non real-time (NRT) content over a distribution network, the method comprising:

• receiving encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs generates a first ECM encrypted with a first long term key and a second ECM encrypted with a second long term key, wherein the first long term key is different from the second long term key;
• decrypting, by a processor, a selected ECM with a using the first long term key or the second long term key to obtain the control word;
• and
• decrypting the encrypted NRT content to obtain decrypted NRT content.

An apparatus for receiving non real-time (NRT) content over a distribution network, the apparatus comprising at least one a processor, the at least one processor comprising one or more modules, the one or more modules comprising:

• means for receiving encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs generates a first ECM encrypted with a first long term key and a second ECM encrypted with a second long term key, wherein the first long term key and the second long term key are different;
• means for decrypting a selected ECM with a using the first long term key or the second long term key to obtain the control word;
• and
• means for decrypting the encrypted NRT content to obtain decrypted NRT content.

A device configured to distribute non real-time (NRT) content over a distribution network, the device comprising:

• an antenna;
• processing logic configured to receive, using the antenna, encrypted NRT content that has been encrypted with a control word and one or more entitlement control messages (ECMs) in an encapsulated file, wherein the one or more ECMs generates a first ECM encrypted with a first long term key and a second ECM encrypted with a second long term key, wherein the first long term key and the second long term key are different;
• key acquisition logic configured to decrypt a selected ECM with a using the first long term key or the second long term key to obtain the control word;
• and
• decryption logic configured to decrypt the encrypted NRT content to obtain decrypted NRT content.