Method and apparatus for distribution and synchronization of cryptographic context information

An apparatus for synchronizing an encryptor and key management logic in a video distribution system, the apparatus comprising:

• means for receiving an unencrypted content stream;
• means for receiving, from the encryptor, a request message requesting at least one encryption key for use by the encryptor in encrypting an Internet Protocol (IP) packet stream generated from the unencrypted content stream, the request message having authentication data and stream-dependent parameters associated with the IP packet stream to be encrypted, wherein the authentication data comprises an authentication token and a checksum value, the authentication token having an encrypted version of a session key and the checksum value being keyed with the session key;
• means for verifying authenticity of the encryptor using the authentication data;
• means for generating a cryptographic context for the IP packet stream, wherein the cryptographic context includes the stream-dependent parameters and the at least one encryption key, based on the authenticity of the encryptor being verified;
• means for sending a reply message to the encryptor, the reply message having the at least one encryption key;
• and
• means for distributing key stream messages having the cryptographic context to one or more user terminals, the one or more user terminals receiving a version of the IP packet stream as encrypted by the encryptor using the at least one encryption key, wherein the encrypted version of the IP packet stream is transmitted by a terrestrial television broadcast technology adapted for handheld broadcasts.

A video distribution system, comprising:

• an encryptor component for encrypting configured to encrypt an internet protocol (IP) packet stream generated from an unencrypted content stream using at least one encryption key;
• and
• an entitlement control message (ECM) generator component in communication with the encryptor component, the ECM generator component configured to:
• receive a request message from the encryptor component requesting the at least one encryption key for use by the encryptor component in encrypting the IP packet stream generated from the unencrypted content stream, the request message having authentication data and stream-dependent parameters associated with the IP packet stream, wherein the authentication data comprises an authentication token and a checksum value, the authentication token having an encrypted version of a session key and the checksum value being keyed with the session key,
• verify authenticity of the encryptor component using the authentication data,
• when the authenticity of the encryptor component is verified, generate a cryptographic context for the IP packet stream, wherein the cryptographic context includes the stream-dependent parameters and the least one encryption key,
• send a reply message to the encryptor component, the reply message having the at least one encryption key, and
• distribute key stream messages having the cryptographic context to one or more user terminals, the one or more user terminals receiving a version of the IP packet stream as encrypted by the encryptor using the at least one encryption key, wherein the encrypted version of the IP packet stream is transmitted by a terrestrial television broadcast technology adapted for handheld broadcasts.