Downloadable security based on certificate status

A client device configured to receive a conditional access system (CAS) client for a CAS, the client device comprising:

• a data storage configured to store a download manager certificate (DMC) unique to the client device;
• and
• a hardware processor configured to send the DMC of the client device to a CAS computer;
• wherein the CAS computer is configured to:
• receive a DMC of the client device;
• determine, using the DMC, security information including a DMC key size and an expiration time of a DMC subordinate certificate authority (sub-CA) certificate, for the client device, from the data storage, wherein the DMC key size is a key size of a DMC public key saved in the data storage;
• determine whether the DMC is valid based on the expiration time of the DMC sub-CA certificate and on the DMC key size;
• if the DMC is determined to be invalid, not provide a cryptographic identity for the client device to the client;
• and
• if the DMC is determined to be valid, send the cryptographic identity for the client device to the client device protected using the DMC and at a later time, if the DMC key size is considered to be still sufficiently secure, the validity of each DMC is extended by issuing a new DMC sub-CA certificate with a same public key as the sub-CA certificate;
• and
• determine at a later time whether the cryptographic identity of the client device is configured to be used based on the DMC public key size;
• wherein the processor is configured to receive the cryptographic identity for the client device and the CAS client protected using the DMC from the CAS computer in response to the CAS computer determining the DMC is valid.

A method for operating a downloadable conditional access system (DCAS) computer, the method comprising:

• by the DCAS computer:
• receiving a download manager certificate (DMC) of a client device;
• determining, using the DMC, security information including a DMC key size and an expiration time of a DMC subordinate certificate authority (sub-CA) certificate, for the client device, from a data storage, wherein the DMC key size is a key size of a DMC public key saved in the data storage;
• determining whether the DMC is valid based on the expiration time of the DMC sub-CA certificate and on the DMC key size;
• if the DMC is determined to be invalid, not providing a cryptographic identity for the client device and a CAS client to the client device;
• and
• if the DMC is determined to be valid, sending the cryptographic identity for the client device and a CAS client to the client device protected using the DMC and at a later time, if the DMC key size is considered to be still sufficiently secure, the validity of each DMC is extended by issuing a new DMC sub-CA certificate having extended lifetime with a same public key as the DMC sub-CA certificate;
• and
• determine at a later time whether the cryptographic identity of the client device is configured to be used based on the DMC public key size.