Provisioning DRM credentials on a client device using an update server

A method of provisioning DRM credentials on a client device, comprising:

• sending an authorization request from a client device to a gateway device associated with said client device and located within the same local network as said client device;
• receiving at said client device an authorization token from said gateway device in response to said authorization request;
• sending a DRM credential request from said client device to an update server, said DRM credential request comprising a digital signature that includes two signature portions, a device class certificate associated with a class of the receiving update server device, wherein the device class certificate signature portion is generated by the receiving update server, and said authorization token, wherein the authorization token signature portion is generated by the gateway device that issued the authorization token to the client device;
• receiving DRM credentials at said client device from said update server if said update server validates said authorization token;
• decrypting said DRM credentials at said client device using a cryptographic key shared between said client device and a key generation system, wherein said key generation system used said cryptographic key to encrypt said DRM credentials prior to providing said DRM credentials to said update server;
• and
• installing said DRM credentials on said client device.