Reduced Hierarchy Key Management System and Method

Abstract

A controller receives an encrypted media stream (“EMS”) and an identifier indicative of a selected content key from a headend. The EMS is encrypted with an encryption key and can be decrypted with a corresponding decryption key which is determinable from the selected content key. The controller receives indexes and content keys from the headend prior to receiving the EMS. Each index respectively corresponds to an identifier with one index corresponding to the identifier indicative of the selected content key. The content keys correspond to the indexes with one content key corresponding to the index corresponding to the identifier indicative of the selected content key. The controller selects the index corresponding to the identifier indicative of the selected content key upon receiving the EMS, determines the selected content key from the selected index, determines the decryption key from the selected content key, and decrypts the EMS with the decryption key.

1 . A method comprising:
 storing, by a computing device, a plurality of indexes and a plurality of content keys corresponding to the plurality of indexes, wherein at least one index, of the plurality of indexes, corresponds to a combination of two or more content keys of the plurality of content keys;   receiving an encrypted data stream and an identifier associated with decrypting the encrypted data stream;   selecting, based on determining that the identifier corresponds to the at least one index, the combination; and   decrypting, based on the combination, at least a portion of the encrypted data stream.   
     
     
         2 . The method of  claim 1 , wherein the decrypting comprises:
 generating, based on the combination, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         3 . The method of  claim 1 , wherein the decrypting comprises:
 generating, based on the combination and a working key modifier, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         4 . The method of  claim 1 , wherein the decrypting comprises:
 generating a decryption key by using at least one of an exclusive OR (EXOR) operation or a hashing operation on the combination and a working key modifier; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         5 . The method of  claim 1 , wherein the computing device comprises a set-top box. 
     
     
         6 . The method of  claim 1 , further comprising:
 receiving data comprising an update to the plurality of indexes corresponding to the plurality of content keys; and   changing, based on the data, the at least one index from corresponding to the combination to corresponding to a second combination of two or more content keys of the plurality of content keys, wherein the second combination is different from the combination.   
     
     
         7 . The method of  claim 1 , further comprising:
 prior to storing the plurality of indexes and the plurality of content keys, receiving the plurality of indexes and the plurality of content keys during a session setup time for a video on-demand service.   
     
     
         8 . The method of  claim 1 , wherein at least one content key, of the combination, is associated with a service tier. 
     
     
         9 . An apparatus comprising:
 one or more processors; and   memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
 store a plurality of indexes and a plurality of content keys corresponding to the plurality of indexes, wherein at least one index, of the plurality of indexes, corresponds to a combination of two or more content keys of the plurality of content keys; 
 receive an encrypted data stream and an identifier associated with decrypting the encrypted data stream; 
 select, based on determining that the identifier corresponds to the at least one index, the combination; and 
 decrypt, based on the combination, at least a portion of the encrypted data stream. 
   
     
     
         10 . The apparatus of  claim 9 , wherein the instructions, when executed by the one or more processors, cause the apparatus to decrypt at least the portion of the encrypted data stream by:
 generating, based on the combination, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         11 . The apparatus of  claim 9 , wherein the instructions, when executed by the one or more processors, cause the apparatus to decrypt at least the portion of the encrypted data stream by:
 generating, based on the combination and a working key modifier, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         12 . The apparatus of  claim 9 , wherein the instructions, when executed by the one or more processors, cause the apparatus to decrypt at least the portion of the encrypted data stream by:
 generating a decryption key by using at least one of an exclusive OR (EXOR) operation or a hashing operation on the combination and a working key modifier; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         13 . The apparatus of  claim 9 , wherein the apparatus comprises a set-top box. 
     
     
         14 . The apparatus of  claim 9 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to:
 receive data comprising an update to the plurality of indexes corresponding to the plurality of content keys; and   change, based on the data, the at least one index from corresponding to the combination to corresponding to a second combination of two or more content keys of the plurality of content keys, wherein the second combination is different from the combination.   
     
     
         15 . The apparatus of  claim 9 , wherein the instructions, when executed by the one or more processors, further cause the apparatus to:
 prior to storing the plurality of indexes and the plurality of content keys, receive the plurality of indexes and the plurality of content keys during a session setup time for a video on-demand service.   
     
     
         16 . The apparatus of  claim 9 , wherein at least one content key, of the combination, is associated with a service tier. 
     
     
         17 . A non-transitory computer readable medium storing instructions that, when executed, cause:
 storing a plurality of indexes and a plurality of content keys corresponding to the plurality of indexes, wherein at least one index, of the plurality of indexes, corresponds to a combination of two or more content keys of the plurality of content keys;   receiving an encrypted data stream and an identifier associated with decrypting the encrypted data stream;   selecting, based on determining that the identifier corresponds to the at least one index, the combination; and   decrypting, based on the combination, at least a portion of the encrypted data stream.   
     
     
         18 . The non-transitory computer readable medium of  claim 17 , wherein the instructions, when executed, cause decrypting at least the portion of the encrypted data stream by:
 generating, based on the combination, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         19 . The non-transitory computer readable medium of  claim 17 , wherein the instructions, when executed, cause decrypting at least the portion of the encrypted data stream by:
 generating, based on the combination and a working key modifier, a decryption key; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         20 . The non-transitory computer readable medium of  claim 17 , wherein the instructions, when executed, cause decrypting at least the portion of the encrypted data stream by:
 generating a decryption key by using at least one of an exclusive OR (EXOR) operation or a hashing operation on the combination and a working key modifier; and   decrypting, based on the decryption key, at least the portion of the encrypted data stream.   
     
     
         21 . The non-transitory computer readable medium of  claim 17 , wherein the instructions, when executed, further cause:
 receiving data comprising an update to the plurality of indexes corresponding to the plurality of content keys; and   changing, based on the data, the at least one index from corresponding to the combination to corresponding to a second combination of two or more content keys of the plurality of content keys, wherein the second combination is different from the combination.   
     
     
         22 . The non-transitory computer readable medium of  claim 17 , wherein the instructions, when executed, further cause:
 prior to storing the plurality of indexes and the plurality of content keys, receiving the plurality of indexes and the plurality of content keys during a session setup time for a video on-demand service.   
     
     
         23 . The non-transitory computer readable medium of  claim 17 , wherein at least one content key, of the combination, is associated with a service tier.