Network security system

1. A consuming device which is part of a network including other devices, the device comprising:

computer processing machinery to:

receive encrypted content and a plurality of doubly encrypted secret shares from a content provider, the doubly encrypted secret shares being received from the content provider doubly encrypted by an inner encryption and then an outer encryption such that the outer encryption needs to be decrypted before the inner encryption, the outer encryption being uniquely encrypted for decryption by a corresponding one of the other devices in the network, the inner encryption being for decryption only by the consuming device;

distribute the doubly encrypted secret shares from the consuming device to the other devices, the consuming device being forced to distribute the secret shares to the other devices for decryption before the secrets can be used;

a content storage medium to store the encrypted content therein, wherein the computer processing machinery is also operative to:

receive, by the consuming device from the other devices, at least some of the secret shares with the outer decryption decrypted;

decrypt the inner encryption of the received at least some secret shares;

form a content decryption input from the decrypted at least some secret shares;

receive the encrypted content from the content storage medium;

receive the content decryption input; and

decrypt the encrypted content using the content decryption input thereby rendering decrypted content; and

a content consumer to use the decrypted content.

2. The device according to claim 1 , wherein the secret shares are formed in accordance with a threshold scheme such that only a predetermined number of any of the secret shares is needed in order to form the content decryption input, the predetermined number being greater than one but less than the number of the other devices.

3. The device according to claim 2 , wherein the threshold scheme is based on the Shamir secret-sharing method.

4. The device according to claim 1 , wherein:

the content consumer is a media player; and

the decrypted content includes a video frame.

5. The device according to claim 4 , wherein the content decryption input is an entitlement control message.

6. The device according to claim 1 , wherein:

the content consumer is a computer processor; and

the decrypted content includes at least part of a data file.

7. The device according to claim 6 , wherein the content decryption input is a decryption key.

8. A method for restricting access to encrypted content stored in a consuming device which is part of a network including other devices, the method comprising the consuming device performing:

receiving encrypted content and a plurality of doubly encrypted secret shares from a content provider, the doubly encrypted secret shares being received from the content provider doubly encrypted by an inner encryption and then an outer encryption such that the outer encryption needs to be decrypted before the inner encryption, the outer encryption being uniquely encrypted for decryption by a corresponding one of the other devices in the network, the inner encryption being for decryption only by the consuming device;

distributing the doubly encrypted secret shares from the consuming device to the other devices, the consuming device being forced to distribute the secret shares to the other devices for decryption before the secrets can be used;

storing the encrypted content;

receiving, by the consuming device from the other devices, at least some of the secret shares with the outer decryption decrypted;

decrypting the inner encryption of the at least some secret shares;

forming a content decryption input from the decrypted at least some secret shares;

decrypting the encrypted content using the content decryption input thereby rendering decrypted content; and

using the decrypted content.

9. An apparatus including computer processing machinery to perform the steps of the method of claim 8 .