System and Method for a Variable Key Ladder

1 . A method, comprising:

receiving, by a receiver, a data message;

storing configuration data in a memory;

selecting between a first device key and a second device key depending upon the configuration data; and

decrypting, by a decryption apparatus, at least a portion of the data message using a key ladder that includes the selected first or second device key.

2 . The method of claim 1 , further comprising receiving the configuration data as part of the data message.

3 . The method of claim 1 , further comprising generating the second device key by decrypting at least a portion of the data message using an asymmetric key.

4 . The method of claim 1 , wherein the first device key is a symmetric device key.

5 . The method of claim 1 , wherein the key ladder comprises at least one symmetric key and at least one asymmetric key.

6 . The method of claim 1 , wherein the configuration data indicates a number of tiers of the key ladder.

7 . The method of claim 1 , wherein the data message comprises an Entitlement Management Message (EMM).

8 . A decryption apparatus, comprising:

a memory configured to store configuration data and a first device key;

a receiver configured to receive a data message from a network;

a key decryption operator configured to generate a second device key based on a data message;

a switch configured to select between the first device key and the second device key depending upon the configuration data; and

a decryption engine configured to decrypt at least a portion of the data message using a key ladder that includes the selected first or second device key.

9 . The decryption apparatus of claim 8 , wherein the data message comprises the configuration data, and wherein the decryption apparatus is configured to store, in the memory, the configuration data received as part of the data message.

10 . The decryption apparatus of claim 8 , wherein the key decryption operator is configured to generate the second device key by decrypting at least a portion of the data message using an asymmetric key stored in the memory.

11 . The decryption apparatus of claim 8 , wherein the first device key is a symmetric device key.

12 . The decryption apparatus of claim 8 , wherein the key ladder comprises at least one symmetric key and at least one asymmetric key.

13 . The decryption apparatus of claim 8 , wherein the configuration data indicates a number of tiers of the key ladder.

14 . The decryption apparatus of claim 8 , wherein the data message comprises an Entitlement Management Message (EMM).

15 . A method, comprising:

storing, in a memory, a first key and a second key;

selecting between the first key and a third key depending upon configuration data;

determining a key ladder tier of the second key based on the configuration data; and

decrypting at least a portion of a data message using a key ladder that includes the selected one of the first and third keys as a device key and that includes the second key at the determined key ladder tier.

16 . The method of claim 15 , further comprising receiving, by a receiver, the configuration data as part of the data message.

17 . The method of claim 15 , further comprising generating the third key by decrypting at least a portion of the data message using an asymmetric fourth key.

18 . The method of claim 15 , wherein the key ladder comprises at least one symmetric key and at least one asymmetric key.

19 . The method of claim 15 , wherein the configuration data indicates a number of tiers of the key ladder.

20 . The method of claim 15 , wherein the data message comprises an Entitlement Management Message (EMM).