Security and key management of digital content

1. A method to protect digital content within a particular domain, the method comprising:

receiving, from a source outside of the particular domain, the digital content at a first client device which is a set top box (STB), the received digital content being encrypted and in a first format;

decrypting the received digital content to produce decrypted digital content in the first format at the first client device using a first key;

transcoding the decrypted digital content in the first format to produce the digital content in a second format;

re-encrypting the digital content in the second format using a second key,

wherein the first client device derives the second key locally based on information received from a server; and

transmitting the re-encrypted digital content in the second format to a second client device within the particular domain,

wherein the second client device connects to the server to obtain a copy of the second key derived at the server and decrypts the re-encrypted digital content in the second format at the second client device.

2. The method of claim 1 , wherein the second key is bound to devices within the particular domain.

3. The method of claim 1 , wherein the second key is derived at least in part using a domain ID associated with the particular domain and the first key.

4. The method of claim 1 , wherein the second key is derived at least in part using a time value and the first key.

5. The method of claim 1 , wherein the information from which the first client device derives the second key includes information encrypted with the first key.

6. The method of claim 1 , further comprising modifying copy control parameters associated with the digital content at the first client device.

7. The method of claim 1 , wherein the information from which the first client device derives the second key includes control data received with the digital content at the first client device.

8. The method of claim 7 , wherein the control data is an entitlement control message (ECM).

9. The method of claim 1 , wherein first client device obtains the second key out of band.

10. The method of claim 1 , further comprising embedding a watermark that is unique to the particular domain in the transcoded content by the first client device.

11. The method of claim 10 , wherein the watermark includes information received from the server.

12. The method of claim 1 , wherein the first key and the second key are derived on the first client device using a hardware-implemented mechanism including a unique key.

13. The method of claim 1 , wherein the second client device decrypts the copy of the second key obtained from the server using a hardware-implemented mechanism including a unique key.

14. The method of claim 13 , wherein the hardware-implemented mechanism is a key ladder.

15. The method of claim 1 , wherein the first format and the second format have different bitrates.

16. The method of claim 1 , wherein the server verifies the second client device's membership in the particular domain before allowing the second client device to obtain the second key.

17. A system for managing access to digital content, the system comprising:

a first client device, which is a set top box (STB) belonging to a particular domain, configured to

receive, from a source outside of the particular domain, the digital content, the received digital content being encrypted and in a first format,

decrypt the received digital content using a first key to produce decrypted digital content in the first format,

transcode the decrypted digital content in the first format to produce the digital content in a second format,

derive a second key based on information received from a server;

re-encrypt the digital content in the second format using the second key, and

transmit the re-encrypted digital content in the second format; and

a second client device belonging to the particular domain, configured to receive the re-encrypted digital content in the second format transmitted by the first client device,

wherein the second client device connects to the server to obtain a copy of the second key derived at the server and decrypts the re-encrypted digital content in the second format.

18. The system of claim 17 , wherein the first client device is a set-top box (STB) gateway including a digital video recorder (DVR).

19. The system of claim 17 , wherein the second client device is a mobile device.

20. The system of claim 17 , wherein server from which the second client obtains the second key is a video content authority system (VCAS).

21. A method to manage access to digital content within a particular domain, the method comprising:

delivering the digital content, from a source outside of the particular domain, to a first client device which is a set top box (STB), the delivered digital content being encrypted and in a first format,

wherein the first client device decrypts the received digital content in the first format using a first key to produce decrypted digital content in the first format and transcodes the decrypted digital content in the first format to produce the digital content in a second format;

wherein the first client device re-encrypts the digital content in the second format using a second key and transmits the re-encrypted digital content in the second format, and

wherein a second client device within the particular domain receives the re-encrypted digital content in the second format transmitted by the first client device and connects to a server to obtain the second key and decrypts the re-encrypted digital content in the second format,

wherein the second key is derived by the first client device and by the server.