Dynamic broadcast content access management systems and methods
This disclosure relates to, among other things, systems and methods for the secure management and distribution of electronic content over broadcast communication channels. Certain embodiments disclosed herein may allow for implementation of a multi-tenant conditional access system whereby a client device may configure itself between multiple broadcast service operators. Robust key generation and management techniques are also described that may use a derived key structure to protect control words used to descramble broadcast content, providing additional measures of security and implementation redundancy.
1. A method for managing electronic content performed by a client device comprising a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the client device to perform the method, the method comprising:
receiving, by the client device, a broadcast content stream, the broadcast content stream comprising a plurality of encrypted content packets, at least one encrypted control word packet comprising at least one encrypted control word, and at least one license packet, the plurality of encrypted content packets being encrypted using the at least one control word;
processing, by the client device, the at least one license packet, wherein processing the at least one license packet comprises:
identifying target information associated with the at least one license packet;
identifying an initial secret key provisioned to the client device based, at least in part, on the target information;
generating a series of derived keys, the series of derived keys comprising a plurality of derived keys derived based, at least in part, on the initial secret key;
decrypting a content key included in the at least one license packet using at least one of the derived keys in the series of derived keys; and
decrypting the control word included in the at least one encrypted control word packet using the decrypted content key; and
descrambling the broadcast content stream by decrypting the plurality of encrypted content packets using the decrypted control word.
2. The method of claim 1 , wherein decrypting the content key included in the at least one license packet using the at least one of the derived keys in the series of derived keys comprises:
attempting to decrypt the content key using a terminal derived key in the series of the derived keys;
determining that the decryption of the content key using the terminal derived key was unsuccessful; and
decrypting the content key with a derived key preceding the terminal derived key in the series of derived keys.
3. The method of claim 1 , wherein the initial secret key comprises a unique device key.
4. The method of claim 1 , wherein the initial secret key comprises a group key.
5. The method of claim 4 , wherein the group key comprises a manufacturer group key.
6. The method of claim 4 , wherein the initial secret key comprises an operator group key.
7. The method of claim 6 , wherein the operator group key is associated with a particular broadcast service operator.
8. The method of claim 7 , wherein the method further comprises storing the generated series of derived keys in a database managed by the client device associated with the particular broadcast service operator.
9. The method of claim 1 , wherein the method further comprises receiving, at the client device, a request to render the broadcast content stream.
10. The method of claim 9 , wherein the method further comprises rendering, by the client device, the descrambled broadcast content stream.
11. The method of claim 1 , wherein the broadcast content stream comprises an MPEG-2 encoded transport stream.
12. The method of claim 1 , wherein the at least one license packet comprises an entitlement management message packet.
13. The method of claim 1 , wherein the at least one encrypted control word packet comprises an entitlement control message packet.
14. The method of claim 1 , wherein the series of derived keys is generated using, at least in part, a key derivation function.
15. The method of claim 14 , wherein the key derivation function comprises a one-way key derivation function.
16. The method of claim 1 , where the client device comprises a television.
17. The method of claim 1 , wherein the client device comprises a set top box.
18. The method of claim 1 , wherein the client device comprises a conditional access module.