Client device and local station with digital rights management and methods for use therewith

1. A client device comprising:

a memory for storing a current version certificate, the current version certificate having a corresponding current version;

at least one device interface for communications to and from a certification authority and a local station;

a processing module, coupled to the memory and the at least one device interface, that:

receives a current instance certificate, via the communications from the certificate authority, wherein the current instance certificate includes the current version identifier of the current version certificate and a current instance public key corresponding to a current instance private key;

sends the current instance certificate, via the communications to the local station, during a registration with the local station;

generates a request for video content and sends the request via the communications to the local station;

receives first encrypted data, via the communications from the local station, wherein the first encrypted data includes a content key that is encrypted via the current instance public key; and

receives second encrypted data via the communications from the local station, wherein the second encrypted data includes the video content that is encrypted via the content key.

2. The client device of claim 1 wherein the memory further stores the current instance certificate along with at least one past instance certificate, that includes a past instance public key corresponding to an earlier version certificate having an earlier version identifier than the current version identifier.

3. The client device of claim 2 , wherein the processing module identifies when third encrypted data received via communications from the local station corresponds to the at least one past instance certificate that is encrypted via a past instance public key, and wherein the client device further includes a cryptography module that decrypts the third encrypted data based on the past instance private key of the earlier version certificate.

4. The client device of claim 1 wherein the current instance certificate is signed by the certification authority.

5. The client device of claim 1 wherein the current version certificate is signed by the certification authority.

6. The client device of claim 1 wherein the processing module authenticates the client device to the certification authority, prior to receiving the current instance certificate, by including the current version certificate in the communications to the certification authority.

7. A local station comprising:

a memory for storing a plurality of current instance certificates corresponding to a plurality of client devices, wherein each of the plurality of current instance certificates includes a current version identifier and a current instance public key associated with a current instance private key of a corresponding one of the plurality of client devices;

at least one device interface, for communication to and from the plurality of client devices, a certification authority and at least one media content provider;

a processing module, coupled to the memory and the at least one device interface, that:

receives the plurality of current instance certificates, via the communications from the plurality of client devices, during registrations with the plurality of client devices;

receives a request for video content, via the communication from one of the plurality of client devices;

retrieves one of the plurality of current instance certificates corresponding to the one of the plurality of client devices;

authenticates the request based the one of the plurality of current instance certificates;

when the request is authenticated:

retrieves the requested video content via the communication with the at least one media content provider;

generates first encrypted data and sends the first encrypted data via the communication to the one of the plurality of client devices, wherein the first encrypted data includes a content key that is encrypted via the current instance public key; and

generates second encrypted data and sends the second encrypted data via the communications to the one of the plurality of client devices, wherein the second encrypted data includes the video content that is encrypted via the content key.

8. The local station of claim 7 , wherein the processing module receives revocation data via the communications from the certification authority, the revocation data indicating the revocation of at least one of the plurality of client devices, and

wherein the processing module authenticates the request by determining when the one of the plurality of current instance certificates has been revoked.

9. The local station of claim 7 , wherein the processing module receives revocation data via the communications from the certification authority, the revocation data indicating the revocation of at least one version identifier, and

wherein the processing module authenticates the request by determining when the current version identifier included in the one of the plurality of current instance certificates, has been revoked.

10. The local station of claim 7 wherein the current instance certificate is signed by the certification authority.

11. A method for use in a client device, the method comprising:

storing a current version certificate, the current version certificate having a corresponding current version identifier;

receiving a current instance certificate from a certificate authority, wherein the current instance certificate includes the current version identifier of the current version certificate and a current instance public key corresponding to a current instance private key of the client device;

sending the current instance certificate to a local station, during a registration with the local station;

generating a request for video content and sending the request to the local station;

receiving first encrypted data from the local station, wherein the first encrypted data includes a content key that is encrypted via the current instance public key; and

receiving second encrypted data from the local station, wherein the second encrypted data includes the video content that is encrypted via the content key.

12. The method of claim 11 further comprising:

storing at least one past instance certificate that includes a past instance public key corresponding to a past private key.

13. The method of claim 12 , further comprising:

identifying when third encrypted data received from the local station corresponds to the at least one past instance certificate that is encrypted via the past instance public key, and decrypting the third encrypted data based on the past private.

14. The method of claim 11 wherein the current instance certificate is signed by the certification authority.

15. The method of claim 11 wherein the current version certificate is signed by the certification authority.

16. The method of claim 11 further comprising:

authenticating the client device to the certification authority, prior to receiving the current instance certificate, by sending the current version certificate to the certification authority.

17. A method for use in a local station, the method comprising:

receiving a plurality of current instance certificates from a plurality of client devices, during registrations with the plurality of client devices;

storing the plurality of current instance certificates corresponding to the plurality of client devices, wherein each of the plurality of current instance certificates includes a current version identifier and a current instance public key associated with a current instance private key of a corresponding one of the plurality of client devices;

receiving a request for video content from one of the plurality of client devices;

accessing one of the plurality of current instance certificates corresponding to the one of the plurality of client devices;

authenticating the request based the one of the plurality of current instance certificates;

when the request is authenticated:

retrieving the requested video content from at least one media content provider;

generating first encrypted data and sending the first encrypted data to the one of the plurality of client devices, wherein the first encrypted data includes a content key that is encrypted via the current instance public key; and

generating second encrypted data and sending the second encrypted data to the one of the plurality of client devices, wherein the second encrypted data includes the video content that is encrypted via the content key.

18. The method of claim 17 , further comprising:

receiving revocation data from a certification authority, the revocation data indicating the revocation of at least one of the plurality of client devices; and

wherein authenticating the request includes determining when the one of the plurality of current instance certificates has not been revoked.

19. The method of claim 17 , further comprising:

receiving revocation data from a certification authority, the revocation data indicating the revocation of at least one version identifier; and

wherein authenticating the request includes determining when the current version identifier included in the one of the plurality of current instance certificates, has not been revoked.

20. The method of claim 17 wherein the current instance certificate is signed by a certification authority.