Secure bridging of third-party digital rights management to local security

1. A method, comprising:

at a headend of a multichannel video programming distributor (MVPD), the headend including a virtual set-top application, an MVPD network distinct from the virtual set-top application, a first router communicatively coupled to the virtual set-top application, a conditional-access encoder, and a second router coupled to the conditional-access encoder:

at the virtual set-top application:

receiving encrypted content from a content provider, wherein the content provider is distinct from the MVPD;

decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider;

processing the decrypted content from the content provider;

encrypting data corresponding to the processed decrypted content from the content provider;

transmitting the encrypted data over a secure data link from the first router to the second router, wherein the secure data link comprises a virtual private network (VPN) implemented across an Ethernet link; and

at the second router, decrypting the encrypted data and sending the decrypted data from the second router to the conditional-access encoder;

determining whether a set-top of a customer supports user-interface overlay rendering; and

upon determining that the set-top of the customer does not support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data and at least one user-interface overlay using a second DRM protocol compatible with the set-top of the customer, wherein the second DRM protocol is distinct from the first DRM protocol; and

transmitting the data and the at least one user-interface overlay, as encrypted by the conditional-access encoder, to the set-top of the customer; and

upon determining that the set-top of the customer does support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data using the second DRM protocol compatible with the set-top of the customer; and

transmitting, to the set-top of the customer (i) the data as encrypted by the conditional-access encoder, and (ii) the at least one user-interface overlay that has not been encrypted using the second DRM protocol.

2. The method of claim 1 , wherein:

receiving the encrypted content, decrypting the encrypted content, and processing the decrypted content are performed in a secure application server at a central location.

3. The method of claim 2 , wherein decrypting the encrypted content is performed using a key from a secure keybox in the secure application server.

4. The method of claim 1 , wherein receiving the encrypted content from the content provider comprises receiving the encrypted content from a content-distribution network associated with the content provider.

5. The method of claim 4 , wherein the encrypted content is received from the content-distribution network via the Internet.

6. The method of claim 1 , wherein:

the encrypted content comprises encrypted video; and

processing the decrypted content comprises scaling the video to fit a window of a screen.

7. The method of claim 1 , wherein:

the encrypted content comprises encrypted video; and

processing the decrypted content comprises overlaying user-interface graphics on the video.

8. The method of claim 1 , wherein the MVPD is a cable-TV company or a satellite-TV company.

9. The method of claim 1 , wherein the headend of the MVPD distributes the processed content as encrypted by the conditional-access encoder via the Internet.

10. The method of claim 1 , wherein the encrypted content comprises encrypted audio.

11. The method of claim 1 , wherein the encrypted content comprises an encrypted image.

12. An electronic system, comprising:

a secure application server of a multichannel video programming distributor (MVPD), including a virtual set-top application, an MVPD network distinct from the virtual set-top application, a first router communicatively coupled to the virtual set-top application, a conditional-access encoder, and a second router coupled to the conditional-access encoder, comprising one or more processors and memory storing one or more programs configured to be executed by the one or more processors, the one or more programs including instructions for:

receiving encrypted content from a content provider, wherein the content provider is distinct from the MVPD;

decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider;

processing the decrypted content from the content provider;

encrypting data corresponding to the processed decrypted content from the content provider;

transmitting the encrypted data over a secure data link from the first router to the second router, wherein the secure data link comprises a virtual private network (VPN) implemented across an Ethernet link;

at the second router, decrypting the encrypted data and sending the decrypted data from the second router to the conditional-access encoder; and

determining whether a set-top of a customer supports user-interface overlay rendering; and

upon determining that the set-top of the customer does not support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data and at least one user-interface overlay using a second DRM protocol compatible with the set-top of the customer, wherein the second DRM protocol is distinct from the first DRM protocol; and

transmitting the data and the at least one user-interface overlay, as encrypted by the conditional-access encoder, to the set-top of the customer; and

upon determining that the set-top of the customer does support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data using the second DRM protocol compatible with the set-top of the customer; and

transmitting to the set-top of the customer (i) the data as encrypted by the conditional-access encoder, and (ii) the at least one user-interface overlay that has not been encrypted using the second DRM protocol.

13. A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors at a headend of a multichannel video programming distributor (MVPD), the headend including a virtual set-top application, an MVPD network distinct from the virtual set-top application, a first router communicatively coupled to the virtual set-top application, a conditional-access encoder, and a second router coupled to the conditional-access encoder, the one or more programs including instructions for:

at the virtual set-top application:

receiving encrypted content from a content provider, wherein the content provider is distinct from the MVPD;

decrypting the encrypted content in accordance with a first Digital Rights Management (DRM) protocol used by the content provider;

processing the decrypted content from the content provider;

encrypting data corresponding to the processed decrypted content from the content provider;

transmitting the encrypted data over a secure data link from the first router to the second router, wherein the secure data link comprises a virtual private network (VPN) implemented across an Ethernet link;

at the second router, decrypting the encrypted data and sending the decrypted data from the second router to the conditional-access encoder;

determining whether a set-top of a customer supports user-interface overlay rendering; and

upon determining that the set-top of the customer does not support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data and at least one user-interface overlay using a second DRM protocol compatible with the set-top of the customer, wherein the second DRM protocol is distinct from the first DRM protocol;

transmitting the data and the at least one user-interface overlay, as encrypted by the conditional-access encoder, to the set-top of the customer; and

upon determining that the set-top of the customer does support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data using the second DRM protocol compatible with the set-top of the customer; and

transmitting, to the set-top of the customer (i) the data as encrypted by the conditional-access encoder, and (ii) the at least one user-interface overlay that has not been encrypted using the second DRM protocol.

14. The method of claim 1 , wherein:

the virtual set-top application is executed by a secure application server.

15. The method of claim 1 , wherein the headend of the MVPD comprises a headend of a cable TV provider.

16. The method of claim 1 , further comprising:

at a first instance of the virtual set-top application, determining that a first set-top of a first customer supports user-interface overlay rendering;

upon determining that the first set-top of the first customer does not support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted data and the at least one user-interface overlay using the second DRM protocol compatible with the first set-top of the customer, wherein the second DRM protocol is distinct from the first DRM protocol; and

transmitting the encrypted content and the at least one user-interface overlay, as encrypted by the conditional-access encoder, to the first set-top of the first customer; and

at a second instance of the virtual set-top application, determining that a second set-top of a second customer supports user-interface overlay rendering;

upon determining that the second set-top of the second customer does support user-interface overlay rendering:

encrypting, via the conditional-access encoder, the decrypted and processed content using the second DRM protocol compatible with the second set-top of the second customer; and

transmitting, to the second set-top of the second customer (i) the encrypted content as encrypted by the conditional-access encoder, and (ii) the at least one user-interface overlay that has not been encrypted using the second DRM protocol.