Method for ensuring content protection and subscription compliance

Abstract

A method for enforcing compliance in both the copy protect domain and service subscription domain for streamed multicast data. Each content is encrypted with a title key that itself is encrypted with a channel unique key which is a hash of a session key and a channel key. A compliant player is given the channel key upon registration for a subscription service (representing subscription protection) and is also given device keys upon activation (representing copy protection) for decrypting the session key. Consequently, the channel unique key can be obtained (and, hence, the content decrypted) only by a player that is compliant with both copy protection rules and subscription rules. The channel key can be refreshed periodically as subscriptions change or expire.

Description

BACKGROUND OF THE INVENTION

[0002] 1. Field of the Invention

[0003] The present invention relates generally to multicast data encryption.

[0004] 2. Description of the Related Art

[0005] Protecting copyrights of content owners and subscription rights of providers of the content poses considerable challenges in the digital age, particularly to content that is “streamed” to users over the Internet. In contrast to more conventional content download, in streaming paradigms the data that is being transmitted can be used by the recipient before the end of the file has been received. For time-dependent content such as music or videos, streaming requires mechanisms to ensure that data is available when needed.

[0006] “Streaming” is one common application of multicasting. In multicasting, multiple users can receive the same stream roughly simultaneously. Multicasting thus combines characteristics of broadcasting and point-to-point communications, since a copy of the data is sent to all recipients.

[0007] The rights of two separate entities are implicated in content streaming. First, the content owner typically desires that the content not be copied, i.e., that the content not be copied unless explicitly authorized. This requirement remains fixed over time. Second, the provider of the service that streams the content to users wants to ensure that only authorized users receive the stream, typically pursuant to a paid-for subscription or pay-per-view service, and that unauthorized users cannot access the content absent a subscription regardless of whether they are using copyright-compliant players. The latter requirement changes over time, since subscriptions typically are time-based and usually expire after a subscription period. The present invention thus recognizes the need for multiple enforcement domains, i.e., for a subscription enforcement domain overlaid on a copyright protection domain.

[0008] The present invention further recognizes that certain broadcast encryption schemes can be used in the streaming data application described above to achieve both copyright protection and subscription enforcement. Two such schemes are summarized here.

[0009] U.S. Pat. No. 6,118,873, incorporated herein by reference, discloses a system for encrypting broadcast music, videos, and other content. As set forth therein, only authorized players, implemented either by hardware or software, can play and/or copy the content and only in accordance with rules established by the vendor of the content.

[0010] In the encryption method disclosed in the above-referenced patent, authorized players are issued software-implemented device keys from a matrix of device keys. The keys can be issued simultaneously with each other or over time, but in any event, no player is supposed to have more than one device key per column of the matrix. Although two players might share the same key from the same column, the chances that any two players share exactly the same set of keys from all the columns of the matrix are very small when keys are randomly assigned. The keys are used to decrypt content.

[0011] In the event that a player (and its keys) becomes compromised, deliberately or by mistake, it is necessary to revoke the keys of that player. Revoking a set of keys effectively renders the compromised player (and any clones thereof) inoperable to play content that is produced after the revocation.

[0012] Another broadcast encryption method is disclosed in the above-referenced parent application, in which players are grouped into (possibly overlapping) subsets, with each subset having a unique, long-lived subset key. Each player is assigned respective private information Iu. A short-lived session encryption key K is selected, and players that are not in a revoked set R are partitioned into disjoint subsets Si1, . . . Sim having associated subset keys Li1, . . . ,Lim. The session key K is encrypted with the subset keys Li1, . . . ,Lim to render m encrypted versions of the session key K. The players establish leaves in a tree such as a complete binary tree, and the subsets Si1, . . . Sim are induced by the tree.

[0013] With more specificity, in the parent application the players are initially partitioned into groups S1, . . . ,Sw, wherein “w” is an integer. A given transmission selects m such groups as a “cover” for non-revoked players, with the cover being defined by the set of revoked players. The “cover” groups establish subtrees (either complete subtrees or a difference between two subtrees) in a tree. A player's private information Iu is preferably found as information ij in a transmitted message that indicates that a player belongs to a subset Sij of one of the groups S1, . . . ,Sw. In one embodiment, the information Iu consists of a player's position in the tree and the subset keys that are associated with ancestor nodes of the player. A subset key Lij can then be obtained from or derived using the private information of the player.

[0014] In one embodiment referred to as the “complete subtree” method, respective groups correspond to all possible subtrees in the complete tree. Each player is assigned keys from all nodes that are in a direct path between a leaf representing the player and the root of the tree. In other words, each subset S1 includes all leaves in a subtree rooted at some node v1, with at least each node in the subtree being associated with a respective subset key. In this embodiment, content is provided to players in a message defining a header, and the header includes at most r*log(N/r) subset keys and encryptions, wherein r is the number of players in the revoked set R and N is the total number of players. Moreover, each player must store log N keys, and each player processes the message using at most log N operations plus a single decryption operation.

[0015] In a second embodiment referred to as the “subset difference” method, respective groups of players correspond to a universe of sets S1, . . . ,Sw that can be described as “a first subtree A minus a second subtree B that is entirely contained in A”. Each node in this tree has a set of labels, one unique to the node and others that are induced by ancestor nodes. Each player is assigned labels from all nodes hanging from nodes in a direct path between the receiver and the root (at most logN labels from each such node), but not from nodes in the direct path itself. In other words, each subset includes all leaves in a subtree rooted at some node vi that are not in the subtree rooted at some other node vj that descends from vi. One of the labels of the subset difference nodes for a particular player are provided to the player in a transmission as that player's private information. Using the labels, the player can generate the subset keys necessary for decryption.

[0016] With respect to the subset difference method of the parent application, the revoked set R defines a spanning tree. A cover tree T is initialized as the spanning tree, and then the method iteratively removes nodes from the cover tree T and adds subtrees to the cover tree T until the cover tree T has at most one node. The cover tree T is used to identify subset keys to be used in a particular transmission, with players evaluating the pseudorandom sequence generator to derive subset keys from the labels. Preferably, for processing efficiency revocations are processed in order from left to right such that only two revocations at a time must be kept in memory.

[0017] Other less preferred encryption systems have been provided. Examples of such systems include the tree-based logical key hierarchy systems disclosed in Wallner et al., Key Management for Multicast: Issues and Architectures, IETF draft wallner-key, 1997, and Wong et al., Secure Group Communication Using Key Graphs, SIGCOMM 1998. With more specificity regarding the methods of Wallner et al. and Wong et al., keys are assigned by assigning an independent label to each node in a binary tree. Unfortunately, in the referenced methods some of the labels change at every revocation, and consequently are inappropriate for certain scenarios such as the stateless player scenario and moreover would require excessive encryptions and decryptions.

SUMMARY OF THE INVENTION

[0018] The invention includes a computer system for undertaking the inventive logic set forth herein. The invention can also be embodied in a computer program product that stores the present logic and that can be accessed by a processor to execute the logic. Also, the invention is a computer-implemented method that follows the logic disclosed below.

[0019] A method for multicasting data includes encrypting a title T with a title key KT, and encrypting the title key KT with a channel-unique key Kcu using an encryption function S to render a multicast data channel encrypted as SKcu(KT), SKT(T).

[0020] In a preferred embodiment, the channel-unique key Kcu is the result of a combination such as a hash of a channel key Kc and a session key Ks. Moreover, the session key Ks preferably is encrypted with a first encryption scheme BRs1 to render a session key block.

[0021] In the preferred embodiment, a player is provided with device keys Kd during or pursuant to activation of the player. Also, the player is provided with the channel key Kc and a session key block during or pursuant to registration of the player with a subscription service. These provisions can be made point-to-point or as part of a broadcast. In any case, the player can determine the session key Ks from the session key block using the device keys Kd.

[0022] If desired, the method can include periodically refreshing the channel key Kc to enforce subscriptions, and selectively updating the session key block to revoke compromised players. The channel key Kc can be refreshed by encrypting a new channel key Kc′ with an encryption scheme. For bandwidth considerations, the channel key Kc′ can be sent in a message that is split, and it also can be refreshed using plural messages.

[0023] In a particularly preferred embodiment, at least the encryption scheme BRs2 includes assigning each player in a group of players respective private information Iu, and partitioning players not in a revoked set R into disjoint subsets Si1, . . . Sim having associated subset keys Li1, . . . Lim. The scheme further includes encrypting the session key KS with the subset keys Li1, . . . ,Lim to render m encrypted versions of the session key KS. If desired, the encryption scheme BRs2 may further include partitioning the players into groups S1, . . . , Sw, wherein “w” is an integer, and the groups establish subtrees in a tree. The tree includes a root and plural nodes, with each node having an associated label. Each subset can include all leaves in a subtree rooted at some node vi that are not in the subtree rooted at some other node vj that descends from vi. The revoked set R can define a spanning tree, and the encryption scheme can further entail initializing a cover tree T as the spanning tree, and iteratively removing nodes from the cover tree T and adding nodes to a cover until the cover tree T has at most one node. Or, each node can have a label possibly induced by at least one of its ancestors, and each player can be assigned labels from all nodes hanging from a direct path between the player and the root but not from nodes in the direct path. Labels can be assigned to subsets using a pseudorandom sequence generator.

[0024] In another aspect, a method for enforcing copy protection compliance and subscription compliance includes providing players with respective device keys Kd that are useful for enabling copy protection compliance. The method also includes providing players with at least one channel key Kc that is useful for enabling subscription compliance, such that a player can decrypt content only if the player is both compliant with copy protection and the player is an active subscriber to a content channel.

[0025] In still another aspect, a player for decrypting streamed content includes at least one device key Kd and means for decrypting a session key Ks using the device key Kd. The player also includes means for decrypting a channel unique key Kcu using at least the session key Ks. Moreover, the player can include means for deriving a title key KT using at least the channel unique key Kcu, with the title key KT being useful for decrypting content.

[0026] In yet another aspect, a computer program device has a computer program storage device which includes a program of instructions that are usable by a computer. The device includes logic means for receiving private information Iu upon registration with a content provider. Also, the device has logic means for subscribing to at least one content channel provided by the content provider, and logic means for receiving at least one channel key Kc in response to subscribing to the channel. Logic means are provided for using at least the channel key Kc and private information Iu to decrypt content streamed over the channel.

[0027] The details of the present invention, both as to its structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which:

BRIEF DESCRIPTION OF THE DRAWINGS

[0028] FIG. 1 is a block diagram of the present system;

[0029] FIG. 2 is a flow chart depicting the dual enforcement domain concept;

[0030] FIG. 3 is a flow chart of the overall encryption logic;

[0031] FIG. 4 is a flow chart of the player logic; and

[0032] FIG. 5 is a schematic diagram of the various states that a player can enter, along with a legend.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0033] Referring initially to FIG. 1, a system is shown, generally designated 10, for enforcing content copyright protection as well as subscription service protection. As indicated in FIG. 1, players (only a single player 12 shown for clarity) receive content by multicast streaming from a subscription service provider 14, which in turn receives the content from a content owner 16. While the present invention focusses on streamed data, it is to be understood that the principles of the present invention apply equally to other applications, such as to content that is downloaded in files without streaming.

[0034] The components 12, 14, 16 can be implemented by hardware or software. They can communicate via wired or wireless links, and can use computer networks such as the Internet to communicate with each other. Content from the content owner 16 can be provided to the subscription service provider 14 off-line, e.g., by shipping disks storing digital content from the content owner 16 to the provider 14.

[0035] By “broadcast” or “multicast” is meant the wide dissemination of a program from a source such as the subscription service provider to many players simultaneously over cable (from a satellite source), or wire, or radiofrequency (including from a satellite source).

[0036] It is to be understood that the logic shown and discussed below, which may be executed by a processor as a series of computer-executable instructions, is executed by processors associated with one or more of the components 12, 14, 16. The instructions may be contained on a data storage device with a computer readable medium, such as a computer diskette having a computer usable medium with computer readable code elements stored thereon. Or, the instructions may be stored on a DASD array, magnetic tape, conventional hard disk drive, electronic read-only memory, optical storage device, or other appropriate data storage device. In an illustrative embodiment of the invention, the computer-executable instructions may be lines of compiled C++ compatible code.

[0037] Indeed, the flow charts herein illustrate the structure of the logic of the present invention as embodied in computer program software. Those skilled in the art will appreciate that the flow charts illustrate the structures of computer program code elements including logic circuits on an integrated circuit, that function according to this invention. Manifestly, the invention is practiced in its essential embodiment by a machine component that renders the program code elements in a form that instructs a digital processing apparatus (that is, a computer) to perform a sequence of function acts corresponding to those shown.

[0038] Now referring to FIG. 2, the overall logic for enforcing compliance in two domains—copy protection, and subscription—can be seen. Commencing at block 18, all legitimate players are provided with respective keys and/or information that are useful for decrypting streamed content. The initial provision of device keys Kd is made for copy protection compliance. Block 20 represents subscription compliance, wherein the subset of players that have subscribed to a particular channel are identified, and the channel content is encrypted such that only the subset of players subscribing to the channel can decrypt channel content.

[0039] Preferred implementations of the above are set forth below in reference to FIG. 3. In the disclosure below, the notation BRSk represents the encryption of a key K using a broadcast encryption algorithm B under a symmetric cryptosystem S, such that players in a set R are excluded. The symmetric cryptosystem S preferably is a symmetric cryptographic algorithm such as DES or SEAL. The resulting ciphertext can be referred to as a session key block.

[0040] Commencing at block 22, a session key KS is encrypted with a copy compliance algorithm BRS1 to render a session key block. In one embodiment, the copy compliance algorithm BRS1 is the method set forth in the above-referenced patent and/or known as the C2 cipher available at www.4centity.com; in another embodiment, it is the method set forth in the parent application, and more particularly it is the subset difference method of the parent application.

[0041] Moving to block 24, a channel unique key Kcu can be generated from the session key Ks and a channel key Kc. In one non-limiting embodiment, the channel unique key Kcu is a hash of a concatenation of the session key Ks and channel key Kc.

[0042] In parallel with the operations of blocks 22 and 24, at block 26 a piece of content to be streamed, e.g., a video clip or movie, audio clip or movie, book, and so on, referred to herein as a “title”, is encrypted with a title key KT using the preferably symmetric algorithm S. At block 28, the results of blocks 24 and 26 are combined as follows. The title key KT is encrypted with the channel unique key Kcu using the preferably symmetric algorithm S. Then, at block 30, the channel is encrypted as the encryption of the title with the title key (SKT(T)) and the encryption of the title key with the channel unique key (SKcu(KT)).

[0043] Having described how streamed content preferably is encrypted, FIGS. 4 and 5 show how the system configures players to receive and decrypt content while enforcing both copy protection rules (by ensuring compliant players) and subscription protection. Commencing at block 32 in FIG. 4 and as indicated at state 34 in FIG. 5, an initially disabled player is enabled to an inactive state 36 by providing it with the code necessary to undertake the logic herein, and then activated to state 38 by providing it with a preferably unique set of device keys Kd in accordance with the above-referenced patent documents. This provision can be made during manufacture or subsequently during a separate activation step. If made separately, the device keys Kd can be transferred using, e.g., a public key exchange method P1.

[0044] As indicated at block 40 in FIG. 4, the player can next move to a registered state 42 (FIG. 5). In one non-limiting embodiment, this is done by the player sending public information about itself to the subscription service provider 14, which in return sends private information Iu to the player using a key exchange method P1′. In one nonlimiting embodiment algorithms P1 and P1′ can be implemented using secure socket layers with server-side certificates. One set of private information Iu preferably is provided for each subscription. In one illustrative embodiment, the private information Iu is the private information mentioned above and disclosed in the parent application.

[0045] Once a player is registered, at block 44 it can move to a subscribed state 46, wherein the player is subscribed to one or more channels from the subscription service provider 14. Ordinarily, the subscription process entails a payment from the player to the service provider. The terms of subscriptions can vary in duration, content, cost, etc., with the subscriptions being dynamic and each player potentially having several subscriptions simultaneously.

[0046] Although being entitled to a subscription, a player might not be actually receiving the content until it connects to the service at block 48 to enter an online state 50. The service provider 14 verifies that the player's subscription to the channel is valid for access control, and if valid, a current channel key Kc is sent to the player using a point to point exchange by means of a public key exchange method, denoted P2. The algorithm P2 can be implemented using the method of the above-referenced patent with a player-side media key block and secret media identification known only to the player and the service provider. This player-side media key block is not to be confused with the session key block.

[0047] Additionally, the player receives from the service provider the session key block, which as described above is an encryption of the current session key under the abovementioned copy compliance algorithm BRS1. Along with the session key block, the player receives the current title key KT, encrypted with the channel unique key Kcu as described above.

[0048] In an alternative embodiment, instead of a point-to-point transfer the data exchanged at block 48 can be broadcast in-band. Specifically, the encryption data can be periodically transmitted over the channel, so that online, authorized players can receive it and use it for decryption.

[0049] In any case, it may now be appreciated that an authorized player, while online, can receive and decrypt content at block 52 if it has not been revoked per the below discussion, and if it has a valid subscription to the channel. To decrypt the content, the player accesses its various device keys Kd and private information Iu as follows. In one illustrative, non-limiting embodiment, the session key Ks is derived from the session key block using the device keys Kd in accordance with the patent and/or parent application referred to above. Using the session key Ks and channel key Kc, the channel unique key Kcu is decrypted. In turn, the title key KT is derived using the channel unique key Kcu, with the title key KT being used for decrypting content. This process is represented by listen loop 53 in FIG. 5.

[0050] The player can return to state 46 in FIG. 5 by disconnecting, as indicated by the loop 54. Also, as discussed above the channel key Kc can be periodically refreshed, as indicated by the loop 56, by sending a new channel key Kc′ only to subscribers of the channel. The new key preferably is sent using a message that is a function of the old channel key Kc and a subscription compliance algorithm BRS2, namely, SKcu(BRS2(Kc′)). In one preferred, non-limiting embodiment, the subscription compliance algorithm BRS2 is the above-summarized subset difference method of the parent application, with players whose subscriptions have expired in the preceding period being included in the revoked set R of the algorithm. Such a refresh can be thought of as a minimal refresh, since it excludes only players whose subscriptions have just expired. Note that players not having the current channel key Kc cannot decrypt the refresh message and therefore need not be included in the set R, thus reducing the size of the refresh message.

[0051] For the first time a player connects, to obtain the channel unique key Kcu the player uses its device keys Kd to obtain the session key Ks, which is then combined with the channel key Kc using the hash function to render the channel unique key Kcu. After a refresh loop 56, a new channel key Kc′ is computed (using private information Iu in accordance with the parent application, and more preferably with the subset difference method of the parent application) and combined with the session key, with the resulting new channel unique key Kcu′ excluding all revoked and expired players.

[0052] When the player's subscription expires, the player is not provided with the refreshed channel key, causing it to return to the registered state 42 in FIG. 5, as indicated by the loop 58. Subsequently moving from state 42 to state 46 and from state 46 to state 50 is accomplished in accordance with the disclosure above.

[0053] Players that are not connected during a refresh but still have a valid subscription can connect to obtain the current channel key. However, as recognized herein a rogue player can claim to have disconnected but in fact can continue to listen to the channel. To counter this, the service provider 14 maintains a list of all players that could have the current channel key, and these players can be excluded from the refresh (i.e., entered into the set R) if their subscriptions have expired. Players with a subscription that is just expiring and that obtained the channel key through a connect transition at some point in the past are considered to be connected for the purpose of exclusion in the current refresh transition.

[0054] Additionally, if a player whose subscription expired more than one refresh period in the past (and, hence, is not included in the exclude set R) obtains the channel key Kc illegally, it would be able to decrypt the new channel key Kc′ and all future channel keys, as long it constantly monitors the channel. Accordingly, the present invention can exclude, in every refresh message, all players whose subscription will not be valid during the following period. Such a refresh can be thought of as a full refresh requiring a full revocation message. However, since the size of the exclude set R might be large, the following two optimizations can be used.

[0055] The full revocation message can be split and gradually sent over time. As a result, the refresh does not take effect instantaneously for all players. Also, players whose subscription expired long ago are sporadically revoked. That is, an intermediate revocation message is constructed that includes all players who must be revoked as well as many of the long-ago expirations that bandwidth permits.

[0056] In the event that it is discovered that the player has been compromised, it is necessary to revoke the player's device keys Kd and configure it to a revoked state 60, so that it cannot be used to make unauthorized copies of content. The copy compliance algorithm BRS1 must be able to trace the originally licensed players whose device keys were compromised and revoke these players.

[0057] To revoke one or more players, a new session key block is generated that revokes all players that have ever been revoked, i.e., exclusion is cumulative. The content owner 16 can distribute the new session key blocks to the service provider 14, which is responsible for updating it for secure streaming. The new session key block is broadcast in the clear to all connected players to update the session key block, as indicated by the loop 61; those who connect after the update can obtain the new session key block in a point-to-point exchange. Note that typically the same session key block is used by all compliant service providers for all channels.

[0058] When a revoked, connected player attempts to listen to any channel for which an updated session key block has been provided, it cannot decrypt the new session key Ks′ and thus cannot access the content. When this happens, the user of the revoked player must restart the entire process, since a revoked player is for all practical purposes the same as a disabled player in state 34.

[0059] As mentioned above, the preferred implementation requires a player to store a set of device keys for content protection and a set of private information for each subscription service. As recognized here, this might exceed the capacity of smaller players, requiring that only a single enforcement domain be used, either copy protection or subscription protection.

[0060] For a copy protection domain only, keys are drawn from a tree and provided only once. The channel key is transmitted to all players and can be decrypted by all; however, a compliant player will not use the key to decrypt content unless it is subscribed. The refresh transition simply refreshes the channel key using the previous channel key. This method requires only a single set of keys at a player, requires a central agency to coordinate revocations, and should be designed to sustain many revocations.

[0061] For subscription domain only, all keys are drawn from a single tree, and there are no device keys. The unique set of keys is given to players at activation. During subscription the player and its keys are identified and a message containing the channel key is transmitted. At refresh, a revocation message excluding all players whose subscriptions is about to expire is multicast.

[0062] Because every service provider must be able to construct a revocation message, all providers must have the same keys. Therefore, this scheme uses public key techniques. Players that are found to violate compliance can be excluded from every message, thus effectively revoking those players.

[0063] It is to be understood that the principles disclosed herein can be applied to multicasting such as videoconferencing, with the service provider enforcing access control to the conference. Every node encrypts its messages using the same algorithms described in the listen state. A title can be equivalent to a message originating from one user, or the conference may be split into chunks of fixed duration. Compliance is used to ensure no unauthorized use of the conference content is made.

[0064] While the particular METHOD FOR ENSURING CONTENT PROTECTION AND SUBSCRIPTION COMPLIANCE as herein shown and described in detail is fully capable of attaining the above-described objects of the invention, it is to be understood that it is the presently preferred embodiment of the present invention and is thus representative of the subject matter which is broadly contemplated by the present invention, that the scope of the present invention fully encompasses other embodiments which may become obvious to those skilled in the art, and that the scope of the present invention is accordingly to be limited by nothing other than the appended claims, in which reference to an element in the singular means “at least one”, not “only one”, unless otherwise stated in the claim. All structural and functional equivalents to the elements of the above-described preferred embodiment that are known or later come to be known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be encompassed by the present claims. Moreover, it is not necessary for a device or method to address each and every problem sought to be solved by the present invention, for it to be encompassed by the present claims. Furthermore, no element, component, or method step in the present disclosure is intended to be dedicated to the public regardless of whether the element, component, or method step is explicitly recited in the claims. No claim element herein is to be construed under the provisions of 35 U.S.C. §112, sixth paragraph, unless the element is expressly recited using the phrase “means for” or, in the case of a method claim, the element is recited as a “step” instead of an “act”.

Claims

1. A method for securely transmitting multicast data, comprising: encrypting at least one title T with at least title key KT; and encrypting the title key KT with at least one channel-unique key Kcu using at least one encryption function S to render a multicast data channel encrypted as SKcu(KT), SKT(T).

2. The method of claim 1, wherein the channel-unique key Kcu is the result of a combination of a channel key Kc and a session key Ks.

3. The method of claim 2, wherein the combination is a hash function of a concatenation of the channel key Kc and session key Ks.

4. The method of claim 2, wherein the session key Ks is encrypted with at least a first encryption scheme BRs1 to render a session key block.

5. The method of claim 4, comprising providing at least one player with device keys Kd to activate the player.

6. The method of claim 5, comprising providing the player with the channel key Kc.

7. The method of claim 6, wherein at least one of the providing acts is undertaken in a point-to-point communication.

8. The method of claim 6, wherein at least one of the providing acts is undertaken as part of a broadcast.

9. The method of claim 6, comprising providing the player with the session key block.

10. The method of claim 9, wherein the player can determine the session key Ks from the session key block using the device keys Kd.

11. The method of claim 10, comprising periodically refreshing the channel key Kc to enforce subscriptions.

12. The method of claim 10, comprising selectively updating the session key block.

13. The method of claim 12, comprising updating the session key block by encrypting an updated session key with at least the encryption scheme BRs1.

14. The method of claim 11, wherein a new channel key Kc′ is encrypted with at least a second encryption scheme BRs2.

15. The method of claim 14, wherein the new channel key Kc′ is sent in a message that is split.

16. The method of claim 14, wherein the new channel key Kc′ is refreshed using plural messages.

17. The method of claim 14, wherein the encryption scheme BRs2 includes: assigning each player in a group of players respective private information Iu; partitioning players not in a revoked set R into disjoint subsets Si1, . . . Sim having associated subset keys Li1, . . . Lim; and encrypting the session key KS with the subset keys Li1, . . . Lim to render m encrypted versions of the session key KS.

18. The method of claim 17, wherein the encryption scheme BRs2 further includes partitioning the players into groups S1, . . . ,Sw, wherein “w” is an integer, and the groups establish subtrees in a tree.

19. The method of claim 18, wherein the tree includes a root and plural nodes, each node having at least one associated label, and wherein each subset includes all leaves in a subtree rooted at some node vi that are not in the subtree rooted at some other node vj that descends from v1.

20. The method of claim 19, wherein the revoked set R defines a spanning tree, and wherein the method includes: initializing a cover tree T as the spanning tree; iteratively removing nodes from the cover tree T and adding nodes to a cover until the cover tree T has at most one node.

21. The method of claim 19, wherein each node has at least one label possibly induced by at least one of its ancestors, and wherein each player is assigned labels from all nodes hanging from a direct path between the player and the root but not from nodes in the direct path.

22. The method of claim 21, wherein labels are assigned to subsets using a pseudorandom sequence generator, and the act of decrypting includes evaluating the pseudorandom sequence generator.

23. The method of claim 1, wherein the data is streamed to players.

24. A method for enforcing copy protection compliance and subscription compliance, comprising: providing players with respective device keys Kd useful for enabling copy protection compliance; and providing players with at least one channel key Kc useful for enabling subscription compliance, such that a player can decrypt content only if the player is both compliant with copy protection and the player is an active subscriber to a content channel.

25. The method of claim 24, wherein the content is streamed to players.

26. The method of claim 25, comprising: encrypting at least one title T with at least title key KT; and encrypting the title key KT with at least one channel-unique key Kcu using at least one encryption function S to render a multicast data channel encrypted as SKcu(KT), SKT(T).

27. The method of claim 26, wherein the channel-unique key Kcu is the result of a combination of the channel key Kc and a session key Ks.

28. The method of claim 27, wherein the combination is a hash function of a concatenation of the channel key Kc and a session key Ks.

29. The method of claim 27, wherein the session key Ks is encrypted with at least a first encryption scheme BRs1 to render a session key block.

30. The method of claim 29, comprising providing at least one player with its respective device keys Kd to activate the player.

31. The method of claim 30, comprising providing the player with the channel key Kc upon or in response to subscription.

32. The method of claim 30, wherein at least one of the providing acts is undertaken in a point-to-point communication.

33. The method of claim 30, wherein at least one of the providing acts is undertaken as part of a broadcast.

34. The method of claim 30, comprising providing the player with the session key block.

35. The method of claim 34, wherein the player can determine the session key Ks from the session key block using the device keys Kd.

36. The method of claim 35, comprising periodically refreshing the channel key Kc to enforce subscriptions.

37. The method of claim 34, comprising selectively updating the session key block.

38. The method of claim 35, wherein the new channel key Kc′ is refreshed by encrypting a new channel key Kc′ with at least one encryption scheme.

39. The method of claim 38, wherein the new channel key Kc′ is sent in a message that is split.

40. The method of claim 38, wherein the new channel key is refreshed using plural messages.

41. A player for decrypting streamed content, comprising: at least one device key Kd; means for decrypting a session key Ks using the device key Kd; means for decrypting a channel unique key Kcu using at least the session key Ks; and means for deriving a title key KT using at least the channel unique key Kcu, the title key KT being useful for decrypting content.

42. The player of claim 41, wherein the content is multicast to the player.

43. The player of claim 42, wherein the player includes means for receiving streamed content, and the content is streamed to the player.

44. A computer program device, comprising: a computer program storage device including a program of instructions usable by a computer, comprising: logic means for receiving private information Iu upon registration with a content provider; logic means for subscribing to at least one content channel provided by the content provider; logic means for receiving at least one encrypted channel key Kc at least partially in response to subscribing to the channel; logic means for deriving the channel key Kc using the information Iu; and logic means for using at least the channel key Kc to decrypt content streamed over the channel.

45. The computer program device of claim 44, further comprising: plural device keys Kd; logic means for receiving at least one session key block; logic means for deriving at least one session key Ks from the session key block using at least one device key Kd.

46. The computer program device of claim 45, further comprising: logic means for using the session key Ks and channel key Kc to derive a channel unique key Kcu; and logic means for using the channel unique key Kcu to decrypt a title key KT useful for decrypting the content.

47. The method of claim 14, wherein the new channel key Kc′ is sent in-band with the title T.

48. The method of claim 38, wherein the new channel key Kc′ is sent in-band with the title T.