| CPC G06F 21/105 (2013.01) [G06F 21/602 (2013.01); H04L 9/0877 (2013.01)] | 20 Claims |

|
1. A method comprising:
at a digital rights management (DRM) key protection system including one or more processors, a non-transitory memory, and a network interface:
receiving, from a first client system associated with a first receiving device of a plurality of receiving devices, an indication of a first user authentication by the first client system;
receiving, from a second client system associated with a second receiving device of the plurality of receiving devices, an indication of a second user authentication by the second client system;
receiving, from a DRM license system based on the first and second user authentications, a plurality of encrypted content keys respectively associated with the plurality of receiving devices, wherein the plurality of encrypted content keys includes a first encrypted content key that is associated with the first receiving device of the plurality of receiving devices, and wherein the plurality of encrypted content keys includes a second encrypted content key that is associated with the second receiving device of the plurality of receiving devices;
decrypting the first encrypted content key to generate a first decrypted content key, and decrypting the second encrypted content key to generate a second decrypted content key;
generating a first protected content key based on the first decrypted content key and a first key ladder associated with the first receiving device, and generating a second protected content key based on the second decrypted content key and a second key ladder associated with the second receiving device; and
providing the first protected content key to the first receiving device to enable the first receiving device to decrypt content using the first protected content key and provide the decrypted content to the first client system, and providing the second protected content key to the second receiving device to enable the second receiving device to decrypt content using the second protected content key and provide the decrypted content to the second client system.
|