Abstract: In one embodiment, a method for securing data on a semi-trusted server is implemented on a computing device and includes: receiving at least a current session key from a user device for use during a current session, where the current session key is suitable for encrypting data and for decrypting data encrypted with the current session key, decrypting communications received from the user device during the session with said session key, encrypting with the session key at least one of communications to be sent to said user device and personal data generated during the session, storing the encrypted personal data, and discarding the current session key upon completion of the session, thereby limiting possible access to the stored encrypted personal data other than during the session. Related apparatus and methods are also described.

Abstract: A method for communication, including distributing over a communication network multiple channels of digital content, which are encrypted using different, channel-specific control words, and transmitting over the communication network, different, channel-specific entitlement control messages from which the control words are derivable such that each of the different channel-specific control words is derivable from any of the different channel-specific entitlement control messages by authorized receivers of the channels on the communication network. Related methods and apparatus are also included.

Abstract: In one embodiment, a method for securing data on a semi-trusted server is implemented on a computing device and includes: receiving at least a current session key from a user device for use during a current session, where the current session key is suitable for encrypting data and for decrypting data encrypted with the current session key, decrypting communications received from the user device during the session with said session key, encrypting with the session key at least one of communications to be sent to said user device and personal data generated during the session, storing the encrypted personal data, and discarding the current session key upon completion of the session, thereby limiting possible access to the stored encrypted personal data other than during the session. Related apparatus and methods are also described.

Abstract: A message signing system including a processor operative to receive a seed S0 and a number N from an authority providing permission to digitally sign up to N messages for a client device, successively apply a one-way function to the seed S0 yielding a chain having a plurality of values Si, i being greater than zero, create up to N digital signatures, creation of each digital signature including evaluating an encryption function with one of the values Si and a MAC of one of the messages as input to the encryption function, the MAC being a keyed hash function, each of the created digital signatures being based on a different one of the values Si and a different one of the messages, and send the created digital signatures and the messages signed by the created digital signatures to the client device. Related apparatus and methods are also included.

Abstract: A method for communication, including distributing over a communication network multiple channels of digital content, which are encrypted using different, channel- specific control words, and transmitting over the communication network, different, channel-specific entitlement control messages from which the control words are derivable such that each of the different channel-specific control words is derivable from any of the different channel-specific entitlement control messages by authorized receivers of the channels on the communication network. Related methods and apparatus are also included.