Abstract: A device including a receiver to receive a media stream including media content for a plurality of services, the content packed into packets each having a header and payload including a part of the content of one of the services, a mapping table(s) directly or indirectly mapping, the services to packet-IDs such that each service is mapped to one packet-ID, thereby enabling the packets including the content of a service to be identified via the packet-ID identifying that service, encrypted packet-IDs such that each packet includes its encrypted packet-ID in its header, and a packet filter to derive the packet-ID of that service from the mapping table(s), calculate the encrypted packet-ID from the derived packet-ID, and filter, from the media stream, the packets with the header including the calculated encrypted packet-ID yielding the packets including the part of the content of that service. Related apparatus and methods are also described.

Abstract: A method and system of preventing control word sharing, the method and system including receiving a temporal key, denoted TKi, at a removable security element, receiving an entitlement control message (ECM), the ECM including a control word derivable by the removable security element, deriving the control word from the ECM at the removable security element, combining at least the control word and a value associated with an ID of the removable security element, thereby producing combined control word and removable security element ID data, encrypting the combined control word and removable security element ID data according to an encryption function, wherein the encrypting includes using TKi as an encryption key, and at a time after a removable security element interface has received TKi, but prior to a start of a crypto period with which the control word is associated, sending the encrypted combined control word and removable security element ID data to the removable security element interface.

Abstract: An end-user device, including a processor to prepare barcode-input data including (a) at least one of an identification of a user of the end-user device, and an identification of the end-user device, and (b) data based on activity of at least one of the end-user device, the user of the end-user device, and a security element removably inserted into the end-user device, and prepare a two-dimensional barcode including the barcode input data, the two-dimension barcode being prepared for displaying on a display in a manner suitable for scanning by a communication device. Related apparatus and methods are also included.

Abstract: A method and system for media consumption are described.

Abstract: A method for providing safety for downloadable applications on an onboard computer in a safety critical environment includes installing an application on the onboard computer, where the application is signed by a trusted signing entity, associating a usage policy with the signed application in a safety permissions manifest, where the usage policy at least includes rules for actions allowed for the signed application under certain environmental conditions in the safety critical environment, monitoring the environmental conditions, receiving a request to perform an action from the signed application, determining whether performance of the action is permissible, where the determining is based on least on the associated usage policy and the monitored environmental conditions, and permitting/preventing the performance based on the determining. Related apparatus and methods are also described.

Abstract: A system and method is described for providing the status of safety critical systems to untrusted devices.

Abstract: A method and system for fingerprinting a content item is described, the content item including a set of content item elements E, providing information uniquely associated with a single user including a string of bits S0, parsing S0 into a plurality of substrings which are functions of S0, providing a matrix of content item replacement elements, each row of which includes, for each member of E, an array of content item replacement elements for Ei, uniquely associating each substring of S0 so that for every substring there exists a corresponding element of E, for every substring, replacing at least one instance of the corresponding element E in the content item with one substitute matrix element for the corresponding substring, and outputting a replacement content item including the result of the replacing, the substitute matrix elements being chosen according to at least one similarity criterion.

Abstract: A multimedia content distribution method including a) storing an item of a multimedia content, b) firstly transcoding the content for playback on a first multimedia device, c) generating a content ID of the firstly transcoded content, d) storing the content ID of the firstly transcoded content in association with the stored content, e) accessing the stored content using the content ID of the firstly transcoded content, and f) secondly transcoding the stored content for playback on a second multimedia device.

Abstract: A method for distributing information includes distributing an item of encrypted information to a plurality of clients and distributing respective key-shares to the clients, such that each client will require a key-share that has been distributed to at least one other client in order to reconstruct a key for decrypting the encrypted information. Upon receiving from a first client a report that a second client requested and received a respective one of the key-shares from the first client, a record of a delivery of the item to the second client is made responsively to the report.

Abstract: A method of distributing audio video content is described. The method includes: receiving configuration data for a plurality of devices; for each device in the plurality of devices, computing a set of bit rates based, at least in part, on the configuration data; encoding audio video content at each bit rate in each set of bit rates to produce a plurality of encoded audio video content streams; splitting each encoded audio video content stream in the plurality of encoded audio video content streams into chunks to produce a plurality of chunked encoded audio video content streams; for each device in the plurality of devices, creating a separate index file, each separate index file including references to at least one of the plurality of chunked encoded audio video content streams; publishing a locator for each separate index file in a catalogue; and transmitting the plurality of chunked encoded audio video content streams and each separate index file to a network.

Abstract: A system and method for protecting content is described, the system and method comprising a content item which has been segmented into at least two portions, each portion being encrypted according to a different encryption key, a single content rights license associated with the content item, the license including at least two encrypted decryption keys operative to decrypt at least one of the at least two portions, such that any two encrypted decryption keys of the at least two encrypted decryption keys includes a first key which is less securely encrypted than the second key, a plurality of decryption keys, each one of the decryption keys being able to decrypt at least one of the at least two encrypted decryption keys, a decryptor for decrypting the at least one of the at least two encrypted decryption keys, and a second decryptor for decrypting, with the at least one of the at least two encrypted decryption keys, at least one portion of the at least two portions of the content item.

Abstract: A secondary content distribution system and method is described, the system and method including a receiver for receiving a plurality of differing versions of secondary content from an provider, each one of the differing versions of the secondary content being associated with at least one of a reading mode, and a connection mode, a processor operative to determine a reading mode of a user of a client device, a selector for selecting one of the differing versions of the secondary content for display on the client device display, the selection being a function, at least in part, of matching the determined reading mode with the reading mode associated with the one of the differing versions of the secondary content and the connection mode of the client device, and a display for displaying the selected one of the differing versions of the secondary content on the client device display. Related methods, systems, and apparatus are also described.

Abstract: A method and system of preventing control word sharing, the method and system including receiving a temporal key, denoted TKi, at a removable security element, receiving an entitlement control message (ECM), the ECM including a control word derivable by the removable security element, deriving the control word from the ECM at the removable security element, combining at least the control word and a value associated with an ID of the removable security element, thereby producing combined control word and removable security element ID data, encrypting the combined control word and removable security element ID data according to an encryption function, wherein the encrypting includes using TKi as an encryption key, and at a time after a removable security element interface has received TKi, but prior to a start of a crypto period with which the control word is associated, sending the encrypted combined control word and removable security element ID data to the removable security element interface.

Abstract: An end-user device, including a processor to prepare barcode-input data including (a) at least one of an identification of a user of the end-user device, and an identification of the end-user device, and (b) data based on activity of at least one of the end-user device, the user of the end-user device, and a security element removably inserted into the end-user device, and prepare a two-dimensional barcode including the barcode input data, the two-dimension barcode being prepared for displaying on a display in a manner suitable for scanning by a communication device. Related apparatus and methods are also included.

Abstract: A device including a receiver to receive a media stream including media content for a plurality of services, the content packed into packets each having a header and payload including a part of the content of one of the services, a mapping table(s) directly or indirectly mapping, the services to packet-IDs such that each service is mapped to one packet-ID, thereby enabling the packets including the content of a service to be identified via the packet-ID identifying that service, encrypted packet-IDs such that each packet includes its encrypted packet-ID in its header, and a packet filter to derive the packet-ID of that service from the mapping table(s), calculate the encrypted packet-ID from the derived packet-ID, and filter, from the media stream, the packets with the header including the calculated encrypted packet-ID yielding the packets including the part of the content of that service. Related apparatus and methods are also described.

Abstract: A key distribution system for controlling access to content by rendering devices, comprising an epoch module to provide epochs, each epoch including service key periods, a service key module to provide a batch of service keys, a group module to provide group keys for each epoch such that each rendering device is assigned a group key grouping together the devices having the same group key, thereby defining groups, in different epochs the devices are grouped differently, an encryption module to encrypt, for each epoch, each service key in the batch of service keys, individually with each group key yielding a plurality of group-key-encrypted service keys from each service key, and a delivery module to distribute to the devices, for each one of the epochs, the group-key-encrypted service keys for the batch of service keys and the group keys of the one epoch. Related apparatus and methods are also described.

Abstract: A method and system for fingerprinting a content item is described, the and system method include providing the content item, the content item including a set of content item elements, the set of content item elements denoted E, such that E={E1, E2, Ei, Em}, providing information uniquely associated with a single user, the information including a string of bits, hereinafter denoted S0, parsing S0 into a plurality of subsequences of strings of bits, hereinafter denoted S1,, Sn, the parsing being performed such that S0 equals a function of S1,, Sn, providing a matrix of content item replacement elements, the matrix denoted R, each row of matrix R including, for at least each one of n members of set E, an array of content item replacement elements for Ei denoted Ri, such that Ri={Ri1, Rij}, uniquely associating each one of S1, Sn with one matrix element of matrix R, so that for every one of S1,, Sn there exists a corresponding element of E, for every one of S1,, Sn replacing at least one instance of the correspo

Abstract: A digital rights management system including a controlled content disk to store content in an encrypted format, and a processor to run a plurality of applications and a secure device driver thereon, the processor being operationally associated with the controlled content disk, the applications being unable to decrypt content from the encrypted format, the secure device driver having a receiving module to receive a request from one of the applications to access the content, a validation module to validate the request based upon a recognized access pattern to the content by the one application, and a transport module to transfer the content from the controlled content disk to the one application, contingent upon a positive result of the validating of the validation module. Related apparatus and methods are also described.

Abstract: A rights validator system for controlling access to content, the system including a query processor to receive a rights query and to provide a result to the rights query based on an estimated time, and a time-based query response module operationally connected to the query processor, the time-based query response module being operative to determine the estimated time as a function of a most recently updated time, and a plurality of indications of elapsed time since the most recently updated time, the indications of elapsed time being from a plurality of different sources of time indication. Related apparatus and methods are also included.

Abstract: A system and a method for providing variable security mechanisms for securing digital content, in which a single security mechanism is not used for all content. Instead, at least one characteristic or feature of the security mechanism is varied between units, instances or categories of content. Therefore, even if unauthorized access is gained to a single unit of content, the overall integrity and security of the system for content distribution is not compromised. Preferably, security is provided though a general mechanism, which is then varied in order to provide variable, dissimilar security schemes for different types of content. By “type of content”, it is meant any of a single unit of content, a single instance of content or a single category of content. For example, for a category of content, the content may be characterized according to the identity of the content itself, such as the title of a movie for example, and/or according to the owner of a particular copy of the content.