Abstract: An apparatus comprising a processor, the processor configured to select a first cryptographic key, encrypt a message with the first cryptographic key to produce a first encrypted message, and further encrypt the first cryptographic key and an identifier of a second apparatus with a first encryption key to form a second encrypted message.

Abstract: A system and method for enforcing digital rights management (DRM) rules in a terminal, even when the requesting rendering application is already operating. Content, which may be encrypted, is received at the terminal and securely stored. On-demand authorization is effected for the rendering application that is requesting access to the content, using secure communications between a DRM engine within the terminal and an operating system within the terminal that is augmented with a security manager adapted to engage in such secure communications. If the rendering application is found to be authorized, the DRM rules are applied to determine whether the rendering application may access the content, and if so, the content is made available to the rendering application.