A method of enabling selected access to control words distributed to each of a plurality of receivers or groups of receivers, comprising: establishing a plurality of sets of primary product keys, each set containing at least two different primary product keys, wherein the number of combinations of primary product keys that comprise one and only one primary product key from each of the plurality of sets is at least the number of receivers or groups of receivers; for each receiver or group of receivers, providing said receiver or group of receivers a respective different combination of primary product keys from said combinations of primary product keys; for each primary product key of each of the sets of primary product keys, providing to each of the plurality of receivers or groups of receivers a primary entitlement control message corresponding to said primary product key, each such primary entitlement control message comprising a reference to the corresponding primary product key, wherein each such primary entitlement control message distributes a primary control word which can be recovered through decryption using the corresponding primary product key, but not through decryption using any other primary product key of the set of primary product keys and, wherein the primary entitlement control messages corresponding to a particular set of primary product keys are provided to the plurality of receivers or groups of receivers such that all of the primary control words distributed using said primary entitlement control messages are active, in those receivers in which they are recovered through decryption, in the same crypto period; and for each primary product key of each of the sets of primary product keys, providing to each of the plurality of receivers or groups of receivers a copy of a portion of content corresponding to said primary product key, each copy of a portion of content being encrypted such that it can be obtained through decryption using the primary control word of the primary entitlement control message corresponding to said primary product key. establishing a plurality of sets of primary product keys, each set containing at least two different primary product keys, wherein the number of combinations of primary product keys that comprise one and only one primary product key from each of the plurality of sets is at least the number of receivers or groups of receivers; for each receiver or group of receivers, providing said receiver or group of receivers a respective different combination of primary product keys from said combinations of primary product keys; for each primary product key of each of the sets of primary product keys, providing to each of the plurality of receivers or groups of receivers a primary entitlement control message corresponding to said primary product key, each such primary entitlement control message comprising a reference to the corresponding primary product key, wherein each such primary entitlement control message distributes a primary control word which can be recovered through decryption using the corresponding primary product key, but not through decryption using any other primary product key of the set of primary product keys and, wherein the primary entitlement control messages corresponding to a particular set of primary product keys are provided to the plurality of receivers or groups of receivers such that all of the primary control words distributed using said primary entitlement control messages are active, in those receivers in which they are recovered through decryption, in the same crypto period; and for each primary product key of each of the sets of primary product keys, providing to each of the plurality of receivers or groups of receivers a copy of a portion of content corresponding to said primary product key, each copy of a portion of content being encrypted such that it can be obtained through decryption using the primary control word of the primary entitlement control message corresponding to said primary product key.