An end-user device comprising: a receiver to receive a media stream from a Headend system, the media stream including: media content for a plurality of services, the media content being packed into a plurality of packets, each one of the packets having a header and a payload, the payload of each one of the packets including a part of the media content of one of the services; a mapping table or at least two mapping tables, the mapping table directly mapping, or the at least two tables together indirectly mapping, the services to a plurality of packet-IDs such that each one of the services is mapped to one of the packet-IDs, thereby enabling the packets including the media content of the one service to be identified via the one packet-ID identifying the one service; a plurality of encrypted packet-IDs such that each one of the packets includes one of the encrypted packet-IDs in the header of the one packet so that the one encrypted packet ID included in the one packet is for the one service of the part of the media content included in the one packet; and a packet filter to: perform the following: derive the one packet-ID of the one service from the mapping table or the mapping tables; calculate the one encrypted packet-ID for the one service from the one packet-ID derived from the mapping table or mapping tables; and filter, from the media stream, the packets with the header including the one encrypted packet-ID yielding the packets including the part of the media content of the one service. a receiver to receive a media stream from a Headend system, the media stream including: media content for a plurality of services, the media content being packed into a plurality of packets, each one of the packets having a header and a payload, the payload of each one of the packets including a part of the media content of one of the services; a mapping table or at least two mapping tables, the mapping table directly mapping, or the at least two tables together indirectly mapping, the services to a plurality of packet-IDs such that each one of the services is mapped to one of the packet-IDs, thereby enabling the packets including the media content of the one service to be identified via the one packet-ID identifying the one service; a plurality of encrypted packet-IDs such that each one of the packets includes one of the encrypted packet-IDs in the header of the one packet so that the one encrypted packet ID included in the one packet is for the one service of the part of the media content included in the one packet; and media content for a plurality of services, the media content being packed into a plurality of packets, each one of the packets having a header and a payload, the payload of each one of the packets including a part of the media content of one of the services; a mapping table or at least two mapping tables, the mapping table directly mapping, or the at least two tables together indirectly mapping, the services to a plurality of packet-IDs such that each one of the services is mapped to one of the packet-IDs, thereby enabling the packets including the media content of the one service to be identified via the one packet-ID identifying the one service; a plurality of encrypted packet-IDs such that each one of the packets includes one of the encrypted packet-IDs in the header of the one packet so that the one encrypted packet ID included in the one packet is for the one service of the part of the media content included in the one packet; and a packet filter to: perform the following: derive the one packet-ID of the one service from the mapping table or the mapping tables; calculate the one encrypted packet-ID for the one service from the one packet-ID derived from the mapping table or mapping tables; and filter, from the media stream, the packets with the header including the one encrypted packet-ID yielding the packets including the part of the media content of the one service. perform the following: derive the one packet-ID of the one service from the mapping table or the mapping tables; calculate the one encrypted packet-ID for the one service from the one packet-ID derived from the mapping table or mapping tables; and filter, from the media stream, the packets with the header including the one encrypted packet-ID yielding the packets including the part of the media content of the one service.