Patent ID: 7949135

Claim:
A method for improved key distribution in a broadcast data communication system for selective access to services, wherein a group key management message, including a service access key, is transferred to a group of users for access to a selected service, said method comprising: creating a set of encryption keys based on a stateless subset cover scheme, each user being associated with a leaf in said stateless subset cover scheme; establishing a state key and a corresponding state representing a subset of users that have the state key and a subset of users that do not have the state key; determining a subset cover based on information representative of the established state; and determining said group key management message at least partly based on the determined subset cover, wherein said group key management message M is determined according to: M={T,S rs ,E ( H Srs ,K P ) . . . S tu ,E ( H Stu ,K P ), E ( K E ,K M )}, K E =F ( K P ,K State ) where T is a state identifier, K state is the current state key, S rs , . . . , S tu are user sets covering users that shall remain active among those users which have the state key, E is an encryption function, H Srs , . . . H stu , are encryption keys of the stateless subset cover scheme corresponding to said user sets, K P is said additional key, K E is an envelope key calculated as a function F of Said additional key and the state key, and K M is the information protection key; and the broadcast data communication system transferring said group key management message to the group of users for access to the selected service.