Patent ID: 8873751

Claim:
Server apparatus, comprising: a processor; computer memory holding computer program instructions executed by the processor to perform content protection by: in response to a request for a segment of content, generating and associating with the segment an entitlement control message (ECM) that confers entitlement to a session-specific key from which one or more decryption keys are adapted to be derived, the decryption keys being associated with a cryptographic scheme and adapted for use to decrypt the segment by a client player, wherein the ECM includes, in a first public portion, a URL to the session-specific key, and, in a second private portion, at least one parameter associated with the cryptographic scheme, the at least one parameter being encrypted by an ephemeral key used to protect the ECM; encrypting the segment of content to create an encrypted fragment; serving the encrypted fragment and the ECM in response to the request; receiving a request for the session-specific key, the request for the session-specific key having been issued by the client player following parsing by the client player of the ECM for the segment; generating the session-specific key; and returning the session-specific key to the client player to enable decryption of the segment only as the segment is about to be rendered by the client player.