Patent ID: 8762718

Claim:
A computer-implemented method, comprising: receiving, by a headend gateway, a first data stream to forward to a first client device of a plurality of client devices; determining that a data block in the first data stream is not known to be stored by the first client device; generating a block-encryption key for the data block based on a base key for the first client device; generating an encrypted data block by encrypting the data block using the block-encryption key; generating a second data stream for the first client device, wherein the second data stream includes the encrypted data block; sending the second data stream to at least the first client device; generating a block-decryption key for the encrypted data block, which involves deriving the block-decryption key from the base key for the first client device; storing the encrypted data block along with the block-decryption key; and responsive to determining that a second computing device needs to decrypt the encrypted data block, sending the block-decryption key to the second client device so that the block-decryption key is encrypted using a base key assigned to the second client device.