FORENSIC MEDIA KEY BLOCK FOR IDENTIFYING COMPROMISED KEYS

A forensic media key block (MKB) is provided to a clone device, either a software- or hardware-implemented clone, that has gained access to one or more compromised device keys of unknown identity from a set of the device keys in a digital content guard system. Media keys in the forensic MKB are selectively marked as “revoked” and then the ability of the clone to decrypt the MKB to successfully play content is observed. In this way the identity of the compromised key or keys is eventually learned, and the system can then revoke the compromised key or keys system-wide.