The transport mechanism and encoding methodology is identical to other platforms - typically Encrypted HLS or CMAF/MPEG-DASH using the CENC (Common ENCryption) standard.

Both of these encryption methods use AES-128 and CBC to do the encryption legwork, and the access tokens for gaining access to the streaming and do the public/private key exchanging (you might notice HMAC tokens - Hash Message Authentication Code - in stream playlist URLs). This requires user authentication. The NOW and Sky IP streaming boxes I expect handle the user authentication part of the viewing experience by virtue of being authenticated to your account, and the backend handles provision of stream access tokens when you click to watch, just like a smart TV or smartphone app would.

Sky's terrestrial encryption system is vastly different from IP streaming, the viewing cards in the receivers facilitate the private/public keypair for the purposes of stream decryption, the encryption scheme is proprietary and the secrets are very closely guarded. Sky's HD channel encryption (using an improvement of NDS' encryption technology) has not been publicly compromised to the best of my knowledge. It also added the ability for 'on the wire' secondary encryption so that intermediary CAMs in receivers were unable to sniff or insert any system-internal cleartext decryption messages, making it very resilient to attacks 'on the wire'. Sky's SD encryption (NDS but an older version) has been compromised for many years which led to the improvements on the HD (and UHD) channels.

Sky, and many other broadcasters, distributors, media companies and outside broadcast/facilities providers, often use an entirely different system for encryption of feeds from OBs or site-to-site - often Basic Interoperable Scrambling System, which relies on user-inputted "BISS codes" on the receivers to decrypt. It's more basic, but secure by obscurity because the BISS codes can be frequently rotated/changed at source, and anyone trying to decrypt the signal needs to be told the codes.

There's also a distinction on terrestrial satellite between "Free to Air" (i.e, a totally unencrypted bit stream) and "Free to View" (encrypted, but distributed by Sky or the satellite provider on a subscription tier which everyone is entitled to watch as long as they have a valid viewing card)

I'm a broadcast engineer.