Pay-TV broadcasting system is an extensively deployed application that charges users based on their subscription. To ensure security for the Pay-TV broadcasting application, a conditional access system (CAS) is designed to control TV channel/program access to only the authorized subscribers. Several key management schemes with a four-level hierarchical key structure have been proposed. In this paper, we point out a severe security weakness of these schemes against collusion attacks. Then we propose a new CAS scheme with a three-level hierarchical key structure using ciphertext-policy attribute-set-based encryption (ASBE), an extension of ciphertext-policy attribute-based encryption (CP-ABE). Our scheme achieves scalable, flexible, fine-grained, and most importantly, collusion-resistant access control for Pay-TV broadcasting applications. The proposed scheme is designed to support all operations in Pay-TV applications. We then provide a detailed analysis on security and performance of our scheme. We also implement the scheme and it is showed to be both efficient and flexible for Pay-TV broadcasting applications.