Key protecting device and key protecting method

1. A key protecting device, comprising:

a crypto engine;

a read-only memory (ROM), storing a chip unique key, exclusively accessible to the crypto engine; and

a processor configured to:

obtain an encrypted service content and an encrypted content encrypted key from a service provider;

store the encrypted service content and the encrypted content encrypted key in dynamic random access memory (DRAM); and

receive a first salt value and a first encrypted key from a non-volatile memory,

wherein the crypto engine receives the chip unique key from the ROM that is exclusively accessible to the crypto engine, receives the first salt value and the first encrypted key from the processor, uses the first salt value and the chip unique key to decrypt the first encrypted key to generate a first key and then uses the first key to decrypt the encrypted content encrypted key to generate a content encrypted key, and uses the content encrypted key to decrypt the encrypted service content to generate a service content for display.

2. The key protecting device according to claim 1 , wherein the crypto engine generates a first key encrypted key according to the first salt value and the chip unique key, and stores the first key encrypted key therein; the crypto engine generates the first key according to the first key encrypted key and the first encrypted key, and deletes the first key encrypted key from the crypto engine.

3. The key protecting device according to claim 2 , wherein:

the processor receives a second salt value and a second encrypted key from the non-volatile memory; the second salt value is different from the first salt value;

the crypto engine receives the chip unique key from the ROM that is exclusively accessible to the crypto engine, receives the second salt value from the processor, and generates a second key encrypted key according to the second salt value and the chip unique key; the second key encrypted key is different from the first key encrypted key; and

the crypto engine receives the second encrypted key from the processor, and stores the second key encrypted key therein; the crypto engine generates a second key according to the second key encrypted key and the second encrypted key, and deletes the second key encrypted key from the crypto engine.

4. The key protecting device according to claim 3 , wherein the ROM is a one-time programmable (OTP) memory or an e-fuse.

5. The key protecting device according to claim 3 , wherein:

the processor receives the first salt value from the non-volatile memory; the crypto engine receives the first salt value from the processor, receives the chip unique key from the ROM that is exclusively accessible to the crypto engine, generates the first key encrypted key according to the first salt value and the chip unique key, and stores the first key encrypted key therein;

the processor obtains the first key; the crypto engine receives the first key from the processor, generates the first encrypted key according to the first key encrypted key and the first key, and deletes the first key encrypted key from the crypto engine; and

the processor receives the first encrypted key from the crypto engine, and stores the first encrypted key to the non-volatile memory.

6. The key protecting device according to claim 5 , wherein:

the processor obtains the second key, and receives the second salt value from the non-volatile memory; the second salt value is different from the first salt value;

the crypto engine receives the chip unique key from the ROM that is exclusively accessible to the crypto engine, receives the second salt value from the processor, generates the second key encrypted key according to the second salt value and the chip unique key, and stores the second key encrypted key therein; the second key encrypted key is different from the first key encrypted key;

the crypto engine receives the second key from the processor, generates the second encrypted key according to the second key encrypted key and the second key, and deletes the first key encrypted key from the crypto engine; and

the processor receives the second encrypted key from the crypto engine, and stores the second encrypted key to the non-volatile memory.

7. The key protecting device according to claim 3 , further comprising:

a memory, exclusively accessible to the crypto engine;

wherein, the crypto engine receives a first encrypted content encrypted key, generates a first content encrypted key according to the first key and the first encrypted content encrypted key, and stores the first content encrypted key into the memory.

8. The key protecting device according to claim 7 , wherein the memory is a static random access memory (SRAM).

9. A key protecting method, comprising:

obtaining an encrypted service content and an encrypted content encrypted key from a service provider;

storing the encrypted service content and the encrypted content encrypted key in dynamic random access memory (DRAM);

receiving a first salt value from a non-volatile memory;

receiving a chip unique key from a ROM that is exclusively accessible to a crypto engine;

generating a first key according to the first salt value, the chip unique key and a first encrypted key

employing the first salt value and the chip unique key to decrypt the first encrypted key to generate a first key;

employing the first key to decrypt the encrypted content encrypted key to generate a content encrypted key; and

employing the content encrypted key to decrypt the encrypted service content to generate a service content for display.

10. The key protecting method according to claim 9 , wherein the step of generating the first key according to the first salt value, the chip unique key and the first encrypted key comprises:

generating a first key encrypted key according to the first salt value and the chip unique key, and storing the first key encrypted key in the crypto engine;

generating the first key according to the first key encrypted key and the first encrypted key; and

deleting the first key encrypted key from the crypto engine.

11. The key protecting method according to claim 10 , further comprising:

receiving a second salt value from the non-volatile memory, the second salt value being different from the first salt value;

receiving the chip unique key from the ROM that is exclusively accessible to the crypto engine;

generating a second key encrypted key according to the second salt value and the chip unique key, and storing the second key encrypted key in the crypto engine, the second key encrypted key being different from the first key encrypted key;

generating a second key according to the second key encrypted key and a second encrypted key; and

deleting the second key encrypted key from the crypto engine.

12. The key protecting method according to claim 11 , further comprising:

receiving the first salt value from the non-volatile memory;

receiving the chip unique key from the ROM that is exclusively accessible to the crypto engine;

generating the first key encrypted key according to the first salt value and the chip unique key, and storing the first key encrypted key in the crypto engine;

receiving the first key;

generating the first encrypted key according to the first key encrypted key and the first key;

storing the first encrypted key to the non-volatile memory; and

deleting the first key encrypted key from the crypto engine.

13. The key protecting method according to claim 12 , further comprising:

receiving the second salt value from the non-volatile memory;

receiving the chip unique key from the ROM that is exclusively accessible to the crypto engine;

generating the second key encrypted key according to the second salt value and the chip unique key and storing the second key encrypted key in the crypto engine;

receiving the second key;

generating the second encrypted key according to the second key encrypted key and the second key;

storing the second encrypted key to the non-volatile memory; and

deleting the second key encrypted key from the crypto engine.

14. The key protecting method according to claim 13 , further comprising:

receiving a first encrypted content encrypted key;

generating a first content encrypted key according to the first key and the first encrypted content encrypted key; and

storing the first content encrypted key to a memory that is exclusively accessible to the crypto engine.