Provided is a method for protecting an encrypted control word. The method includes: receiving a hardware security module entitlement management message and an encrypted control word transmitted from a main chip, where the hardware security module entitlement management message includes a key for decrypting the encrypted control word; decrypting, based on the hardware security module entitlement management message and a hardware security module root key stored in the hardware security module, the encrypted control word to obtain a control word; reencrypting the control word based on a re-encryption key stored in the hardware security module to obtain a reencrypted control word; and transmitting the reencrypted control word to the main chip, so that the main chip decrypts, based on a main chip entitlement management message transmitted from the front end, the reencrypted control word to obtain the control word.