Device for decrypting protected content and for providing the decrypted content for playback, the device comprising a secure module for carrying out cryptographic operations including the decryption of the protected content using decryption information (CW), and the device being configured to install therein at least one client software module assigned to a provider of protected content, the client software module being adapted to forward decryption information (CW) for decrypting the protected content of the provider to the secure module in an encrypted form; wherein the secure module is adapted to store therein a public key (P_PK) assigned to the provider and to authenticate at least one link key (LK) provided by the content provider using the stored public key (P_PK), wherein the secure module comprises a plurality of slots for storing one or more cryptographic keys, each slot including resources of the secure module , which are reserved for this slot and cannot be used by other slots, wherein the secure module is configured to store the public key (P_PK) in one of the plurality of slots, wherein the secure module is configured to reserve the respective slot for the content provider to which the public key (P_PK) is assigned in response to storing of the public key (P_PK) in the respective slot, wherein the secure module is adapted to receive a protected software image of the client software module and to initiate the installation of the client software module in the device upon having decrypted and/or validated the software image by means of a first link key authenticated using the stored public key (P_PK) or by means of a key (DLK) of a key ladder (LK, DLK) derived from the authenticated first link key (LK), wherein, during execution of the installed client software module , the secure module being adapted to decrypt the decryption information (CW) by means of a second link key (LK) authenticated using the stored public key (P_PK) or by means of key of a key ladder derived from the authenticated second link key (LK), wherein the first and second link keys are different or are the same. wherein the secure module is adapted to store therein a public key (P_PK) assigned to the provider and to authenticate at least one link key (LK) provided by the content provider using the stored public key (P_PK), wherein the secure module comprises a plurality of slots for storing one or more cryptographic keys, each slot including resources of the secure module , which are reserved for this slot and cannot be used by other slots, wherein the secure module is configured to store the public key (P_PK) in one of the plurality of slots, wherein the secure module is configured to reserve the respective slot for the content provider to which the public key (P_PK) is assigned in response to storing of the public key (P_PK) in the respective slot, wherein the secure module is adapted to receive a protected software image of the client software module and to initiate the installation of the client software module in the device upon having decrypted and/or validated the software image by means of a first link key authenticated using the stored public key (P_PK) or by means of a key (DLK) of a key ladder (LK, DLK) derived from the authenticated first link key (LK), wherein, during execution of the installed client software module , the secure module being adapted to decrypt the decryption information (CW) by means of a second link key (LK) authenticated using the stored public key (P_PK) or by means of key of a key ladder derived from the authenticated second link key (LK), wherein the first and second link keys are different or are the same. <EOS>