KR20050056112A - Method for requesting, generating and distributing traffic encryption key according to services in wireless portable internet system and apparatus thereof, and protocol configuration method in the same - Google Patents

Abstract

The present invention relates to a service-specific traffic encryption key request, generation and distribution method and apparatus therefor, and a protocol configuration method in a wireless portable Internet system. The subscriber station transmits a key request message requesting a traffic encryption key for each service to the base station using a MAC message. The base station analyzes the key request message transmitted from the subscriber station to generate the requested traffic encryption key for each service. Thereafter, the base station transmits a key response message including the generated service-specific traffic encryption key to the subscriber station using the MAC message. At this time, if the key generation fails in the base station, the base station generates a key rejection message including the reason for the key generation failure and transmits it to the subscriber station. According to the present invention, the ability to assign traffic encryption keys for various services provided by the system can be supported, and as a result, many subscribers can be stably provided such as a multicast service or a broadcast service. Can be activated to promote the service.

Description

METHODO FOR REQUESTING, GENERATING AND DISTRIBUTING TRAFFIC ENCRYPTION KEY ACCORDING TO SERVICES IN WIRELESS PORTABLE INTERNET SYSTEM AND APPARATUS THEREOF, AND PROTOCOL CONFIGURATION METHOD IN THE SAME}

The present invention relates to security in a wireless portable internet system, and more particularly, to an apparatus and method for generating and distributing a traffic encryption key for each service in a wireless portable internet system, and a protocol configuration method.

The wireless portable Internet is a next-generation communication method that further supports mobility to a short-range data communication method using a fixed access point (AP) like a conventional wireless LAN.

Various standards have been proposed for such a wireless portable Internet, and international standardization of the portable internet is currently underway based on IEEE 802.16.

1 is a schematic diagram showing an outline of a wireless portable Internet.

As shown in FIG. 1, a wireless portable Internet system is basically connected to a subscriber station 10, a base station 20 and 21 performing wireless communication with the subscriber station 10, and a base station 20 and 21 through a gateway. Routers 30 and 31.

Conventional wireless LAN methods such as IEEE 802.11 provide a data communication method capable of wireless communication within a short distance around a fixed access point, but this provides mobility of a subscriber station (hereinafter referred to as SS). Rather than supporting wired data, it was limited to supporting short-range data communications.

Meanwhile, the wireless portable Internet system promoted by the IEEE 802.16 group or the like ensures mobility even when the subscriber station 10 shown in FIG. 1 moves from a cell managed by the base station 20 to a cell managed by the base station 21. It will provide an uninterrupted data communication service.

The IEEE 802.16 is basically a standard that supports Metropolitan Area Network (MAN), and refers to an information communication network covering an intermediate area between a local area network (LAN) and a wide area network (WAN).

Accordingly, the wireless portable Internet system supports handover of the subscriber station 10 like the mobile communication service, and performs dynamic IP address allocation according to the movement of the subscriber station.

In this case, the wireless portable Internet subscriber station 10 and the base stations 20 and 21 communicate with each other by orthogonal frequency division multiple access (hereinafter, referred to as OFDMA). The OFDMA scheme is a multiplexing scheme combining a frequency division scheme using a plurality of orthogonal subcarriers as a plurality of subchannels and a time division scheme (TDM) scheme. This OFDMA scheme is inherently resistant to fading occurring in multipath, and has a high data rate.

2 is a hierarchical diagram showing the hierarchical structure of the wireless portable Internet system.

As shown in FIG. 2, the hierarchical structure of the IEEE 802.16 wireless portable Internet system is largely classified into a physical layer (L10) and a media access control (hereinafter referred to as "MAC") layer (L21, L22, L23).

The physical layer L10 is responsible for a wireless communication function performed in a normal physical layer such as modulation and demodulation and coding.

On the other hand, the wireless portable Internet system does not have a hierarchical layer for each function like a wired Internet system, and takes charge of various functions in one MAC layer.

Looking at the sublayers by their function, the MAC layer includes a privacy sublayer (L21), a MAC common part sublayer (L22), and a service specific convergence sublayer (L23). do.

The privacy sublayer L21 performs device authentication, security key exchange, and encryption functions. Only authentication for the device is performed in the privacy sublayer L21, and user authentication is performed in an upper layer (not shown) of the MAC.

The MAC common sublayer L22 is an essential part of the MAC layer, and is responsible for system access, bandwidth allocation, traffic connection establishment and maintenance, and QoS management.

The service specific aggregation sublayer L23 is responsible for payload header suppression and QoS mapping functions in continuous data communication.

3 is a schematic diagram showing a connection structure between a base station (hereinafter referred to as "BS") and a subscriber station in a wireless portable Internet system.

As shown in FIG. 3, the MAC layer of the subscriber station SS and the MAC layer of the base station BS have a concept of a traffic connection (C1).

Here, the term "traffic connection (C1)" means a logical connection rather than a physical connection, and the MAC sibling layer of the SS and the BS to transmit traffic for one service flow. It is defined as a mapping relationship between peers.

Accordingly, a parameter or message defined on the traffic connection C1 defines a function between MAC sibling layers, and in reality, the parameter or message is processed and framed and transmitted through a physical layer, and the frame is analyzed to analyze the MAC layer. Will perform the function corresponding to that parameter or message.

In addition, the MAC message includes various messages for performing a request (REQ), response (RSP), and acknowledgment (ACK) for various operations.

Meanwhile, in the IEEE 802.16 wireless portable Internet system, an encryption function for traffic data is defined to provide a reliable service. The encryption function for traffic data is emerging as a requirement for service stability and network stability, and is a basic condition for providing legitimate service.

Conventional IEEE 802.16 wireless portable Internet system defines a method for generating and distributing a traffic encryption key to be used for the traffic connection prior to the traffic connection establishment procedure to encrypt the traffic data. Specifically, the subscriber station and the base station use a PKM-REQ (Privacy Key Managment-Request) message and a PKM-RSP (Privacy Key Managment-Response) message for generating and distributing a traffic encryption key. That is, the terminal requests a traffic encryption key assignment by transmitting a key request message, which is one of PKM-REQ messages, to the base station, and the base station sends a response to the terminal. Specifically, the base station sends a key reply message to the terminal when the traffic encryption key assignment is successful, and transmits a key reject message to the terminal when the traffic encryption key assignment is successful. By using the traffic encryption key assigned through the traffic encryption key assignment procedure, the terminal and the base station encrypts and transmits all traffic data.

The traffic encryption key generation and distribution scheme defined in the existing IEEE 802.16 wireless portable Internet system is limited to a unicast service between the terminal and the base station.

In order for IEEE 802.16 wireless mobile Internet system to provide scalable services to more and more subscribers and to provide various services stably, it is necessary to consider not only unicast service but also multicast service and broadcast service. have.

However, when providing a multicast service or a broadcast service in the IEEE 802.16 wireless portable Internet system, there are considerations for service encryption. That is, a method of restricting the service to users of the same system that does not subscribe to the multicast service or providing a broadcast service should be considered to limit the service to subscribers of other operators. The limitation is that the current specification does not have a specific definition.

Accordingly, an aspect of the present invention is to solve the above problems, and provides an apparatus and method for generating and distributing a key for encrypting traffic for various services in a wireless portable Internet system, and a method for configuring the protocol. It is.

The present invention also provides an apparatus and method for generating and distributing a traffic encryption key for each service in a wireless portable Internet system that can be accommodated when a failure occurs in a service encryption key generation procedure for each service, and a method for configuring the protocol. To provide.

In accordance with one aspect of the present invention for achieving the above object, a method for requesting a traffic encryption key for each service in a wireless portable Internet system is provided.

A method for requesting a traffic encryption key for each service from a subscriber station wirelessly connected to a base station in a wireless portable Internet system,

a) determining a service type to be distributed with a traffic encryption key to be used for the traffic connection before establishing a traffic connection with the base station; b) generating a key request message requesting a traffic encryption key according to the determined service type; And c) transmitting the generated key request message to the base station using a Media Access Control (MAC) message.

According to another aspect of the present invention, there is provided a method for generating and distributing a traffic encryption key for each service in a wireless portable Internet system.

In a wireless portable Internet system, a base station generates and distributes a traffic encryption key for each service to a wirelessly connected subscriber station.

a) receiving a key request message requesting a traffic encryption key for each service from the subscriber station; b) analyzing the key request message to determine a service type; c) generating a traffic encryption key according to the determined service type; And d) generating a key response message including the generated traffic encryption key and transmitting it to the subscriber station using a MAC message.

According to another aspect of the present invention, there is provided a method for generating a traffic encryption key for each service and configuring a distribution protocol in a wireless portable Internet system.

A method of constructing a protocol for generating and distributing a traffic encryption key for each service in a wireless portable Internet system to be used for a traffic connection between a base station and a subscriber station.

a) the subscriber station transmitting a key request message requesting a traffic encryption key for each service to the base station using a MAC message; And b) the base station analyzes the key request message transmitted from the subscriber station to generate the requested traffic encryption key for each service, and then uses the MAC message as a key response message including the generated traffic encryption key for each service. And transmitting to the subscriber station.

An apparatus for requesting a traffic encryption key for each service in a wireless portable Internet system according to another aspect of the present invention,

An apparatus for wirelessly connecting to a base station in a wireless portable Internet system and requesting a traffic encryption key for each service from the base station,

A key request message generator for generating a key request message for requesting the base station to assign a traffic encryption key for each service; A key request message transmitter for transmitting a key request message generated by the key request message generator to the base station using a MAC message; A key response / rejection message receiver configured to receive a key response message or a key rejection message transmitted from the base station using a MAC message; A message analyzer for analyzing a key response message or a key rejection message received by the key response / rejection message receiving unit, extracting a traffic encryption key for a key response message, and analyzing an error type for a key rejection message; And controlling the operations of the key request message generator, the key request message transmitter, the key response / rejection message receiver, and the message analyzer to request the base station to assign a traffic encryption key for each service, and to request the key assignment from the base station. And a key request controller for receiving and processing a traffic encryption key or an error code when an error occurs.

An apparatus for generating and distributing a traffic encryption key for each service in a wireless portable Internet system according to another aspect of the present invention,

An apparatus for generating and distributing a traffic encryption key for each service to a subscriber station in a wireless portable Internet system,

A key request message receiving unit which receives a key request message transmitted from the subscriber station using a MAC message; A message analyzing unit analyzing the key request message received by the key request message receiving unit and analyzing information including the type of service included in the key request message; A subscriber identifier that determines whether a traffic encryption key can be assigned to a service requested by the key request message; A traffic encryption key generation unit generating a traffic encryption key for each service analyzed by the message analyzer; A key response message transmitter configured to generate a key response message including a traffic encryption key generated according to the service type requested by the subscriber station by the traffic encryption key generator, and transmit the key response message to the subscriber station using a MAC message; And controlling the operations of the key request message receiving unit, the message analyzing unit, the subscriber identification unit, the traffic encryption key generation unit, and the key response message transmitting unit to correspond to the service-specific traffic encryption key allocation request from the subscriber station. And a key generation and distribution control unit for generating and distributing an encryption key.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

Hereinafter, a traffic encryption key generation and distribution device for each service in a wireless portable Internet system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

4 is a flowchart for establishing a connection in a wireless portable Internet system according to an embodiment of the present invention.

4, when the subscriber station enters the base station (S10), first, the base station establishes downlink synchronization with the subscriber station (S20).

As such, when downlink synchronization is configured in the base station, the subscriber station acquires an uplink parameter (S30). For example, the parameter may include a channel descriptor message according to the characteristics of the physical layer (eg, signal to noise ratio).

Thereafter, the subscriber station and the base station perform a ranging procedure (S40). In this case, ranging is performed by correcting and matching timing, power, and frequency information between a subscriber station and a base station. Initial ranging is performed first, and then periodic ranging is periodically performed.

When the ranging procedure S40 is completed, a negotiation about a terminal basic function for establishing a connection between the subscriber station and the base station is performed (S50). When the negotiation for the basic function is completed, the subscriber station authentication is performed using the certificate of the subscriber station of the base station (S60).

When the authentication of the subscriber station is completed and the authority to use the wireless portable Internet is confirmed, the base station registers the device address of the subscriber station (S70). Thereafter, the base station provides an IP address to the subscriber station through a DHCP server or a MIP server to perform IP connection establishment (S80).

In order to provide a full-fledged traffic service to a subscriber station assigned an IP address, the base station performs a procedure for generating and distributing a traffic encryption key for each service (S90), and performs traffic connection establishment for each (S100).

FIG. 5 is a detailed flowchart of a traffic encryption key generation and distribution process for each service illustrated in FIG. 4.

Referring to FIG. 5, when the IP connection establishment procedure S10 to S80 between the subscriber station SS and the base station BS is completed, the subscriber station SS may be provided with a traffic service in earnest. In order to encrypt the traffic data provided together, a traffic encryption key generation and distribution procedure for each service (S90) is performed.

First, the subscriber station (SS) transmits a key request (Key Request) message, which is a PKM-REQ message to the base station (BS) in order to receive a traffic encryption key for the type of service desired by the subscriber station (S91). At this time, the key request message is delivered with a parameter for distributing the traffic encryption key for each service, which will be described later.

Upon receiving the key request message transmitted from the SS, the BS generates an encryption key to be allocated to the SS by using a traffic encryption key generation mechanism based on all field values of the received message. After that, the result is transmitted to the subscriber station (SS) (S93).

In detail, when the BS generates a traffic encryption key to be allocated to the SS, the BS transmits a key reply message, which is a PKM-RSP message, to the SS. However, if generation of the traffic encryption key to be assigned to the subscriber station (SS) in the base station (BS), the key reject message (Key Reject) message is transmitted to the subscriber station (SS). At this time, the key rejection message includes an error code related to a key assignment failure, which will be described later.

As such, the base station BS transmits a key response or key rejection message to the subscriber station SS, thereby ending the traffic encryption key generation and distribution procedure S90 for the subscriber station SS.

In this case, the key response message transmitted by the base station BS to the subscriber station SS includes a traffic encryption key according to the type of service requested by the subscriber station SS, and the subscriber station SS receives the corresponding service. Encrypts or decrypts the traffic data using the traffic encryption key received from the base station (BS) when received.

FIG. 6 is a table illustrating parameters included in a key request message to be newly added for generating and distributing a traffic encryption key for each service shown in FIG. 5.

Referring to FIG. 6, the SS included in the key request message for requesting the BS to allocate the traffic encryption key for each service to the BS is a service type and a multicast service group ID. ID).

The service type indicates what type of service the subscriber station (SS) wants to receive. Accordingly, the base station (BS) looks at the value of this service type and generates and assigns a traffic encryption key according to the service type.

The multicast service group ID exists only when the type of service for which the SS wants to receive a traffic encryption key is a multicast service and serves as an identifier of the multicast service group. This multicast service group ID is also used for the purpose of placing a restriction on the services of other multicast service groups that the subscriber station (SS) does not subscribe to even if it receives the multicast service.

FIG. 7 is a diagram illustrating an attribute of a service type parameter illustrated in FIG. 6.

Referring to FIG. 7, a service type parameter indicates a corresponding service type of a traffic encryption key to be assigned to this parameter. For example, the type of the service type parameter is '28', the length is 1 byte, and the value indicates the service type according to the set value. For example, if the value of the service type parameter is "0", it requires the traffic encryption key assignment corresponding to the unicast service, and "1" means the traffic encryption key assignment corresponding to the multicast service. Is requesting traffic encryption key assignment corresponding to broadcast service. Accordingly, the base station BS generates a traffic encryption key for each service by referring to the value of the service type parameter included in the key request message transmitted from the subscriber station SS and distributes the traffic encryption key to the subscriber station SS.

FIG. 8 is a diagram illustrating attributes of a multicast service group ID field shown in FIG. 6.

Referring to FIG. 8, the multicast service group ID is an identifier of a multicast service group provided by the IEEE 802.16 wireless portable Internet system. For example, the type of the multicast service group ID parameter is '29', the length is 1 byte, and the value is an identifier of the multicast service group.

Accordingly, the base station (BS) refers to the value of the multicast service group ID parameter included in the key request message transmitted from the subscriber station (SS) whether to generate a traffic encryption key for each multicast service for the subscriber station (SS) Decide

FIG. 9 is a table illustrating an error code included in a key rejection message to be newly added for generating and distributing a traffic encryption key for each service shown in FIG. 5.

9, the base station (BS) is included in the key rejection message transmitted to the subscriber station (SS) by failing to generate a corresponding key to allocate a traffic encryption key for each service to the subscriber station (SS), Includes "Unsupported Service Type" and "Unauthorized Multicast Service Group ID."

"Unsupported service type" is a service type indicated in the service type included in the key request message transmitted from the subscriber station (SS) to be assigned a service-specific traffic encryption key has a value that cannot be supported by the base station (BS). In this case, an error code parameter included in the key rejection message is used to indicate the failure. For example, if the error code field value of the key rejection message received at the subscriber station (SS) is '7', it indicates a failure due to "unsupported service type".

On the other hand, "unauthorized multicast service group ID" indicates that the subscriber station (SS) indicates the multicast service type in the service type parameter included in the key request message, and wherein the identifier recorded in the multicast service group ID parameter is the base station. This is an error code generated when the identifier cannot be assigned a traffic encryption key in (BS). For example, if the error code field value of the key rejection message received at the subscriber station SS is '8', it indicates a failure due to "unauthorized multicast service group ID".

Hereinafter, an example of an apparatus for generating and distributing a traffic encryption key for each service in a wireless portable Internet system according to an embodiment of the present invention will be described.

10 is a block diagram of a traffic encryption key generation and distribution device for each service according to an embodiment of the present invention.

As shown in FIG. 10, the apparatus for generating and distributing a traffic encryption key for each service according to an exemplary embodiment of the present invention includes a base station 100 and a subscriber station 200.

The subscriber station 100 includes a key request message generator 110, a key request message transmitter 120, a key response / rejection message receiver 130, a message analyzer 140, a memory 150, and a key request controller 160. ).

The key request message generating unit 110 generates a key request message requesting the base station 200 to allocate a traffic encryption key for each service. The key request message generated at this time is generated as a PKM-REQ message which is one of MAC messages in IEEE 802.16, and includes a service type and a multicast service group ID parameter as shown in FIG.

The key request message transmitter 120 transmits the key request message generated by the key request message generator 110 to the base station 200 through the antenna 170 using the PKM-REQ message which is one of the MAC messages.

The key response / rejection message receiving unit 130 receives a key response message or a key rejection message transmitted from the base station 200 using the PKM-RSP message, which is one of the MAC messages, through the antenna 170.

The message analyzer 140 analyzes the key response message or the key rejection message received by the key response / rejection message receiver 130, extracts the traffic encryption key in the case of the key response message, and, in the case of the key rejection message, Analyze the type of error.

The memory 150 stores the results analyzed by the message analyzer 140. For example, it stores a traffic encryption key that is extracted and used for encryption in future traffic transmission, or stores an error code generated when the key assignment fails.

The key request control unit 160 requests the base station 200 to allocate a traffic encryption key for each service, and receives a traffic encryption key assigned for each service from the base station 200 or receives and processes the error code when an error occurs. The operation of the message generator 110, the key request message transmitter 120, the key response / rejection message receiver 130, the message analyzer 140, and the memory 150 is controlled.

Meanwhile, the base station 200 may include a key request message receiver 210, a message analyzer 220, a subscriber identifier 230, a memory 240, a traffic encryption key generator 250, and a key response / rejection message transmitter ( 260 and a key generation and distribution control unit 270.

The key request message receiving unit 210 receives a key request message using a PKM-REQ message, which is one of MAC messages transmitted from the subscriber station 100, through the antenna 280.

The message analyzer 220 analyzes the key request message received by the key request message receiver 210 and analyzes parameters such as a service type and a multicast service group ID included in the key request message.

If the service requested by the key request message is a multicast service, the subscriber identification unit 230 determines whether the traffic encryption key is assigned to the identifier recorded in the multicast service group ID included in the key request message. Determine whether or not. If the identifier recorded in the multicast service group ID is an identifier for which a traffic encryption key cannot be assigned, it is indicated as "unauthorized multicast service group ID".

The memory 240 stores the result analyzed by the message analyzer 220, the result identified by the subscriber identifier 230, and the like.

The traffic encryption key generation unit 250 generates a traffic encryption key for each service only when the traffic encryption key request from the subscriber station is accepted.

The key response / rejection message transmitter 260 generates a key response message including the traffic encryption key generated when the traffic encryption key generation is successfully completed by the traffic encryption key generator 250 to generate one of the MAC messages, PKM-. The RSP message is transmitted to the subscriber station 100 through the antenna 280. However, if the traffic encryption key generation unit 250 fails to generate the traffic encryption key, a key rejection message including an error code indicating the failure reason is generated and transmitted to the subscriber station 100 using the PKM-RSP message. do.

The key generation and distribution control unit 270 generates and distributes a corresponding traffic encryption key for each service according to the traffic encryption key assignment request for each service from the subscriber station 100, and if an error occurs in generating the traffic encryption key, In order to transmit the error code to the subscriber station 100, the key request message receiving unit 210, the message analyzing unit 220, subscriber identification unit 230, memory 240, traffic encryption key generation unit 250 and the key Controls the operation of the response / rejection message transmitter 260.

Although the preferred embodiment of the present invention has been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

According to the present invention, the following effects are obtained.

First, it is possible to support the ability to assign traffic encryption keys for various services provided by the system, and as a result, it is possible to stably provide various services such as multicast service or broadcast service. The service can be activated.

Second, by creating and managing traffic encryption keys for each service, stronger security of the service can be maintained.

Third, in the case of the multicast service, the group traffic encryption key assigned to each multicast service group is different so that security can be maintained for each group.

1 is a schematic diagram showing an outline of a wireless portable Internet.

2 is a hierarchical diagram showing the hierarchical structure of the wireless portable Internet system.

3 is a schematic diagram illustrating a connection structure between a base station and a subscriber station in a wireless portable Internet system.

4 is a flowchart illustrating an initial access of a subscriber station in a wireless portable Internet system according to an embodiment of the present invention.

FIG. 5 is a detailed flowchart of a traffic encryption key generation and distribution process for each service illustrated in FIG. 4.

FIG. 6 is a diagram illustrating a parameter table included in a key request message in the process of generating and distributing a traffic encryption key for each service shown in FIG. 5.

FIG. 7 is a diagram illustrating an attribute of a service type parameter illustrated in FIG. 6.

FIG. 8 is a diagram illustrating attributes of a multicast service group ID field shown in FIG. 6.

FIG. 9 is a table illustrating an error code included in a key rejection message in the process of generating and distributing a traffic encryption key for each service shown in FIG. 5.

10 is a block diagram of a traffic encryption key generation and distribution device for each service according to an embodiment of the present invention.

Claims (22)

A method for requesting a traffic encryption key for each service from a subscriber station wirelessly connected to a base station in a wireless portable Internet system, the method comprising: a) determining a service type to be distributed with a traffic encryption key to be used for the traffic connection before establishing a traffic connection with the base station; b) generating a key request message requesting a traffic encryption key according to the determined service type; And c) transmitting the generated key request message to the base station using a media access control (MAC) message; Method for requesting a traffic encryption key for each service in a wireless portable Internet system comprising a. The method of claim 1, In step b), the service type is a traffic encryption key request method for each service in a wireless portable Internet system, characterized in that recorded in the parameters included in the key request message. The method according to claim 1 or 2, The service type includes a unicast service, a multicast service, and a broadcast service. The method for requesting a traffic encryption key for each service in a wireless portable Internet system, characterized in that the service. The method of claim 3, When the service type is a multicast service, an ID (ID) in which an identifier of a multicast service group for a subscriber is recorded is included in a parameter of the key request message. How to request a key. The method of claim 3, In step c), the key request message is encrypted using a traffic key service (PKM-REQ) message, which is one of MAC messages of the IEEE 802.16 standard protocol. How to request a key. A method for distributing and generating a traffic encryption key for each service to a wirelessly connected subscriber station in a wireless portable Internet system, the method comprising: a) receiving a key request message requesting a traffic encryption key for each service from the subscriber station; b) analyzing the key request message to determine a service type; c) generating a traffic encryption key according to the determined service type; And d) generating a key response message including the generated traffic encryption key and transmitting it to the subscriber station using a MAC message; Method for generating and distributing traffic encryption keys for each service in a wireless portable Internet system comprising a. The method of claim 6, In step b), the key request message includes the service type related parameter, and the base station analyzes the parameter to determine the service type. Creation and distribution method. The method according to claim 6 or 7, In step c), if the traffic encryption key generation for the subscriber station according to the determined service type fails, a key rejection message including an error code indicating the failure reason is generated and the subscriber station is used by using the MAC message. And a method for generating and distributing traffic encryption keys for each service in a wireless portable Internet system. The method of claim 8, When generating and distributing a traffic encryption key for a service type for which the subscriber station has requested a traffic encryption key is impossible, the base station writes an "unsupported service type" to the error code and transmits it to the subscriber station. A method for generating and distributing traffic encryption keys for each service in a wireless portable Internet system. The method of claim 8, The service type includes a unicast service, a multicast service, and a broadcast service. The method for generating and distributing traffic encryption keys for each service in a wireless portable Internet system. The method of claim 10, If the type of service for which the subscriber station requested the traffic encryption key is a multicast service, and the base station cannot provide the corresponding multicast service defined by the multicast service group ID for the subscriber station, the error code is set to "unauthorized." A method for generating and distributing a traffic encryption key for each service in a wireless portable Internet system, comprising transmitting an unauthorized multicast service group ID to the subscriber station. The method of claim 8, The key response message and the key rejection message are traffic encryption keys for each service in a wireless portable Internet system, which are transmitted using a PKM-RSP (Privacy Key Managment-Response) message, which is one of MAC messages of the IEEE 802.16 standard protocol. Creation and distribution method. A method of configuring a protocol for generating and distributing a traffic encryption key for each service in a wireless portable Internet system to be used for a traffic connection between a base station and a subscriber station, the method comprising: a) the subscriber station transmitting a key request message requesting a traffic encryption key for each service to the base station using a MAC message; And b) the base station analyzes the key request message transmitted from the subscriber station to generate the requested traffic encryption key for each service, and then uses a MAC message to generate a key response message including the generated traffic encryption key for each service. Transmitting to the subscriber station Method for generating and distributing traffic encryption key for each service in a wireless portable Internet system comprising a. The method of claim 13, In the step a), the key request message is generated using a PKM-REQ message which is one of the MAC messages of the IEEE 802.16 standard protocol. Way. The method of claim 13, In the step b), when the generation of the traffic encryption key for each service fails, a key rejection message including an error code recording the failure reason is transmitted to the subscriber station using a MAC message. How to Configure Traffic Encryption Key Generation and Distribution Protocol for Each Service. The method of claim 15, In step b), the key response message and the key rejection message are generated using a traffic encryption key for each service in the wireless portable Internet system, characterized in that the PKM-RSP message is transmitted using one of the MAC messages of the IEEE 802.16 standard protocol. And how to configure a distribution protocol. An apparatus for wirelessly connecting to a base station in a wireless portable Internet system and requesting a traffic encryption key for each service from the base station, A key request message generator for generating a key request message for requesting the base station to assign a traffic encryption key for each service; A key request message transmitter for transmitting a key request message generated by the key request message generator to the base station using a MAC message; A key response / rejection message receiver configured to receive a key response message or a key rejection message transmitted from the base station using a MAC message; A message analyzer for analyzing a key response message or a key rejection message received by the key response / rejection message receiving unit, extracting a traffic encryption key for a key response message, and analyzing an error type for a key rejection message; And Controls operations of the key request message generator, the key request message transmitter, the key response / rejection message receiver, and the message analyzer to request the base station to assign a traffic encryption key for each service, and according to the requested key assignment from the base station. Key request control unit that receives and processes the transmitted traffic encryption key or error code when an error occurs Apparatus for requesting a traffic encryption key for each service in a wireless portable Internet system comprising a. The method of claim 17, The key request message includes a service type and a multicast service group ID of the subscriber station when the service type is a multicast service. The method of claim 17, According to the control of the key request control unit, traffic encryption key request apparatus for each service in a wireless portable Internet system further comprises a memory for storing information including a traffic encryption key or an error code that is a result analyzed by the message analysis unit . A base station apparatus for generating and distributing a traffic encryption key for each service to a subscriber station in a wireless portable internet system, A key request message receiving unit which receives a key request message transmitted from the subscriber station using a MAC message; A message analyzing unit analyzing the key request message received by the key request message receiving unit and analyzing information including the type of service included in the key request message; A subscriber identifier that determines whether a traffic encryption key can be assigned to a service requested by the key request message; A traffic encryption key generation unit generating a traffic encryption key for each service analyzed by the message analyzer; A key response message transmitter configured to generate a key response message including a traffic encryption key generated according to the service type requested by the subscriber station by the traffic encryption key generator, and transmit the key response message to the subscriber station using a MAC message; And By controlling the operations of the key request message receiving unit, message analyzing unit, subscriber identification unit, traffic encryption key generation unit, and key response message transmitting unit, traffic encryption for each service corresponding to the service encryption key allocation request for each service from the subscriber station is performed. Key generation and distribution control to generate and distribute keys Apparatus for generating and distributing traffic encryption keys for each service in a wireless portable Internet system. The method of claim 20, Under the control of the key generation and distribution control unit, if an error occurs in the traffic encryption key generation unit for a request by the subscriber station, the subscriber terminal uses a MAC message to reject a key rejection message including the error code. Key rejection message sender Apparatus for generating and distributing traffic encryption keys for each service in a wireless portable Internet system. The method of claim 20, And a memory for storing information including a result analyzed by the message analyzing unit and a result identified by the subscriber identification unit under the control of the key generation and distribution control unit. Device for generating and distributing traffic encryption keys.