Key delivery method and apparatus in a communications system

A user terminal comprising:

• at least one microprocessor;
• a non-transitory computer-readable storage medium including computer-readable instructions, when executed by the at least one microprocessor, are configured to:
• implement a secure processing module having access to a decryption key, the decryption key being inaccessible to other functions of the user terminal;
• receive an encrypted service key from an access server of a communication network, and pass the encrypted service key to the secure processing module;
• generate an acknowledgement of receipt of the encrypted service key;
• send the acknowledgement of receipt of the encrypted service key from the user terminal to the access server, wherein decrypted service key is made available to the user terminal immediately following receipt and authentication of a return acknowledgement, or at a later time;
• receive the return acknowledgement from the access server, and pass the return acknowledgement to the secure processing module;
• and
• authenticate the return acknowledgement, and make the decrypted service key available to the user terminal.

A Universal IC Card for use with a user terminal, the Universal IC card comprising:

• at least one microprocessor;
• a non-transitory computer-readable storage medium including computer-readable instructions, when executed by the at least one processor, are configured to
• store a decryption key, the decryption key being inaccessible to other functions of the user terminal;
• receive an encrypted service key from an access server of a communication network;
• generate an acknowledgement of receipt of the encrypted service key;
• pass the acknowledgement of receipt of the encrypted service key to the user terminal for sending to the access server, wherein decrypted service key is made available to the user terminal immediately following receipt and authentication of a return acknowledgement, or at a later time;
• receive the return acknowledgement from the access server;
• and
• authenticate the return acknowledgement, and make the decrypted service key available to the user terminal.

An access server, comprising:

• at least one microprocessor;
• a non-transitory computer-readable storage medium including computer-readable instructions, when executed by at least one microprocessor, are configured to
• facilitate access by a user terminal to broadcast and/or multicast data which is encrypted and sent to the user terminal from a communication network, wherein the computer-readable instructions configured to facilitate access further include instructions configured to
• send an encrypted service key to the user terminal, the user terminal further comprising a secure processing module, wherein
• the secure processing module having access to a decryption key for decrypting the encrypted service key but the decryption key being inaccessible to other functions of the user terminal;
• receive an acknowledgement of receipt of the service key, from the user terminal;
• and
• authenticate the acknowledgement of receipt of the encrypted service key and for sending a return acknowledgement to the user terminal, wherein decrypted service key is made available to the user terminal immediately following receipt and authentication of the return acknowledgement, or at a later time.

A method, comprising:

• facilitating access by a user terminal to broadcast and/or multicast data which is encrypted and sent to the user terminal from a communication network, the facilitating including
• sending, by a broadcast/multicast service center (BM-SC), a multimedia internet keying (MIKEY) message to the user terminal, wherein
• the user terminal includes a universal IC card (UICC),
• the MIKEY message is protected by a multimedia broadcast multicast service (MEMS) user key (MUK),
• the MIKEY message includes a MBMS service key (MSK), and
• the MUK is a shared secret between the BM-SC and the UICC;
• authenticating, with the UICC, the MIKEY message using the MUK;
• in response to successfully authenticating of the MIKEY message, decrypting, with the UICC, the MIKEY message and storing the MSK in the UICC;
• preparing, using the UICC, a MSK verification message and encrypting the MSK verification message with the MUK;
• authenticating, by the BM-SC, the MSK verification message using the MUK;
• preparing, by the BM-SC, an acknowledgement response message, encrypting the acknowledgement response message with the MUK, and sending the acknowledgement response message to the UICC;
• authenticating, by the UICC, the acknowledgement response message with the MUK and, in response to successfully authenticating the acknowledgement response message, setting the MSK to an active state;
• in response to receiving a traffic key encrypted with the MSK from a multicast transmission, requesting, by the user terminal, the UICC to decrypt the traffic key with the MSK;
• and
• in response to determining that the MSK is in an active state, releasing, by the UICC, the traffic key to the user terminal.