Method and apparatus for security in a data processing system

• US 7,185,362 B2
• Filed: 08/28/2002
• Issued: 02/27/2007
• Est. Priority Date: 08/20/2001
• Status: Expired due to Term

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Rezaiifar, Ramin, Agashe, Parag A., Wang, Jun, Bender, Paul E., Quick, Roy Franklin Jr., Mahendran, Arungundram C., Rose, Gregory G., Hawkes, Philip Michael, Hsu, Raymond T.
• Primary Examiner(s): Wright; Norman M.
• Application Number:
  US10/233,188
• Publication Number:
  US 20030039361A1
• Time in Patent Office: 1,644 Days
• Field of Search: 726 3- 7, 726 17- 19, 726/27, 726/29, 726/30, 380/201, 380/223, 380/226, 380/44
• US Class Current: 726/4
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04N 21/2347 involving video stream encryption
• CPC Class Codes: H04N 21/26606 for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 7/1675 : Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 4/06 : Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services

Abstract

Method and apparatus for secure transmissions. Each user is provided a registration key. A long-time updated broadcast key is encrypted using the registration key and provided periodically to a user. A short-time updated key is encrypted using the broadcast key and provided periodically to a user. Broadcasts are then encrypted using the short-time key, wherein the user decrypts the broadcast message using the short-time key. One embodiment provides link layer content encryption. Another embodiment provides end-to-end encryption.

Claims

1. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number,

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key;

encrypting the broadcast access key to form an encrypted broadcast access key comprising;

storing a root key in the secure memory storage unit, wherein the root key is associated with the secure memory storage unit, wherein the root key is also stored in a fifth server,

wherein the fifth server is part of a first server, and

wherein extracting the encrypted broadcast access key further comprises;

decrypting the EBAK based on the root key stored in the secure memory storage unit;

storing the encrypted broadcast access key in a secure memory storage unit; and

extracting the encrypted broadcast access key (EBAK) from the secure memory storage unit.

2. The method as in claim 1, wherein the fifth server also performs the functions of authorization, authentication and accounting for broadcast service.

3. The method as in claim 2, wherein the fifth server is a home content server.

4. The method as in claim 2, wherein the fifth server is part of a mobile network.

5. The method as in claim 2, wherein the root key is used for authentication in mobile networks and is known only to the fifth server and the secure memory storage unit.

6. The method as in claim 4, wherein the mobile network is a Code Division-Multiple Access network.

7. The method as in claim 4, wherein the mobile network is a Global System Mobile network.

8. The method as in claim 4, wherein the mobile network is a Wideband Code Division-Multiple Access network.

9. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key;

encrypting the broadcast access key to form an encrypted broadcast access key comprising;

storing a root key in the secure memory storage unit, wherein the root key is associated with the secure memory storage unit; and

wherein extracting the encrypted broadcast access key further comprises;

decrypting the EBAK based on the root key stored in the secure memory storage unit;

storing the encrypted broadcast access key in a secure memory storage unit; and

extracting the encrypted broadcast access key (EBAK) from the secure memory storage unit wherein the mobile network is a Global System for mobile (GSM) network.

10. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key;

encrypting the broadcast access key to form an encrypted broadcast access key;

storing the encrypted broadcast access key in a secure memory storage unit; and

extracting the encrypted broadcast access key (EBAK) from the secure memory storage unit comprising;

receiving the encrypted broadcast access key and a second number and storing the encrypted broadcast access key and the second number in the secure memory storage unit.

11. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key;

encrypting the broadcast access key to form an encrypted broadcast access key;

storing the encrypted broadcast access key in a secure memory storage unit; and

extracting the encrypted broadcast access key (EBAK) from the secure memory storage unit comprising;

determining a Temporary Key (TK);

storing the TK in the secure memory storage unit; and

decrypting the EBAK using the TK to form the Broadcast Access Key (BAK).

12. The method as in claim 11, wherein determining the TK comprises:

determining the TK associated with a second number stored in the secure memory storage unit.

13. The method as in claim 12, wherein determining the TK associated with the second number comprises:

forming the TK from the second number and a second root key stored in the secure memory storage unit, wherein the second root key is uniquely associated with the secure memory storage unit.

14. The method as in claim 13, wherein forming the TK from the second number and the second root key comprises:

storing the second root key in the secure memory storage unit.

15. The method as in claim 13, wherein forming the TK from the second number and the second root key comprises:

encrypting the second root key to form an encrypted second root key;

storing the encrypted second root key at the remote station.

16. The method as in claim 13, wherein the value of the second root key is known only to the fifth server and the secure memory storage unit.

17. The method as in claim 13, wherein the second root key is used for authentication in mobile networks.

18. The method as in claim 17, wherein the mobile network is a CDMA network.

19. The method as in claim 17, wherein the mobile network is a GSM network.

20. The method as in claim 17, wherein the mobile network is a WCDMA network.

21. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service wherein receiving the broadcast access key comprises requesting the broadcast access key from a first server;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number; and

extracting a packet of data from the encrypted packet of data using the short-term key.

22. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data, wherein receiving the encrypted packet of data and the associated first number comprises receiving the associated first number with each encrypted packet of data;

generating the short-term key using the broadcast access key and the first number; and

extracting packet of data from the encrypted packet of data using the short-term key.

23. The method of claim 22, wherein requesting the broadcast access key from a first server is prior to an expiration time of a current broadcast access key.

24. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data, wherein the first number is received with at least one encrypted packet of data;

generating the short-term key using the broadcast access key and the first number; and

extracting a packet of data from the encrypted packet of data using the short-term key.

25. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service at the remote station comprising;

receiving a broadcast access key expiration indicator wherein the broadcast access key expiration indicator identifies an expiration time of the broadcast access key;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number, and

extracting a packet of data from the encrypted packet of data using the short-term key.

26. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service at the remote station comprising;

authorizing the remote station to provide the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number; and

extracting a packet of data from the encrypted packet of data using the short-term key.

27. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key; and

storing the broadcast access key in a secure memory storage unit,

wherein receiving the broadcast access key comprises authorizing the secure memory storage unit to provide the short-term keys to the remote station, wherein the first server authorizes the secure memory storage unit.

28. A method for a remote station to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generating the short-term key using the broadcast access key and the first number;

extracting a packet of data from the encrypted packet of data using the short-term key; and

storing the broadcast access key in a secure memory storage unit,

wherein the secure memory storage unit is a User Identity Module (UIM) adapted for use in a wireless device supporting spread spectrum protocols.

29. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data; and

sending the broadcast access key from a first server to a remote station comprising;

generating the broadcast access key in a fourth server.

30. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data;

sending the broadcast access key from a first server to a remote station;

generating a first random value in the fourth server; and

assigning the first random value to the broadcast access key in a fourth server.

31. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key BAK;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data; and

sending the broadcast access key from a first server to a remote station,

wherein the first server stores details of BAK values provided to the secure memory storage unit, wherein the details are used for accounting.

32. The method as in claim 31, wherein transmitting the encrypted broadcast access key comprises:

sending a broadcast access key expiration indicator, wherein the broadcast access key expiration indicator identifies an expiration time of the broadcast access key.

33. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data;

forming an Encrypted Broadcast Access Key (EBAK) from the broadcast access key at a first server; and

transmitting the encrypted broadcast access key.

34. The method as in claim 33, wherein forming the Encrypted Broadcast Access Key (EBAK) comprises:

encrypting the broadcast access key using a Temporary Key (TK) at the first server.

35. The method as in claim 34, further comprising:

receiving the TK from a fifth server at the first server.

36. The method as in claim 35, further comprising:

receiving a second value and the TK from the fifth server at the first server.

37. The method as in claim 36, wherein the second value is generated at the fifth server.

38. The method as in claim 37, wherein the second value is a random value.

39. The method as in claim 35, wherein sending the TK comprises:

authorizing the first server to provide the broadcast service to the secure memory storage unit.

40. The method as in claim 35, wherein sending the broadcast access key from the first server to the remote station comprises:

sending a second number from the first server o the remote station.

41. The method as in claim 40, wherein the TK is generated from the second number and a second root key, wherein the second root key is uniquely associated with the secure memory storage unit.

42. The method as in claim 41, wherein forming the TK from the second number and the second root key in the fifth server comprises:

storing the second root key in the fifth server.

43. The method as in claim 42, wherein the TK is formed from the second number and the second root key using a pseudo-random number generator.

44. The method as in claim 42, wherein the TK is formed from the second number and the second root key using a cryptographic hash function.

45. The method as in claim 42, wherein the TK is formed from the second number and the second root key using an encryption function.

46. The method as in claim 42, wherein the second root key is a key used for authentication in mobile networks.

47. The method as in claim 42, wherein the mobile network is a CDMA network.

48. The method as in claim 42, wherein the second root key is used for authentication and key generation.

49. The method as in claim 42, wherein the second root key is the key used for AKA authentication and key generation.

50. The method as in claim 49, wherein the communication system is a Wideband CDMA (WCDMA) system.

51. The method as in claim 35, wherein the fifth server also performs the functions of authorization, authentication and accounting for broadcast service.

52. The method as in claim 51, wherein the fifth server is the home content server.

53. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key; and

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data,

wherein generating the short-term key comprises;

generating the short-term key using the broadcast access key and a first number at a second server; and

determining a value of the first number at the second server, comprising determining at least part of the first number from a value not controlled by the second server.

54. The method of claim 53, wherein the value is generated by incrementing a counter.

55. The method of claim 53, wherein the value is generated as a function of time.

56. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data and an associated first number, the broadcasting comprising;

sending the first number with each encrypted packet of data.

57. A method for encryption key management in a communication system supporting broadcast services, comprising:

generating a short-term key using a broadcast access key;

encrypting a packet of data using the short-term key;

broadcasting the encrypted packet of data and an associated first number, the broadcasting comprising;

sending the first number with at least one encrypted packet of data; and

sending at least one encrypted packet of data without the first number.

58. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast server, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generator adapted for generating the short-term key using the broadcast access key and the first number;

means for extracting a packet of data from the encrypted packet of data using the short-term key;

means for encrypting the broadcast access key to form an encrypted broadcast access key, wherein the secure memory storage unit is further adapted to store the encrypted broadcast access key; and

means for extracting the encrypted broadcast access key (EBAK) from the secure memory storage unit, comprising;

means for determining a Temporary Key (TK) comprising means for determining the TK associated with a second number stored in the secure memory storage unit;

means for storing the TK in the secure memory storage unit; and

means for decrypting the EBAK using the TK to form a Broadcast Access Key (BAK),

wherein the means for determining the TK associated with the second number comprises;

means for forming the TK from the second number and a second root key stored in the secure memory storage unit, wherein the second root key is uniquely associated with the secure memory storage unit.

59. The remote station as in claim 58, wherein the means for forming the TK from the second number and the second root key comprises:

means for storing the second root key in the secure memory storage unit.

60. The remote station as in claim 58, wherein the means for forming the TK from the second number and the second root key comprises:

means for encrypting the second root key to form an encrypted second root key;

means for storing the encrypted second root key at the remote station.

61. The remote station as in claim 58, wherein the value of the second root key is known only to a fifth server and the secure memory storage unit.

62. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

wherein the receiver comprises a transmitter for requesting the broadcast access key from a first server;

generator adapted for generating the short-term key using the broadcast access key and the first number; and

means for extracting a packet of data from the encrypted packet of data using the short-term key.

63. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

wherein the receiver comprises means for receiving the first number with each encrypted packet of data;

generator adapted for generating the short-term key using the broadcast access key and the first number; and

means for extracting a packet of data from the encrypted packet of data using the short-term key.

64. The remote station of claim 63, wherein the transmitter requests the broadcast access key prior to an expiration time of a current broadcast access key.

65. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data wherein the first number is received with at least one encrypted packet of data;

generator adapted for generating the short-term key using the broadcast access key and the first number; and

means for extracting a packet of data from the encrypted packet of data using the short-term key.

66. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

receiving a broadcast access key expiration indicator, wherein the broadcast access key expiration indicator identifies an expiration time of the broadcast access key;

generator adapted for generating the short-term key using the broadcast access key and the first number; and

means for extracting a packet of data from the encrypted packet of data using the short-term key.

67. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

authorizing the remote station to provide the broadcast service;

generator adapted for generating the short-term key using the broadcast access key and the first number; and

means for extracting a packet of data from the encrypted packet of data using the short-term key.

68. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generator adapted for generating the short-term key using the broadcast access key and the first number;

means for extracting a packet of data from the encrypted packet of data using the short-term key; and

secure memory storage unit for storing the broadcast access key,

wherein the receiver for receiving the broadcast access key is further adapted for;

authorizing the secure memory storage unit to provide the short-term keys to the remote station, wherein the first server authorizes the secure memory storage unit.

69. A remote station adapted to extract data from at least one encrypted packet of data provided by a broadcast service, comprising:

receiver adapted for;

receiving a broadcast access key for the broadcast service;

receiving an encrypted packet of data from a plurality of encrypted packets of data, wherein the each encrypted packet of data is associated with one short-term key from a plurality of short-term keys, wherein each short-term key is associated with a first number;

receiving the first number corresponding to the short-term key associated with the encrypted packet of data;

generator adapted for generating the short-term key using the broadcast access key and the first number;

means for extracting a packet of data from the encrypted packet of data using the short-term key; and

secure memory storage unit for storing the broadcast access key, wherein the secure memory storage unit is a User Identity Module (UIM) adapted for use in a wireless device supporting spread spectrum protocols.