Description
The MBMS key Generation and Validation Function (MGV-F) is a critical security entity defined within the 3GPP Multimedia Broadcast Multicast Service (MBMS) framework, starting from Release 8. It resides within the MBMS Service Center (BM-SC), which is the core network element that authorizes and initiates MBMS sessions. The primary role of the MGV-F is to manage the lifecycle of cryptographic keys used to secure MBMS content delivered over the cellular network to potentially massive audiences. This involves the generation, storage, distribution, and renewal of keys that encrypt the broadcast/multicast traffic (MTK - MBMS Traffic Key) and keys that protect the key distribution messages themselves (MSK - MBMS Service Key, and MUK - MBMS User Key).
Architecturally, the MGV-F operates in conjunction with the MBMS key Generation and Validation Storage (MGV-S) and the User Services Identity Module (USIM) in the user equipment (UE). The process begins when a subscriber subscribes to an MBMS service. The MGV-F generates a unique MBMS User Key (MUK) for that user-service pair. For an active MBMS session, the MGV-F generates a session-specific MBMS Traffic Key (MTK) used to encrypt the actual media content. To securely deliver this MTK to authorized users, it is encrypted with an MBMS Service Key (MSK). The MSK and MUK are securely provisioned to the user's USIM, typically via the existing UMTS or EPS authentication and key agreement framework. The encrypted MTK (wrapped by the MSK) is then broadcast to all users in the service area. Only users with a valid USIM containing the corresponding MSK can decrypt the MTK and subsequently decrypt the broadcast content.
How it works involves a hierarchical key structure and secure protocols. The MGV-F leverages the MBMS key Distribution Architecture (MKD) protocols. It receives service authorization requests, triggers key generation, and uses the MGV-S as a secure storage for long-term keys like MUKs and MSKs. For key distribution, the MGV-F instructs the BM-SC to broadcast keying material within the MBMS control channel. A key renewal procedure is also managed by the MGV-F to periodically change the MTK, limiting the impact of any potential key compromise. The entire system is designed for scalability, as the point-to-multipoint nature of key distribution means that a single encrypted key message from the MGV-F can be used by millions of devices simultaneously, unlike point-to-point key delivery which would not be feasible for broadcast services.
Purpose & Motivation
The MGV-F was created to address the fundamental security challenge inherent in broadcast and multicast services: how to efficiently provide content confidentiality and access control to a large, dynamic group of users over a public network. Traditional unicast security models, like those used for voice calls or web browsing, rely on point-to-point secure tunnels (e.g., IPsec or TLS) established individually with each user. This model does not scale for broadcasting live TV or software updates to millions of devices, as it would overwhelm the network with individual key negotiations and encryption streams.
The motivation for the MGV-F stemmed from the commercial need for secure premium broadcast services, such as mobile TV. Operators needed a way to monetize MBMS by ensuring that only paying subscribers could decrypt the content, preventing service theft. The MGV-F, as part of the standardized MBMS security framework, provided this capability. It solved the problem of scalable key management by introducing a hierarchical, group-oriented key distribution system. This allowed a single encrypted traffic stream to be broadcast, with efficient point-to-multipoint distribution of the necessary decryption keys to authorized group members. It addressed the limitations of previous non-standard or absent broadcast security mechanisms, enabling new business models for network operators and content providers within the 3GPP ecosystem.
Classification
Detected Changes Across Releases
from 3GPP Change RequestsSpecific changes extracted from the „Change history“ tables of 3GPP specifications (27 CRs across 5 releases). Complements the general historical overview above with the evidence-based evolution of this function.
Studied in Rel-8, normative work from Rel-15.
In Release 15, updates to the USIM management procedures for 5GS were introduced, alongside an enhancement to the USIM OPL configuration to support a 3-byte TAC when connected to NG-RAN. Furthermore, the release included clarifications regarding the presence of the EFIMSConfigData file within both the ISIM and USIM applications.
- USIM Service Table update for PDU session call control support TS 31.102CR0786
- Allow configuration of MCS (Access Identity 2) via USIM. TS 31.102CR0794
- Mission Critical Services configuration data update to USIM TS 31.102CR0808
- Enhance USIM OPL configuration to support 3 bytes TAC when in NG-RAN. TS 31.102CR0818
- Updates to USIM management procedures for 5GS TS 31.102CR0806
- Clarification about presence of EFIMSConfigData in ISIM and USIM TS 31.102CR0833
In Release 16, the MGV-F function was not directly modified; instead, the release introduced several new USIM configuration capabilities. These included the USIM-based configuration of the RLOS PLMN list and allowed MCC list, the storage of URSP rules, and the support for a list of Trusted non-3GPP access networks. Additionally, Release 16 specified storage for a potentially separate KSEAF for non-3GPP access and introduced a dedicated AID for USIM applications with non-IMSI based SUPI types.
- Support for USIM configuration of RLOS PLMN list TS 31.102CR0847
- URSP storage in USIM TS 31.102CR0861
- Specify storage for a potentially separate KSEAF for non-3gpp access on the USIM TS 31.102CR0864
- USIM configuration of RLOS allowed MCC list TS 31.102CR0881
- Support for Trusted non-3GPP access networks list by USIM TS 31.102CR0891
- Dedicated AID for USIM Applications with non-IMSI based SUPI Types TS 31.102CR0897
+ 3 more changes
In Release 17, the MGV-F (MBMS key Generation and Validation Function) was enhanced by introducing a dedicated USIM service indicator for it. Specifically, Service n°133 in the EF UST (USIM Service Table) was declared as "available" to support the function. This ensures that the necessary security parameters, including the K~AUSF~ key, are stored and managed on the USIM for MBMS key generation and validation.
- Introduce a USIM file to store pre-configured CAG information list TS 31.102CR0904
- SOR-CMCI storage in USIM TS 31.102CR0917
- Addition of USIM files for the indication of whether disaster roaming is enabled in the UE, disaster roaming wait range, disaster return wait range and applicability indicator for disaster roaming PLMNs list provided by VPLMN. TS 31.102CR0938
- Adding eDRX parameters in the USIM for NG-RAN TS 31.102CR0943
- 5G NSWO (Non-Seamless WLAN Offload) configuration support in the USIM compromised proposal. TS 31.102CR0946
- Support of 'No E-UTRA Disabling In 5GS' in USIM TS 31.102CR0947
+ 2 more changes
In Release 18, the MGV-F (MBMS key Generation and Validation Function) was enhanced by mandating that Service n°133 be enabled whenever Service n°123 is available in the USIM Service Table. This linkage ensures that extended security parameters, including the SOR counter and UE parameter update counter, are stored on the USIM in association with the K~AUSF~. This change provides a more secure and integrated storage mechanism for MBMS-related security parameters on the UICC.
In Release 19, the MGV-F function introduced backward compatibility handling for USIMs lacking extended security parameter storage in the EF_5GAuthKeys file. This ensures interoperability by defining how MBMS key generation and validation proceeds when the USIM does not have the capability to store these extended security parameters. The update maintains service availability for multimedia broadcast/multicast services under these legacy storage conditions.
- Backward compatibility handling of USIM without extended security parameter storage in EF_5GAuthKeys - Rel19 TS 31.102CR1074
Explore further
Broader topics and technologies where MGV-F plays a role.
Defining Specifications
3GPP specifications that define or reference MGV-F, with the latest known release. Sourced from the 3GPP document catalog — see methodology.
| Specification | Title | Release |
|---|---|---|
| TS 31.102 vj40 | USIM Application Specification | Rel-19 |
| TS 33.246 vj00 | MBMS Security Specification | Rel-19 |