Disclosed are a method for requesting, generating and distributing a service-specific traffic encryption key in a wireless portable Internet system, an apparatus for the same, and a protocol configuration method for the same. In the present invention, a subscriber station sends a Key Request message for requesting a service-specific traffic encryption key to the base station using a PKM-REQ MAC message, and a base station analyzes the Key Request message to generate the requested service-specific traffic encryption key. Subsequently, the base station sends a Key Reply message, including the generated service-specific traffic encryption key, to the subscriber station using a PKM-RSP MAC message. If the base station fails to generate the key, the base station sends a Key Reject message, including a reason for the failure, to the subscriber station.