System for user-friendly access control setup using a protected setup

A method comprising

• executing a configuration protocol between an apparatus and a first device to generate a first key to be shared between the apparatus and the first device;
• enabling the first device, in an instance in which the first device is a control point for a privileged service from a second device, to advertise that it is able to control the privileged service;
• deriving a second key by executing a key derivation function;
• deriving, from the first key, a third key, by executing a key derivation procedure between the apparatus and the first device, for the privileged service in an instance in which the apparatus determines that the first device should be configured to control the privileged service;
• encrypting the third key using at least the second key;
• and
• sending the encrypted third key to the second device, wherein the third key is used to encrypt data transferred between the first device and the second device.

A non-transitory storage device comprising the computer program code configured to, when executed by a processor, cause an apparatus to:

• execute a configuration protocol between the apparatus and a first device to generate a first key to be shared between the apparatus and the first device;
• enable the first device, in an instance in which the first device is a control point for a privileged service from a second device, to advertise that it is able to control the privileged service;
• derive a second key by executing a key derivation function;
• derive, from the first key, a third key, by executing a key derivation procedure between the apparatus and the first device, for the privileged service in an instance in which the apparatus determines that the first device should be configured to control the privileged service;
• encrypt the third key using at least the second key;
• and
• send the encrypted third key to the second device, wherein the third key is used to encrypt data transferred between the first device and the second device.