ECDHE key exchange for mutual authentication using a key server

A method for a network to securely communicate with a wireless device, the method performed by the network, the method comprising:

• a) storing, in a nonvolatile memory of a first server for the network, a server static private key corresponding to a server static public key;
• b) storing, in a nonvolatile memory of a second server for the network, a network static private key corresponding to a network static public key;
• c) receiving, by a low power wide area (LPWA) radio and from the wireless device, a message comprising a device ephemeral public key, cryptographic parameters for the device ephemeral public key, a temporary identifier for the wireless device, and a ciphertext;
• d) receiving, by the first server for the LPWA radio, the message, wherein the first server establishes a secure session with the second server in the network;
• e) receiving, by the second server and from the first server, the device ephemeral public key, the cryptographic parameters, the temporary identifier for the wireless device, and the ciphertext;
• f) generating, by the first server, a first value from a first Elliptic Curve Diffie Hellman (ECDH) key exchange with a device static public key, the device ephemeral public key, the server static private key, and the cryptographic parameters;
• g) generating, by the second server, a second value from a second ECDH key exchange with the device static public key, the device ephemeral public key, the network private key, and the cryptographic parameters;
• h) decrypting the ciphertext into a plaintext using the first value and the second value;
• and
• i) encrypting a response for the plaintext using the first value and the second value.