Key negotiation and provisioning for devices in a network

A method of establishing a secure communication session between a first device and a second device, the first device operating in a user network and implementing a first key exchange protocol for secure communication, the second device capable of communicating with the first device over a wireless communication network, the second device implementing a second key exchange protocol that is different to the first key exchange protocol for secure communication, the method comprising:

• providing a proxy entity configured for implementing the first and the second key exchange protocols for secure communication;
• obtaining by the proxy entity a first device key for the first device using the first key exchange protocol;
• generating by the proxy entity a challenge for the second device, said challenge associated with the first device,
• providing the challenge to the second device using the wireless communication network;
• generating by the second device a response to the challenge;
• obtaining by the proxy entity the response from the second device and generating a session key based on the response;
• encrypting by the proxy entity the generated session key using the first device key and sending the encrypted session key to the first device using the first key exchange protocol;
• decrypting, by the first device the encrypted session key using the first device key;
• and
• establishing a secure communication session over the wireless communication network for data transfer between the first device and the second device using the session key.

A system for establishing a secure communication session between a first and second

• device over a wireless communication network, the system comprising:
• the first device having at least one processor and operating within a user network, said user network including a plurality of other devices, each device in the user network being communicatively coupled with a control server for the user network;
• the second device having at least one processor and being configured for communicating with the first device over the wireless communication network;
• and
• a proxy entity having at least one processor for managing key exchanges or data transfers for secure communication between the first and second devices,
• the system configured for implementing the method as claimed in any one of the preceding claims.