A method for securing encryption keys, the method comprising: providing a first device and a second device, the first device comprising first secure hardware and first insecure hardware, and the second device comprising second secure hardware and second insecure hardware; generating in the first secure hardware at least two period keys (150, 160), the at least two period keys (150, 160) stored in the first secure hardware; generating in the first secure hardware a plurality of session keys (170a, 180a, 190a); encrypting at least a first one of the plurality of session keys (170a, 180a, 190a) generated in the first device according to a first of the at least two period key (150, 160) comprised in the first secure hardware; encrypting at least a second one of the plurality of session keys (170a, 180a, 190a) generated in the first device according to a second of the at least two period keys (150, 160) comprised in the first secure hardware; generating in the second secure hardware at least two period keys (155, 165), the at least two period keys (155, 165) stored in the second secure hardware; generating in the second secure hardware a plurality of session keys (170b, 180b, 190b); encrypting at least a first one of the plurality of session keys (170b, 180b, 190b) generated in the second device according to a first of the at least two period keys (155, 165) comprised in the second secure hardware; encrypting at least a second one of the plurality of session keys (155, 165) generated in the second device according to a second of the at least two period keys (155, 165) comprised in the second secure hardware; decrypting one encrypted session key (170a, 180a, 190a) in the first device and decrypting one encrypted session key (170b, 180b, 190b) in the second device; and establishing an encrypted session between first device and the second device, the encrypted session being encrypted according to the one decrypted session key (170a, 180a, 190a) in the first device and the one decrypted session key (170b, 180b, 190b) in the second device, wherein the at least two period keys (150, 160) comprised in the first device and the at least two period keys (155, 165) comprised in the second device are periodically regenerated in order to produce new period keys, thereby rendering useless any session keys encrypted according to an old period key. providing a first device and a second device, the first device comprising first secure hardware and first insecure hardware, and the second device comprising second secure hardware and second insecure hardware; generating in the first secure hardware at least two period keys (150, 160), the at least two period keys (150, 160) stored in the first secure hardware; generating in the first secure hardware a plurality of session keys (170a, 180a, 190a); encrypting at least a first one of the plurality of session keys (170a, 180a, 190a) generated in the first device according to a first of the at least two period key (150, 160) comprised in the first secure hardware; encrypting at least a second one of the plurality of session keys (170a, 180a, 190a) generated in the first device according to a second of the at least two period keys (150, 160) comprised in the first secure hardware; generating in the second secure hardware at least two period keys (155, 165), the at least two period keys (155, 165) stored in the second secure hardware; generating in the second secure hardware a plurality of session keys (170b, 180b, 190b); encrypting at least a first one of the plurality of session keys (170b, 180b, 190b) generated in the second device according to a first of the at least two period keys (155, 165) comprised in the second secure hardware; encrypting at least a second one of the plurality of session keys (155, 165) generated in the second device according to a second of the at least two period keys (155, 165) comprised in the second secure hardware; decrypting one encrypted session key (170a, 180a, 190a) in the first device and decrypting one encrypted session key (170b, 180b, 190b) in the second device; and establishing an encrypted session between first device and the second device, the encrypted session being encrypted according to the one decrypted session key (170a, 180a, 190a) in the first device and the one decrypted session key (170b, 180b, 190b) in the second device, wherein the at least two period keys (150, 160) comprised in the first device and the at least two period keys (155, 165) comprised in the second device are periodically regenerated in order to produce new period keys, thereby rendering useless any session keys encrypted according to an old period key.