A method comprising: setting up a direct link between first and second stations in a wireless local area network WLAN hosted by an access point AP, the direct link comprising a new communication session; characterised by: generating, with the first station, a first random number R_A; sending, from the first station to the second station, a first message comprising a concatenation of R_A and a media access controller, MAC, address of the first station MAC_A and a MAC address of the second station MAC-B; generating, with the second station, a second random number R_B; sending, from the second station to the AP, a second message comprising a concatenation of R_A, MAC_A,R_B and a MAC address of the second station MAC_B; generating, at the AP, a session key unique to the new communication session and a key name identifier KID-AB utilizing the concatenation from the second message; transferring copies of the session key to each of the first and second stations using a key wrap encryption algorithm; and implementing a security mechanism for the direct link to effect a secure direct link employing a session key derived from the session key. setting up a direct link between first and second stations in a wireless local area network WLAN hosted by an access point AP, the direct link comprising a new communication session; characterised by: generating, with the first station, a first random number R_A; sending, from the first station to the second station, a first message comprising a concatenation of R_A and a media access controller, MAC, address of the first station MAC_A and a MAC address of the second station MAC-B; generating, with the second station, a second random number R_B; sending, from the second station to the AP, a second message comprising a concatenation of R_A, MAC_A,R_B and a MAC address of the second station MAC_B; generating, at the AP, a session key unique to the new communication session and a key name identifier KID-AB utilizing the concatenation from the second message; transferring copies of the session key to each of the first and second stations using a key wrap encryption algorithm; and implementing a security mechanism for the direct link to effect a secure direct link employing a session key derived from the session key. generating, with the first station, a first random number R_A; sending, from the first station to the second station, a first message comprising a concatenation of R_A and a media access controller, MAC, address of the first station MAC_A and a MAC address of the second station MAC-B; generating, with the second station, a second random number R_B; sending, from the second station to the AP, a second message comprising a concatenation of R_A, MAC_A,R_B and a MAC address of the second station MAC_B; generating, at the AP, a session key unique to the new communication session and a key name identifier KID-AB utilizing the concatenation from the second message; transferring copies of the session key to each of the first and second stations using a key wrap encryption algorithm; and implementing a security mechanism for the direct link to effect a secure direct link employing a session key derived from the session key.