An apparatus and method for secure communication. An IoT service establishes communication with an IoT device through an IoT hub or a mobile user device. The IoT service and IoT device each generate public/private keys and exchange the public keys. The IoT service and device use their own private key and the public key received from the IoT device and service, respectively to independently generate a secret. The secret or a data structure derived from the secret is then used to encrypt and decrypt data packets transmitted between the IoT service and the IoT device.