Abstract: The calculation of encryption keys is a processor intensive undertaking that is not suited for “thin client” terminal devices typically used for session applications in an Internet Protocol network. The present invention provides an encryption scheme for use with such terminal devices for the secure transmission of session data that minimizes session set-up delays associated with the exchange of encryption keys. First, keys are negotiated between network elements using prior art techniques (e.g. shared secret, IKE, Diffie-Hellman, RSA). Then, security is maintained by refreshing symmetric keys after each session under cover of an existing key. Perfect Forward Security (PFS) can be provided by “breaking the chain” through periodic key refreshes during system idle times.