A vehicle includes: (i) a main telematics module, (ii) a connectivity module including antenna(s) and processor(s). The connectivity module is configured to: (a) authenticate a mobile device via a vehicle-access-key (VAK); (b), if (a), issue an ephemeral-session-key (DSK) to the mobile device; (c), if (b), establish an active session with the mobile device; (d) encrypt all messages to the mobile device with the VAK during (a) and with the DSK during (c). The connectivity module is configured to automatically revoke the DSK upon expiration of a predetermined time interval.