A security method in a radio access network system of a telecommunications network providing a wireless radio interface for at least one user device, wherein a shared secret key is stored in both the user device and a core network system of the telecommunications network, the method comprising the steps in the radio access network system of: transmitting a request for a further secret key to the core network system; receiving the further secret key from the core network system, wherein the further secret key has been derived using the shared secret key stored in the core network system; providing one or more values over the radio interface to the user device to derive a further secret key in the user device from at least the shared secret key stored in the user device and one or more of the one or more values provided over the radio interface, wherein one or more of the one or more values provided over the radio interface to the user device are received from the core network system as an authentication vector for the user device, and wherein the authentication vector is used for performing at least one of a first authentication procedure and a first key agreement procedure; and characterised by: the request containing an identifier identifying the radio access network system for which the further secret key is required; transmitting the identifier of the radio access network system onto the wireless radio interface; and performing at least one of subsequent local authentication procedures and subsequent local key agreement procedures for the user device over the wireless radio interface using the further secret key in the radio access network system and using the derived further secret key in the user device, wherein the further secret key is derived using the identifier identifying the radio access network system. transmitting a request for a further secret key to the core network system; receiving the further secret key from the core network system, wherein the further secret key has been derived using the shared secret key stored in the core network system; providing one or more values over the radio interface to the user device to derive a further secret key in the user device from at least the shared secret key stored in the user device and one or more of the one or more values provided over the radio interface, wherein one or more of the one or more values provided over the radio interface to the user device are received from the core network system as an authentication vector for the user device, and wherein the authentication vector is used for performing at least one of a first authentication procedure and a first key agreement procedure; and characterised by: the request containing an identifier identifying the radio access network system for which the further secret key is required; transmitting the identifier of the radio access network system onto the wireless radio interface; and performing at least one of subsequent local authentication procedures and subsequent local key agreement procedures for the user device over the wireless radio interface using the further secret key in the radio access network system and using the derived further secret key in the user device, wherein the further secret key is derived using the identifier identifying the radio access network system. the request containing an identifier identifying the radio access network system for which the further secret key is required; transmitting the identifier of the radio access network system onto the wireless radio interface; and performing at least one of subsequent local authentication procedures and subsequent local key agreement procedures for the user device over the wireless radio interface using the further secret key in the radio access network system and using the derived further secret key in the user device, wherein the further secret key is derived using the identifier identifying the radio access network system.