A system comprising: a device comprising: a key request module configured to transmit a key request, comprising a device identifier of the device, to a provisioning server; a key receive module configured to receive a device root key associated with the device from the provisioning server, wherein the device root key is derived by the provisioning server from a unique subscriber root key associated with an international mobile subscriber identity IMSI and the device identifier, and the IMSI is a shared IMSI used for provisioning of a group of devices including the device, wherein respective unique device root keys are derived for the group of devices from the subscriber root key and respective device identifiers of the group of devices by the provisioning server; an authentication request transmit module configured to transmit an authentication request comprising the IMSI, and the device identifier identifying the device to a first home subscriber server, HSS; and an authentication under key agreement, AKA, module configured to perform an AKA procedure using the device root key with a second HSS, whereby the key request module, the key receive module, the authentication request transmit module and the AKA module authenticate the device for subscriber identity module, SIM, provisioning of the device, the first HSS configured to forward the authentication request to the second HSS, and the second HSS configured to derive the device root key based on the subscriber root key associated with the IMSI and the device identifier. a device comprising: a key request module configured to transmit a key request, comprising a device identifier of the device, to a provisioning server; a key receive module configured to receive a device root key associated with the device from the provisioning server, wherein the device root key is derived by the provisioning server from a unique subscriber root key associated with an international mobile subscriber identity IMSI and the device identifier, and the IMSI is a shared IMSI used for provisioning of a group of devices including the device, wherein respective unique device root keys are derived for the group of devices from the subscriber root key and respective device identifiers of the group of devices by the provisioning server; an authentication request transmit module configured to transmit an authentication request comprising the IMSI, and the device identifier identifying the device to a first home subscriber server, HSS; and an authentication under key agreement, AKA, module configured to perform an AKA procedure using the device root key with a second HSS, whereby the key request module, the key receive module, the authentication request transmit module and the AKA module authenticate the device for subscriber identity module, SIM, provisioning of the device, a key request module configured to transmit a key request, comprising a device identifier of the device, to a provisioning server; a key receive module configured to receive a device root key associated with the device from the provisioning server, wherein the device root key is derived by the provisioning server from a unique subscriber root key associated with an international mobile subscriber identity IMSI and the device identifier, and the IMSI is a shared IMSI used for provisioning of a group of devices including the device, wherein respective unique device root keys are derived for the group of devices from the subscriber root key and respective device identifiers of the group of devices by the provisioning server; an authentication request transmit module configured to transmit an authentication request comprising the IMSI, and the device identifier identifying the device to a first home subscriber server, HSS; and an authentication under key agreement, AKA, module configured to perform an AKA procedure using the device root key with a second HSS, whereby the key request module, the key receive module, the authentication request transmit module and the AKA module authenticate the device for subscriber identity module, SIM, provisioning of the device, the first HSS configured to forward the authentication request to the second HSS, and the second HSS configured to derive the device root key based on the subscriber root key associated with the IMSI and the device identifier.