A first network unit (500, 22, 32) of a device management, DM, network system, for protection of a bootstrap message, the first network unit (500, 22, 32) comprising: - a receiver configured to receive from a network entity (21, 31), when the network entity has detected a device, a first message comprising a request to bootstrap a detected device (600, 20, 30), said first message comprising information identifying the device (600, 20, 30) and information identifying a subscriber; - a transmitter configured to send a second message comprising the information identifying said subscriber to a second network unit (23, 33) said second message requesting the second network unit to provide the first network unit (500, 22, 32) with a bootstrap key that is based on the information identifying the subscriber, wherein: - said receiver is further configured to receive, from the second network unit (23, 33), a third message comprising said bootstrap key, for protection of the bootstrap message, said third message further comprising trigger information, - the first network unit further comprises storage means configured to store the bootstrap key, - the first network unit is further configured to protect, based on the bootstrap key, the bootstrap message, - the transmitter is further configured to transmit the protected bootstrap message to the detected device (600,20,30), - said transmitter is further configured to transmit the trigger information to the detected device (600, 20, 30) to trigger generation of the bootstrap key in the detected device (600, 20, 30); - the first network unit is adapted to establish a DM session between the detected device (600, 20, 30) and the first network unit. - a receiver configured to receive from a network entity (21, 31), when the network entity has detected a device, a first message comprising a request to bootstrap a detected device (600, 20, 30), said first message comprising information identifying the device (600, 20, 30) and information identifying a subscriber; - a transmitter configured to send a second message comprising the information identifying said subscriber to a second network unit (23, 33) said second message requesting the second network unit to provide the first network unit (500, 22, 32) with a bootstrap key that is based on the information identifying the subscriber, - said receiver is further configured to receive, from the second network unit (23, 33), a third message comprising said bootstrap key, for protection of the bootstrap message, said third message further comprising trigger information, - the first network unit further comprises storage means configured to store the bootstrap key, - the first network unit is further configured to protect, based on the bootstrap key, the bootstrap message, - the transmitter is further configured to transmit the protected bootstrap message to the detected device (600,20,30), - said transmitter is further configured to transmit the trigger information to the detected device (600, 20, 30) to trigger generation of the bootstrap key in the detected device (600, 20, 30); - the first network unit is adapted to establish a DM session between the detected device (600, 20, 30) and the first network unit.