A method in a client for providing security services to traffic over UDP in OMA SEC_CF, between the client and a server, comprising: establishing a pair of IPSec ESP SAs without shared key negotiation, wherein traffic data cryptographic algorithms are determined; deriving traffic data security keys from a pre-shared key, via the determined traffic data cryptographic algorithms; and providing security services to data of the traffic with the traffic data security keys through use of IPSec ESP, said establishing comprising: generating a request message for transmission to the server to initiate an establishment of the IPSec ESP SA, the request message containing a first set of SA-related parameters including: - a receiving SPI and a transmitting SPI assigned by the client for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the client for the traffic, and - a list of identifiers for cryptographic algorithms which the client supports; and receiving from the server a response message containing a second set of SA-related parameters including: - a receiving SPI and a transmitting SPI assigned by the server for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the server for the traffic, and - a list of identifiers for cryptographic algorithms supported by the server selected from the list of identifiers for cryptographic algorithms which the client supports. establishing a pair of IPSec ESP SAs without shared key negotiation, wherein traffic data cryptographic algorithms are determined; deriving traffic data security keys from a pre-shared key, via the determined traffic data cryptographic algorithms; and providing security services to data of the traffic with the traffic data security keys through use of IPSec ESP, generating a request message for transmission to the server to initiate an establishment of the IPSec ESP SA, the request message containing a first set of SA-related parameters including: - a receiving SPI and a transmitting SPI assigned by the client for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the client for the traffic, and - a list of identifiers for cryptographic algorithms which the client supports; and - a receiving SPI and a transmitting SPI assigned by the client for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the client for the traffic, and - a list of identifiers for cryptographic algorithms which the client supports; receiving from the server a response message containing a second set of SA-related parameters including: - a receiving SPI and a transmitting SPI assigned by the server for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the server for the traffic, and - a list of identifiers for cryptographic algorithms supported by the server selected from the list of identifiers for cryptographic algorithms which the client supports. - a receiving SPI and a transmitting SPI assigned by the server for the pair of IPSec ESP SAs, - a receiving UDP port and a transmitting UDP port assigned by the server for the traffic, and - a list of identifiers for cryptographic algorithms supported by the server selected from the list of identifiers for cryptographic algorithms which the client supports.