A method for managing security keys in a communication network, wherein the security keys are shared between a communication device, an authentication node (15, 21), and a plurality of service nodes (16, 22) that provide services to the communication device, the method comprising the steps of: the authentication node (15, 21) allocating to each service node, a different authentication node identifier; the authentication node locally associating (43, 61) each of the plurality of service nodes with the authentication node identifier allocated to each service node; the communication device retrieving from the network, a service description (44, 62) for at least a service, the service description including the authentication node identifier allocated to the service node that provides the service; choosing at the communication device a service from the service description; the communication device utilizing the authentication node identifier included in the service description to derive (45, 73) a security key based on known information; the authentication node receiving (47, 64) from the communication device, a service identifier in a request for the chosen service; the authentication node associating (48, 65) the service identifier for the chosen service with the service node that provides the chosen service and with the authentication node identifier allocated to the service node that provides the chosen service; the authentication node sending to a bootstrapping server, the authentication node identifier allocated to the service node that provides the chosen service; the bootstrapping server using the authentication node identifier allocated to the service node that provides the chosen service to derive (50, 67) the security key derived by the communication device; the bootstrapping server sending (51, 70) the security key to the authentication node; the authentication node sending (52, 69) the security key to the associated service node, which utilizes the security key to protect communications with the communicating device; wherein when the communication device requests other services from different service nodes, a different security key is derived for use between the communication device and each different service node. the authentication node (15, 21) allocating to each service node, a different authentication node identifier; the authentication node locally associating (43, 61) each of the plurality of service nodes with the authentication node identifier allocated to each service node; the communication device retrieving from the network, a service description (44, 62) for at least a service, the service description including the authentication node identifier allocated to the service node that provides the service; choosing at the communication device a service from the service description; the communication device utilizing the authentication node identifier included in the service description to derive (45, 73) a security key based on known information; the authentication node receiving (47, 64) from the communication device, a service identifier in a request for the chosen service; the authentication node associating (48, 65) the service identifier for the chosen service with the service node that provides the chosen service and with the authentication node identifier allocated to the service node that provides the chosen service; the authentication node sending to a bootstrapping server, the authentication node identifier allocated to the service node that provides the chosen service; the bootstrapping server using the authentication node identifier allocated to the service node that provides the chosen service to derive (50, 67) the security key derived by the communication device; the bootstrapping server sending (51, 70) the security key to the authentication node; the authentication node sending (52, 69) the security key to the associated service node, which utilizes the security key to protect communications with the communicating device; wherein when the communication device requests other services from different service nodes, a different security key is derived for use between the communication device and each different service node.