A method of updating a subscriber identity module , SIM, on a host device , wherein the method is performed by an agent on the host device and comprises: deriving a pre-shared key , said deriving comprising: requesting a SIM identifier of the SIM via a communication module of the host device, wherein the communication module does not support bearer independent protocol; receiving the SIM identifier from the SIM via the communication module and deriving an agent identifier from the SIM identifier; transmitting the agent identifier and the SIM identifier over a network to a SIM update server ; receiving, via said network, a random value from the SIM update server; supplying the random value to the SIM via the communication module to initiate a SIM authentication procedure, and in reply receive an authentication response from the SIM via the communication module; and deriving the pre-shared key from the authentication response; transmitting an update request message over said network to the SIM update server, wherein the update request message comprises said agent identifier and is encrypted prior to transmission using the pre-shared key; receiving an update response message, via said network, from the SIM update server, wherein the update response message comprises update data and is encrypted using the pre-shared key; and following decryption of the update response message using the derived pre-shared key, transmitting the update data to the communication module for relaying to the SIM for execution to update the SIM. deriving a pre-shared key , said deriving comprising: requesting a SIM identifier of the SIM via a communication module of the host device, wherein the communication module does not support bearer independent protocol; receiving the SIM identifier from the SIM via the communication module and deriving an agent identifier from the SIM identifier; transmitting the agent identifier and the SIM identifier over a network to a SIM update server ; receiving, via said network, a random value from the SIM update server; supplying the random value to the SIM via the communication module to initiate a SIM authentication procedure, and in reply receive an authentication response from the SIM via the communication module; and deriving the pre-shared key from the authentication response; requesting a SIM identifier of the SIM via a communication module of the host device, wherein the communication module does not support bearer independent protocol; receiving the SIM identifier from the SIM via the communication module and deriving an agent identifier from the SIM identifier; transmitting the agent identifier and the SIM identifier over a network to a SIM update server ; receiving, via said network, a random value from the SIM update server; supplying the random value to the SIM via the communication module to initiate a SIM authentication procedure, and in reply receive an authentication response from the SIM via the communication module; and deriving the pre-shared key from the authentication response; transmitting an update request message over said network to the SIM update server, wherein the update request message comprises said agent identifier and is encrypted prior to transmission using the pre-shared key; receiving an update response message, via said network, from the SIM update server, wherein the update response message comprises update data and is encrypted using the pre-shared key; and following decryption of the update response message using the derived pre-shared key, transmitting the update data to the communication module for relaying to the SIM for execution to update the SIM. <EOS>