Non-pre-provisioned cellular Internet of things (IoT) devices can be added to an existing user's subscription with an operator and a service provider. The procedure can include obtaining a security association between a device and a user's smartphone using the operator's network. The operator and the service provider can verify the device with a certificate authority. In one embodiment, the smartphone reads (302) a URL pointer to the device certification and sends it (304) to the MME. The MME forwards (306) the URL to the HSS. The HSS verifies (312) the certificate and derives security credentials including the Master key K′. The HSS also derives another key K″ used to establish security context between the IoT device and the smartphone. The device uses its key deriving function KDF with K′ and Rand to generate K″.