Automated device provisioning and activation

A network system comprising:

• means for providing a plurality of service control links to a plurality of end-user devices communicatively coupled to the network system, each service control link secured by an encryption protocol, a particular service control link of the plurality of service control links supporting control-plane communications between the network system and a particular end-user device of the plurality of end-user devices over one or more wireless access networks;
• means for receiving a server message from a particular server of a plurality of servers communicatively coupled to the network system, the server message comprising message payload;
• means for generating an encrypted message comprising the message payload and an identifier identifying a particular device agent of a plurality of device agents on the particular end-user device, the identifier configured to assist in delivering at least a portion of the message payload to the particular device agent on the particular end-user device;
• and
• means for sending the encrypted message to the particular end-user device over the particular service control link.

A non-transitory computer-readable storage medium storing program code for causing one or more processors to execute a method comprising:

• providing a plurality of service control links to a plurality of end-user devices communicatively coupled to the computer, each service control link secured by an encryption protocol, a particular service control link of the plurality of service control links supporting control-plane communications between the computer and a particular end-user device of the plurality of end-user devices over one or more wireless access networks;
• receiving a server message from a particular server of a plurality of servers communicatively coupled to the computer, the server message comprising message payload;
• generating an encrypted message comprising the message payload and an identifier identifying a particular device agent of a plurality of device agents on the particular end-user device configured to assist in delivering at least a portion of the message payload to the particular device agent on the particular end-user device;
• and
• sending the encrypted message to the particular end-user device over the particular service control link.