Service provider certificate management

A service provider system comprising:

• a communication interface configured to establish a telecommunication link with a device via a telecommunication network;
• and
• a processor communicatively coupled to the communication interface and configured to:
• receive a device public key from the device, the device public key predating the establishment of the telecommunication link;
• verify that the device stores a device private key in a secure storage area of the device, the device private key and the device public key being a cryptographic key pair;
• and
• authorize sign-up of the device for service enrollment in response to verifying that the device stores the device private key in the secure storage area of the device.

A method comprising:

• establishing a telecommunication link between a device and service provider system via a telecommunication network;
• sending a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key, a device identity, and a digital signature, the device public key predating the establishing of the telecommunication link, the device public key corresponding to a device private key stored in secure memory of the device, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory of the device;
• and
• receiving, at the device from the service provider system, an authorization to sign up the device for service enrollment.

A device comprising:

• a communication interface configured to establish a telecommunication link between the device and a service provider system via a telecommunication network;
• a secure memory storing a device private key;
• and
• a processor communicatively coupled to the communication interface and the secure memory and configured to:
• send a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key corresponding to the device private key, a device identity, and a digital signature, the device public key predating establishment of the telecommunication link, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory;
• and
• receive, via the communication interface from the service provider system, at least one of a service-provider-signed certificate, corresponding to the device certificate, or an authorization to sign up the device for service enrollment.