A method for managing entitlement of a device to access a service, the method comprising providing an authenticated identity for the device, the authenticated identity including a public encryption key pair associated with the device signed by a trusted authority, and generating a device entitlement certificate encoding an authorisation related to the service and including a public key of the public encryption key pair associated with the device, wherein the device entitlement certificate is signed by the trusted authority.