A network system for enabling secure control-plane communications with, and adapted for being used together with, a mobile end-user device system adapted for enabling secure control-plane communications with the network system, the network system comprising: means for providing a plurality of service control links respectively to a plurality of service control device link agents, each service control device link agent on a respective one of a plurality of mobile end-user devices communicatively coupled to the network system, each service control link secured by an encryption protocol, each service control link supporting control-plane communications between the network system and one of the service control device link agents over a wireless access network, each service control device link agent for delivering agent messages over an agent communication bus to a plurality of device agents located on its respective mobile end-user device; means for receiving server messages from a plurality of servers coupled to the network system (1650, 1652, 1654, 1656, 1658, 1660, 1662, 1618, 1621, 16, 19, 134, 160, 130, 121, 126, 132, 123,4825,4835), including server messages respectively from two different network element functions and respectively intended for at least two corresponding ones of the device agents on a particular mobile end-user device; means for generating encrypted messages using an encryption key, the encrypted messages each comprising a message and an agent identifier based on a respective one of the server messages, the agent identifiers enabling the service control device link agent on the particular end-user device to deliver the messages to the respective intended device agents, the encryption key shared between the system and the particular service control device link agent; and means for sending the encrypted messages over a common service control link to the particular service control device link agent. means for providing a plurality of service control links respectively to a plurality of service control device link agents, each service control device link agent on a respective one of a plurality of mobile end-user devices communicatively coupled to the network system, each service control link secured by an encryption protocol, each service control link supporting control-plane communications between the network system and one of the service control device link agents over a wireless access network, each service control device link agent for delivering agent messages over an agent communication bus to a plurality of device agents located on its respective mobile end-user device; means for receiving server messages from a plurality of servers coupled to the network system (1650, 1652, 1654, 1656, 1658, 1660, 1662, 1618, 1621, 16, 19, 134, 160, 130, 121, 126, 132, 123,4825,4835), including server messages respectively from two different network element functions and respectively intended for at least two corresponding ones of the device agents on a particular mobile end-user device; means for generating encrypted messages using an encryption key, the encrypted messages each comprising a message and an agent identifier based on a respective one of the server messages, the agent identifiers enabling the service control device link agent on the particular end-user device to deliver the messages to the respective intended device agents, the encryption key shared between the system and the particular service control device link agent; and means for sending the encrypted messages over a common service control link to the particular service control device link agent.