A method for verifying whether an electronic device is one of a group of known devices, comprising: obtaining first data dependent on a first device identifier accessible from a first region of storage circuitry of an electronic device by a predetermined process executed by the electronic device; obtaining second data dependent on a second device identifier inaccessible from said storage circuitry by said predetermined process; wherein the first device identifier is accessible by the predetermined process in both a normal processing domain of the electronic device and in a trusted execution environment of the electronic device, wherein the second device identifier is stored in a secure region of said storage circuitry different from the first region, wherein the secure region is inaccessible using the predetermined process and the secure region is prevented by a hardware protection mechanism from being accessed in the normal processing domain of the electronic device, and wherein the secure region is accessible in the trusted execution environment using a secure handler function; transmitting verification information indicative of the first data and the second data to an enrolment server for verifying whether the first device identifier and the second device identifier corresponds to a valid pairing for one of said group of known devices; receiving, by the enrolment server, the verification information indicative of the first device identifier and receiving, by the enrolment server, the verification information indicative of the second device identifier, determining, by the enrolment server, by looking up a device database representing valid pairings of said first device identifier and said second device identifier for said group of known devices, whether the first device identifier and the second device identifier for the electronic device correspond to one of said valid pairings. obtaining first data dependent on a first device identifier accessible from a first region of storage circuitry of an electronic device by a predetermined process executed by the electronic device; obtaining second data dependent on a second device identifier inaccessible from said storage circuitry by said predetermined process; wherein the first device identifier is accessible by the predetermined process in both a normal processing domain of the electronic device and in a trusted execution environment of the electronic device, wherein the second device identifier is stored in a secure region of said storage circuitry different from the first region, wherein the secure region is inaccessible using the predetermined process and the secure region is prevented by a hardware protection mechanism from being accessed in the normal processing domain of the electronic device, and wherein the secure region is accessible in the trusted execution environment using a secure handler function; transmitting verification information indicative of the first data and the second data to an enrolment server for verifying whether the first device identifier and the second device identifier corresponds to a valid pairing for one of said group of known devices; receiving, by the enrolment server, the verification information indicative of the first device identifier and receiving, by the enrolment server, the verification information indicative of the second device identifier, determining, by the enrolment server, by looking up a device database representing valid pairings of said first device identifier and said second device identifier for said group of known devices, whether the first device identifier and the second device identifier for the electronic device correspond to one of said valid pairings.