A network system, comprising: a communication interface enabling the network system to communicate with an end-user device over a wireless access network (110, 405, 415); and one or more network elements (122, 2200, 2210, 2220, 2230, 2240) configured to: receive a device credential from the end-user device, obtain a service policy based at least in part on the device credential, the service policy being applicable to the end-user device, obtain service processor authentication information associated with a service processor on the end-user device, and using the service processor authentication information to facilitate execution of an end-user device service processor authentication procedure, characterized in that the one or more network elements (122, 2200, 2210, 2220, 2230, 2240) comprise a service controller configured to: receive a notification from the wireless access network (110, 405, 415) that the end-user device has started a cellular data session, waiting, in response to the notification, for a predetermined time period to receive a login and/or authentication request from the service processor on the end-user device, wherein when the login and/or authentication request from the service processor is received during the predetermined time period, and when the service processor successfully completes the end-user device service processor authentication procedure, set up a data rating service for cellular data traffic of the end-user device in a first configuration that relies on data traffic characterization from the end-user device, and wherein when the login and/or authentication request from the service processor is not received during the predetermined time period, or when the service processor does not successfully complete the end-user device service processor authentication procedure, set up the data rating service for cellular data traffic of the end-user device in a second configuration that operates without reliance on data traffic characterization from the end-user device. a communication interface enabling the network system to communicate with an end-user device over a wireless access network (110, 405, 415); and receive a device credential from the end-user device, obtain a service policy based at least in part on the device credential, the service policy being applicable to the end-user device, obtain service processor authentication information associated with a service processor on the end-user device, and using the service processor authentication information to facilitate execution of an end-user device service processor authentication procedure, the one or more network elements (122, 2200, 2210, 2220, 2230, 2240) comprise a service controller configured to: receive a notification from the wireless access network (110, 405, 415) that the end-user device has started a cellular data session, waiting, in response to the notification, for a predetermined time period to receive a login and/or authentication request from the service processor on the end-user device, wherein when the login and/or authentication request from the service processor is received during the predetermined time period, and when the service processor successfully completes the end-user device service processor authentication procedure, set up a data rating service for cellular data traffic of the end-user device in a first configuration that relies on data traffic characterization from the end-user device, and wherein when the login and/or authentication request from the service processor is not received during the predetermined time period, or when the service processor does not successfully complete the end-user device service processor authentication procedure, set up the data rating service for cellular data traffic of the end-user device in a second configuration that operates without reliance on data traffic characterization from the end-user device. receive a notification from the wireless access network (110, 405, 415) that the end-user device has started a cellular data session, waiting, in response to the notification, for a predetermined time period to receive a login and/or authentication request from the service processor on the end-user device, wherein when the login and/or authentication request from the service processor is received during the predetermined time period, and when the service processor successfully completes the end-user device service processor authentication procedure, set up a data rating service for cellular data traffic of the end-user device in a first configuration that relies on data traffic characterization from the end-user device, and wherein when the login and/or authentication request from the service processor is not received during the predetermined time period, or when the service processor does not successfully complete the end-user device service processor authentication procedure, set up the data rating service for cellular data traffic of the end-user device in a second configuration that operates without reliance on data traffic characterization from the end-user device.