receiving, from a local bundle assistant (LBA), an SSP credential request including a secondary platform bundle manager (SPBM) credential, wherein the SPBM credential includes secondary platform bundle family identifier (SPB Family ID), secondary platform bundle family custodian object identifier (SPB Family Custodian Object ID) and a first SPBM certificate for key agreement, and wherein the first SPBM certificate for the key agreement includes a public key for key agreement of an SPBM;

verifying the first SPBM certificate based on the SPB Family ID and the SPB Family Custodian Object ID;

generating an ephemeral key pair of a SSP ephemeral public key and a SSP ephemeral secret key;

generating a first session key based on the SSP secret public key and the public key for key agreement of the SPBM;

generating the SSP credential based on the first session key; and

transmitting the generated SSP credential to the LBA, in response to receiving a transfer request from the LBA,

wherein the SPB Family ID represents an identifier that identifies a type of a bundle, and

wherein the SPB Family Custodian Object ID represents an identifier that identifies a subject which manages the SPB Family ID.