Methods and apparatus for enabling secure communications between a UE (user equipment) device operating though a packet-switched network and a 3rd party service outside of the user's home domain. The packet-switched network may be, for example, configured according and IMS architecture and use SIP control signaling. An identity server in the user's home domain is coupled with a proxy server or gateway and receives control messages, on which the identity server effects identity translation if needed. Translating messages targeted for the third party serve includes stripping user identifying information and adding a domain identifier to the message. It may also include adding an identity token. Where an identity token is not added, it may be provided upon request to a 3rd party service entity. Translating messages targeted for the UE includes adding a user identifier for home domain routing.