Network access using hardware-based security

A method for operating an endpoint device to authenticate the endpoint device at a computing platform, the method comprising:

• sending a request for authentication to the computing platform, wherein the computing platform is a threat management facility;
• receiving a challenge payload from the computing platform;
• fetching an endpoint device certificate from a hardware-based security system on the endpoint device, wherein the endpoint device is a network device for an enterprise network managed by the computing platform;
• signing the challenge payload with a digital signature from the hardware-based security system;
• sending a challenge response to the computing platform based on the challenge payload, the challenge response including the endpoint device certificate, the challenge payload, and the digital signature;
• receiving an authentication token for access to security services of the computing platform for the enterprise network from the computing platform in response to the challenge response;
• authenticating the endpoint device at the computing platform with the authentication token;
• in response to an expiration of the authentication token, reauthenticating the endpoint device without a refresh token by transmitting a second challenge payload to the hardware-based security system on the endpoint device;
• and
• accessing services of the computing platform from the endpoint device with the authentication token.

A system comprising:

• an endpoint device connected to an enterprise network, wherein the endpoint device is a network device for the enterprise network;
• and
• a computing platform including an authenticator embodied in computer executable code stored in a non-transitory computer readable medium for managing access by the endpoint device to the computing platform, wherein the computing platform is a threat management facility, and wherein the authenticator is configured:
• to receive a request from the endpoint device for authentication at the computing platform,
• to generate a random data segment,
• to send the random data segment to the endpoint device,
• to receive a response data packet from the endpoint device,
• to determine a validity of the response data packet with one or more cryptographic validation tests of the response data packet,
• to send an authentication token to the endpoint device for access to security services of the computing platform for the enterprise network if the response data packet passes the one or more cryptographic validation tests, and
• in response to an expiration of the authentication token, to reauthenticate the endpoint device without a refresh token by transmitting a second challenge payload to a hardware-based security system on the endpoint device.