Lightweight authentication protocol using device tokens

A computer-implemented method comprising:

• sending, to a directory service, authentication information of a computer system to communicate with a device;
• receiving, from the directory service, registration information associated with the device and a first token that corresponds to the registration information, wherein the registration information comprises network-address information;
• establishing a network connection between the computer system and the device using the network-address information;
• sending, to the device, an authentication challenge comprising a random number;
• receiving, from the device, a digital signature that is generated based, at least in part, on the authentication challenge and a symmetric key, derived from a digital certificate of the device, provided to the device by the directory service;
• and
• verifying the device by at least matching the digital signature received from the device to another digital signature generated based, at least in part, on the first token.

A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:

• transmit, to a directory service, authentication information of the computer system;
• receive, from a directory service, registration information of a device that includes network-address information and a first token that is associated with the registration information;
• establish a network connection with the device based at least in part on the network-address information;
• receive, from the device, a digital signature generated based, at least in part, on a challenge and a signature, wherein:
• the signature is derived from a digital certificate of the device;
• and
• the challenge and signature are transmitted from the directory service to the device;
• generate another corresponding digital signature corresponding to the challenge based, at least in part, on the first token;
• and
• verify the device by at least matching the digital signature from the device to the other digital signature.