Hardware-based device authentication

A method comprising:

• identifying an opportunity for a secure session between a particular domain and a client device, wherein the secure session is based, at least in part, on identity verification of the client device;
• communicating a domain identifier of the particular domain to the client device;
• receiving a secure identifier from the client device, wherein the secure identifier is a unique identifier for the client device corresponding to a pairing of the client device and the particular domain and derived based on a persistent, private identifier embedded in hardware of the client device;
• and
• applying security policies for transactions involving the client device and the particular domain based at least in part on the secure identifier.

At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• identify an opportunity for a computing device to participate in a secure session with a particular domain;
• receive a domain identifier of the particular domain;
• identify, using a secured microcontroller of the computing device, a secured, persistent hardware identifier of the computing device stored in secured memory of the computing device;
• derive a secure identifier for a pairing of the computing device and the particular domain based on the hardware identifier and domain identifier of the particular domain;
• and
• send the secure identifier over a secured channel to the particular domain.

At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• identify an opportunity for a secure session between a particular domain and a client device, wherein the secure session is based, at least in part, on identity verification of the client device;
• send a domain identifier of the particular domain to the client device;
• receive a secure identifier from the client device, wherein the secure identifier is a unique identifier for the client device corresponding to a pairing of the client device and the particular domain and derived based on a persistent, private identifier embedded in hardware of the client device;
• and
• apply security policies for transactions involving the client device and the particular domain based at least in part on the secure identifier.

A system comprising:

• a system processor device;
• system memory accessible to the system processor device;
• a management controller of a computing device, the management controller comprising:
• secure management controller memory isolated from the system processor and system memory and storing a secured, persistent hardware identifier;
• a management microcontroller adapted to execute instructions to:
• identify an opportunity to participate in a secure session with a particular domain;
• receive a domain identifier of the particular domain;
• derive a secure identifier for a pairing of the computing device and the particular domain based on the hardware identifier and domain identifier of the particular domain;
• and
• cause the secure identifier to be sent over a secured channel to the particular domain.