Hardware-based device authentication

At least one non-transitory, machine-accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• identify an opportunity for a secure session between a particular domain and a client device, wherein the secure session is to be based, at least in part, on identity verification of the client device;
• receive a one-time-password from the client device, wherein the one-time password is to be generated from a hash of a seed of the particular domain provisioned on secure memory of the client device and another value;
• process the one-time-password to derive the seed;
• identify a profile mapped to the seed;
• authenticate the client device based at least in part on the one-time-password;
• and
• apply security policies for transactions involving the client device and the particular domain based at least in part on the authentication of the client device.

At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

• identify an opportunity for a computing device to participate in a secure session with a particular domain;
• identify, using a secured microcontroller, a secured, persistent seed corresponding to the particular domain and stored in secured memory of the computing device;
• derive, using the secured microcontroller, a one-time password based on the seed;
• and
• use the one-time password to authenticate the computing device to the particular domain for the secure session, wherein the secured microcontroller sends, independent of a processor and operating system of the computing device, the one-time password to another device associated with the particular domain.

A method comprising:

• identifying an opportunity for a secure session between a particular domain and a client device, wherein the secure session is based, at least in part, on identity verification of the client device;
• receiving a one-time-password from the client device, wherein the one-time password is generated from a hash of a seed of the particular domain provisioned on secure memory of the client device and another value;
• processing the one-time-password to derive the seed;
• identifying a profile mapped to the seed;
• authenticating the client device based at least in part on the one-time-password;
• and
• applying security policies for transactions involving the client device and the particular domain based at least in part on the authentication of the client device.

A system comprising:

• a processor device;
• a memory element;
• a domain manager adapted, when executed by the processor device, to:
• identify an opportunity for a secure session between a particular domain and a client device, wherein the secure session is based, at least in part, on identity verification of the client device;
• receive a secure identifier from the client device, wherein the secure identifier is generated from a hash of a seed of the particular domain provisioned on secure memory of the client device and another value;
• process the one-time-password to derive the seed;
• identify a profile mapped to the seed;
• authenticate the client device based at least in part on the secure identifier;
• and
• apply security policies for transactions involving the client device and the particular domain based at least in part on the authentication of the client device.