Pinning device identifiers to cryptographic key pairs

1 . A method for authenticating a computer system, comprising:

receiving, by a processor of a server, device identifier information associated with the computer system;

generating, by the processor of the server, a device identifier and an enrollment token based on the device identifier information;

communicating, by the processor of the server, the device identifier and the enrollment token to the computer system;

receiving, by the processor of the server from the computer system, a public key signed with a private key as a signed key data in response to the communicating, wherein the public key and the private key are parts of a keypair generated by the computer system from the enrollment token and the device identifier as inputs to a cryptographic key generation process; and

performing, by the processor, authentication of the computer system based on the signed key data.

2 . The method of claim 1 , wherein the device identifier information includes at least one of a unique machine identifier, a security identifier of the computer system, a domain identifier, a hardware identifier, an intune identifier, and an advanced malware protection identifier.

3 . The method of claim 1 , wherein the device identifier information is received in response to a completion of a first factor authentication of a two-factor authentication.

4 . The method of claim 3 , wherein the generating the device identifier and the enrollment token is performed in response to a completion of a second factor authentication of the two-factor authentication.

5 . The method of claim 1 , further comprising determining that enrollment of the computer system is needed based on an absence or a presence of a signature from the signed key data associated with the device identifier information.

6 . The method of claim 5 , further comprising enrolling the computer system as a secure device based on the signed key data.

7 . The method of claim 6 , wherein the enrolling is based on a validation of the enrollment token extracted from the signed key data.

8 . The method of claim 1 , wherein the keypair is generated using cryptography.

9 . The method of claim 1 , wherein the signed key data includes the public key associated with the device identifier and the keypair is associated with a user.

10 . The method of claim 9 , further comprising performing authentication of the user based on the signed key data.

11 . A method for authenticating a computer system, comprising:

determining, by a processor of the computer system, device identifier information associated with the computer system;

receiving, by the processor of the computer system from a server, a device identifier and an enrollment token based on the device identifier information;

generating, by the processor of the computer system, a keypair including a public key and a private the device identifier and the enrollment token as inputs to a cryptographic key generation process; and

transmitting, to a processor of the server, the public key signed with the private key as a signed key data for performing authentication of the computer system based on the signed key data.

12 . The method of claim 11 , wherein the device identifier information includes at least one of a unique machine identifier, a security identifier of the computer system, a domain identifier, a hardware identifier, an intune identifier, and an advanced malware protection identifier.

13 . The method of claim 11 , further comprising completing a first factor authentication of a two-factor authentication, and wherein the determining the device identifier information is in response to the completing.

14 . The method of claim 13 , further comprising completing a second factor authentication of the two-factor authentication, and wherein the receiving the device identifier and the enrollment token is in response to the completing of the second factor authentication of the two-factor authentication.

15 . The method of claim 14 , further comprising enrolling the computer system as a secure device based on the signed key data.

16 . The method of claim 15 , wherein the public key is generated from the enrollment token and the device identifier information.

17 . The method of claim 11 , wherein the keypair is generated using cryptography.

18 . The method of claim 11 , wherein the signed key data includes the public key associated with the device identifier and the keypair is associated with a user.

19 . The method of claim 18 , further comprising performing authentication of the user based on the signed key data.

20 . A system for authenticating a computer system, comprising:

one or more processors; and

at least one of a first computer-readable storage medium and a second computer-readable storage medium,

the first computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the one or more processors to:

receive device identifier information associated with the computer system;

generate a device identifier and an enrollment token based on the device identifier information;

communicate the device identifier and the enrollment token to the computer system;

receive a public key signed with a private key as a signed key data in response to the communicating, wherein the public key and the private key are parts of a keypair generated by the computer system from the enrollment token and the device identifier as inputs to a cryptographic key generation process; and

perform authentication of the computer system based on the signed key data; and

the second computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the one or more processors to:

determine the device identifier information associated with the computer system;

receive the device identifier and the enrollment token based on the device identifier information;

generate the keypair including the public key and the private key from the device identifier and the enrollment token as inputs to the cryptographic key generation process; and

transmit the signed key data for performing the authentication of the computer system based on the signed key data.