A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device using a multi-stage verified boot loader, a discovery agent at the endpoint device, a discovery service at the gateway device, an enrollment service, a policy service, and a device management service, the method comprising: obtaining, by the discovery service on the gateway device, from the discovery agent on the endpoint device, an authenticated identity beacon with a device profile of the endpoint device; verifying, by the discovery service on the gateway device, the authenticated identity beacon of the endpoint device and the device profile; generating, by the discovery service on the gateway device, a certificate request associated with a privacy certificate authority for the endpoint device; sending, by the discovery service on the gateway device, the certificate request to the enrollment service; translating, by the enrollment service, the certificate request to provide a translated certificate request associated with a certificate authority; sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate issued by the certificate authority; translating, by the enrollment service, the certificate to provide a translated certificate associated with the privacy certificate authority for the endpoint device; sending, by the enrollment service, the translated certificate to the discovery service; sending, by the enrollment service, a notification of registration of the endpoint device to the policy service; sending, by the policy service, a directive to add the endpoint device to the device management service; and storing, by the discovery service, the translated certificate in a local certificate store. obtaining, by the discovery service on the gateway device, from the discovery agent on the endpoint device, an authenticated identity beacon with a device profile of the endpoint device; verifying, by the discovery service on the gateway device, the authenticated identity beacon of the endpoint device and the device profile; generating, by the discovery service on the gateway device, a certificate request associated with a privacy certificate authority for the endpoint device; sending, by the discovery service on the gateway device, the certificate request to the enrollment service; translating, by the enrollment service, the certificate request to provide a translated certificate request associated with a certificate authority; sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate issued by the certificate authority; translating, by the enrollment service, the certificate to provide a translated certificate associated with the privacy certificate authority for the endpoint device; sending, by the enrollment service, the translated certificate to the discovery service; sending, by the enrollment service, a notification of registration of the endpoint device to the policy service; sending, by the policy service, a directive to add the endpoint device to the device management service; and storing, by the discovery service, the translated certificate in a local certificate store.