A system comprising: a gateway configured to restrict access to an internal network; an authentication server communicatively coupled to the gateway; a client device with an authentication client having a plurality of authentication devices coupled thereto for authenticating a user, the authentication client configured to establish a communication channel with the authentication server and to register one or more of the authentication devices with the authentication server, the authentication devices usable for performing online authentication with the authentication server following registration; the authentication client to authenticate the user with the authentication server using a specific one of the one or more of the registered authentication devices identified by the authentication server in response to an attempt to gain access to the internal network via the gateway; the authentication server to provide the client device with a cryptographic data structure in response to a successful authentication; the client device to provide the cryptographic data structure to the gateway as proof of the successful authentication; the gateway to validate the cryptographic data structure with the authentication server by providing the cryptographic data structure to the authentication server; and the authentication server to validate the cryptographic data structure provided by the gateway using a key associated with the authentication device used for authentication, wherein upon receiving an indication from the authentication server that the cryptographic data structure is valid, the gateway to provide access by the client device to the internal network. a gateway configured to restrict access to an internal network; an authentication server communicatively coupled to the gateway; a client device with an authentication client having a plurality of authentication devices coupled thereto for authenticating a user, the authentication client configured to establish a communication channel with the authentication server and to register one or more of the authentication devices with the authentication server, the authentication devices usable for performing online authentication with the authentication server following registration; the authentication client to authenticate the user with the authentication server using a specific one of the one or more of the registered authentication devices identified by the authentication server in response to an attempt to gain access to the internal network via the gateway; the authentication server to provide the client device with a cryptographic data structure in response to a successful authentication; the client device to provide the cryptographic data structure to the gateway as proof of the successful authentication; the gateway to validate the cryptographic data structure with the authentication server by providing the cryptographic data structure to the authentication server; and the authentication server to validate the cryptographic data structure provided by the gateway using a key associated with the authentication device used for authentication, wherein upon receiving an indication from the authentication server that the cryptographic data structure is valid, the gateway to provide access by the client device to the internal network.