A method, comprising: receiving, via a network, a request to access a server, the request comprising a first device tag set, wherein the first device tag set comprises a device tag, and the device tag comprises a static portion and a dynamic portion, and wherein the dynamic portion has a first dynamic value; determining if a first device tag set is present in a client device; if the first device tag set is present in a client device: when the first device tag set matches a previously assigned device tag set, requesting a portion of full access credentials from the client device; allowing access to the server without requesting full access credentials of a user, authenticating the portion of full access credentials, if authentication of the portion of full access credentials is successful: invalidating the first device tag set, and assigning and sending a second device tag set, wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value; and when the first device tag set does not match the previously assigned device tag set, requesting full access credentials from the user. receiving, via a network, a request to access a server, the request comprising a first device tag set, wherein the first device tag set comprises a device tag, and the device tag comprises a static portion and a dynamic portion, and wherein the dynamic portion has a first dynamic value; determining if a first device tag set is present in a client device; if the first device tag set is present in a client device: when the first device tag set matches a previously assigned device tag set, requesting a portion of full access credentials from the client device; allowing access to the server without requesting full access credentials of a user, authenticating the portion of full access credentials, if authentication of the portion of full access credentials is successful: invalidating the first device tag set, and assigning and sending a second device tag set, wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value; and when the first device tag set does not match the previously assigned device tag set, requesting full access credentials from the user. when the first device tag set matches a previously assigned device tag set, requesting a portion of full access credentials from the client device; allowing access to the server without requesting full access credentials of a user, authenticating the portion of full access credentials, if authentication of the portion of full access credentials is successful: invalidating the first device tag set, and assigning and sending a second device tag set, wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value; and requesting a portion of full access credentials from the client device; allowing access to the server without requesting full access credentials of a user, authenticating the portion of full access credentials, if authentication of the portion of full access credentials is successful: invalidating the first device tag set, and assigning and sending a second device tag set, wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value; and invalidating the first device tag set, and assigning and sending a second device tag set, wherein sending a second device tag set comprises replacing the first dynamic value with a second dynamic value; and when the first device tag set does not match the previously assigned device tag set, requesting full access credentials from the user.