A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device using a multi-stage verified boot loader, a discovery agent at the endpoint device, a discovery service at the gateway device , an enrollment service , a policy service , and a device management service, the method comprising: obtaining, by the discovery service on the gateway device , from the discovery agent on the endpoint device , an authenticated identity beacon with a device profile of the endpoint device ; verifying, by the discovery service on the gateway device , the authenticated identity beacon of the endpoint device and the device profile ; generating, by the discovery service on the gateway device , a certificate request associated with a privacy certificate authority for the endpoint device ; sending, by the discovery service on the gateway device , the certificate request to the enrollment service ; translating, by the enrollment service , the certificate request to provide a translated certificate request associated with a certificate authority ; sending, by the enrollment service to the certificate authority , the translated certificate request ; receiving, by the enrollment service , a certificate issued by the certificate authority ; translating, by the enrollment service , the certificate to provide a translated certificate associated with the privacy certificate authority for the endpoint device ; sending, by the enrollment service , the translated certificate to the discovery service ; sending, by the enrollment service , a notification of registration of the endpoint device to the policy service ; sending, by the policy service , a directive to add the endpoint device to the device management service; and storing, by the discovery service , the translated certificate in a local certificate store. obtaining, by the discovery service on the gateway device , from the discovery agent on the endpoint device , an authenticated identity beacon with a device profile of the endpoint device ; verifying, by the discovery service on the gateway device , the authenticated identity beacon of the endpoint device and the device profile ; generating, by the discovery service on the gateway device , a certificate request associated with a privacy certificate authority for the endpoint device ; sending, by the discovery service on the gateway device , the certificate request to the enrollment service ; translating, by the enrollment service , the certificate request to provide a translated certificate request associated with a certificate authority ; sending, by the enrollment service to the certificate authority , the translated certificate request ; receiving, by the enrollment service , a certificate issued by the certificate authority ; translating, by the enrollment service , the certificate to provide a translated certificate associated with the privacy certificate authority for the endpoint device ; sending, by the enrollment service , the translated certificate to the discovery service ; sending, by the enrollment service , a notification of registration of the endpoint device to the policy service ; sending, by the policy service , a directive to add the endpoint device to the device management service; and storing, by the discovery service , the translated certificate in a local certificate store. <EOS>