Cryptographic binding of native application and external browser sessions

1 . A computer-implemented method comprising:

receiving, at a server, information associated with a final single sign-on page from a native browser;

extracting, by the server, a public key from the information associated with the final single sign-on page from an identifier associated with the final single sign-on page;

determining whether the public key matches an active authentication key of a secure access system;

generating, by the server, a single sign-on token to bind a browser session and a native application session upon determining that the public key matches the active authentication key of the secure access system;

associating, by the server, the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and

encrypting, by the server, the single sign-on token with the public key to bind the browser session and the native application session, wherein the encrypting of the single sign-on token includes encrypting additional metadata associated with the single sign-on token.

2 . The computer-implemented method of claim 1 , wherein the secure access system is a Virtual Private Network (VPN).

3 . The computer-implemented method of claim 2 , wherein the active authentication key is a VPN authentication key.

4 . The computer-implemented method of claim 1 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.

5 . The computer-implemented method of claim 1 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.

6 . The computer-implemented method of claim 1 , wherein the encrypting of the single sign-on token is based on an encryption scheme including at least one of Elliptic Curve Diffie-Hellman (ECDH), Elliptic Curve Integrated Encryption Scheme (ECIES), and Hybrid Public Key Encryption (HPKE).

7 . A system comprising:

one or more processors; and

at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:

receive information associated with a final single sign-on page from a native browser;

extract a public key from the information associated with the final single sign-on page from an identifier associated with the final single sign-on page;

determine whether the public key matches an active authentication key of a secure access system;

generate a single sign-on token to bind a browser session and a native application session upon determining that the public key matches the active authentication key of the secure access system;

associate the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and

encrypt the single sign-on token with the public key to bind the browser session and the native application session, wherein encrypting the single sign-on token includes encrypting additional metadata associated with the single sign-on token.

8 . The system of claim 7 , wherein the secure access system is a Virtual Private Network (VPN).

9 . The system of claim 8 , wherein the active authentication key is a VPN authentication key.

10 . The system of claim 7 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.

11 . The system of claim 7 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.

12 . The system of claim 7 , wherein the encrypting of the single sign-on token is based on an encryption scheme including at least one of Elliptic Curve Diffie-Hellman (ECDH), Elliptic Curve Integrated Encryption Scheme (ECIES), and Hybrid Public Key Encryption (HPKE).

13 . A non-transitory computer-readable storage medium comprising:

instructions stored on the non-transitory computer-readable storage medium, the instructions, when executed by one or more processors, cause the one or more processors to:

receive information associated with a final single sign-on page from a native browser;

extract a public key from the information associated with the final single sign-on page from an identifier associated with the final single sign-on page;

determine whether the public key matches an active authentication key of a secure access system;

generate a single sign-on token to bind a browser session and a native application session upon determining that the public key matches the active authentication key of the secure access system;

associate the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and

encrypt the single sign-on token with the public key to bind the browser session and the native application session, wherein encrypting the single sign-on token includes encrypting additional metadata associated with the single sign-on token.

14 . The non-transitory computer-readable storage medium of claim 13 , wherein the secure access system is a Virtual Private Network (VPN).

15 . The non-transitory computer-readable storage medium of claim 14 , wherein the active authentication key is a VPN authentication key.

16 . The non-transitory computer-readable storage medium of claim 13 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.

17 . The non-transitory computer-readable storage medium of claim 13 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.