Network authentication with cryptographic corpocessors

1. A system comprising:

a computing device in data communication over a network with a browser on a client device, the computing device comprising a processor and a memory;

machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:

verify that a cryptographic coprocessor is installed on the client device by evaluating a response from the browser on the client device;

send a request to the browser on the client device to provision an asymmetric encryption key-pair using the cryptographic coprocessor, wherein the browser on the client device relays the request to the cryptographic coprocessor, the request comprises a key-authorization credential for the asymmetric encryption key-pair, and the asymmetric encryption key-pair comprises a public key and a private key;

receive, from the browser on the client device, the public key of the asymmetric encryption key-pair and an identity public key for the cryptographic coprocessor; and

store the public key, key-authorization credential, and the identity public key in association with each other.

2. The system of claim 1 , wherein machine-readable instructions further cause the computing device to at least, in response to a verification that the cryptographic coprocessor is installed on the client device, send the request to the browser on the client device to provision the asymmetric encryption key-pair using the cryptographic coprocessor.

3. The system of claim 1 , wherein the request to provision the asymmetric encryption key-pair is a first request, the asymmetric encryption key-pair is a first asymmetric encryption key-pair, the public key is a first public key, the private key is a first private key, and the machine-readable instructions further cause the computing device to at least:

send a second request to the browser on the client device to provision a second asymmetric encryption key-pair as a child key-pair of the first asymmetric encryption key-pair using the cryptographic coprocessor installed on the client device, wherein the second asymmetric encryption key-pair comprises a second public key and a second private key;

receive, from the browser on the client device, the second public key; and

store the second public key and the identity public key in association with each other.

4. The system of claim 1 , wherein the request to provision the asymmetric encryption key-pair is a first request and the machine-readable instructions further cause the computing device to at least:

send a second request to the browser on the client device to encrypt an authentication token and store the authentication token on the client device, wherein the request comprises a copy of the authentication token.

5. The system of claim 4 , wherein the machine-readable instructions further cause the computing device to at least:

verify an identity of a user of the client device; and

the second request to encrypt the authentication token and store the authentication token is sent to the browser on the client device in response to a verification of the identity of the user of the client device.

6. The system of claim 5 , wherein the machine-readable instructions further cause the computing device to at least:

store an association between the authentication token and the identity of the user.

7. The system of claim 4 , wherein the machine-readable instructions further cause the computing device to at least:

receive an authentication request from the browser on the client device; and

send a third request to the browser on the client device for the authentication token, wherein the third request includes a copy of the key-authorization credential.

8. The system of claim 5 , wherein the cryptographic coprocessor installed on the client device complies with a specification for a version of the trusted protection module (TPM) standard.

9. A non-transitory, computer-readable medium comprising machine-readable instructions that, when executed by a processor of a first computing device, cause the first computing device to at least:

send, by a browser on the first computing device, configuration data of the first computing device to a second computing device, wherein the configuration data comprises at least an indication that the first computing device has a cryptographic coprocessor installed on the first computing device;

receive, by the browser on the first computing device, a request from the second computing device to provision an asymmetric encryption key-pair using the cryptographic coprocessor installed on the first computing device, wherein the request comprises a key-authorization credential for the asymmetric encryption key-pair;

generate, by the cryptographic coprocessor on the first computing device, the asymmetric encryption key-pair, wherein the asymmetric encryption key-pair comprises a public key and a private key, wherein access to the private key is protected by the key-authorization credential;

generate, by the cryptographic coprocessor on the first computing device, an identity key that uniquely identifies the cryptographic coprocessor; and

provide, by the browser on the first computing device, the public key and the identity key to the second computing device.

10. The non-transitory, computer-readable medium of claim 9 , wherein the request is a first request, the asymmetric encryption key-pair is a first asymmetric encryption key-pair, the public key is a first public key, the private key is a first private key, and the machine-readable instructions, when executed by the processor, further cause the first computing device to at least:

receive, by the browser on the first computing device, a second request from the second computing device to provision a second asymmetric encryption key-pair using the cryptographic coprocessor installed on the first computing device;

generate, by the cryptographic coprocessor on the first computing device, the second asymmetric encryption key-pair as a child key-pair of the first asymmetric encryption key-pair, the second asymmetric encryption key-pair comprising a second public key and a second private key; and

provide, by the browser on the first computing device, the second public key to the second computing device.

11. The non-transitory, computer-readable medium of claim 9 , wherein the machine-readable instructions, when executed by the processor, further cause the first computing device to at least:

receive, by the browser on the first computing device, a request from the second computing device to encrypt an authentication token and store the authentication token;

encrypt, by the cryptographic coprocessor on the first computing device, the authentication token using the public key to generate an encrypted authentication token; and

store the encrypted authentication token.

12. The non-transitory, computer-readable medium of claim 11 , wherein the machine-readable instructions, when executed by the processor, further cause the first computing device to at least:

receive, by the browser on the first computing device, a request from the second computing device for the authentication token, the request comprising a copy of the key-authorization credential;

access, by the cryptographic coprocessor on the first computing device, the private key using the key-authorization credential;

decrypt, by the cryptographic coprocessor on the first computing device, the encrypted authentication token using the private key to recover the authentication token; and

provide, by the browser on the first computing device, a copy of the authentication token to the second computing device.

13. The non-transitory, computer-readable medium of claim 9 , wherein the cryptographic coprocessor installed on the first computing device complies with a specification for a version of the trusted protection module (TPM) standard.

14. A method implemented with a computing device over a network in data communication with a browser on a client device, the method comprising:

verifying that a cryptographic coprocessor is installed on the client device by evaluating a response from the browser on the client device;

sending a request to the browser on the client device to provision an asymmetric encryption key-pair using the cryptographic coprocessor, wherein the browser on the client device relays the request to the cryptographic coprocessor, the request comprises a key-authorization credential for the asymmetric encryption key-pair, and the asymmetric encryption key-pair comprises a public key and a private key;

receiving, from the browser on the client device, the public key of the asymmetric encryption key-pair and an identity public key for the cryptographic coprocessor; and

storing the public key, key-authorization credential, and the identity public key in association with each other.

15. The method of claim 14 , further comprising in response to a verification that the cryptographic coprocessor is installed on the client device, sending the browser on the request to the client device to provision the asymmetric encryption key-pair using the cryptographic coprocessor.

16. The method of claim 14 , wherein the request to provision the asymmetric encryption key-pair is a first request, the asymmetric encryption key-pair is a first asymmetric encryption key-pair, the public key is a first public key, the private key is a first private key, and the method further comprises:

sending a second request to the browser on the client device to provision a second asymmetric encryption key-pair as a child key-pair of the first asymmetric encryption key-pair using the cryptographic coprocessor installed on the client device, wherein the second asymmetric encryption key-pair comprises a second public key and a second private key;

receiving, from the browser on the client device, the second public key; and

storing the second public key and the identity public key in association with each other.

17. The method of claim 14 , wherein the request to provision the asymmetric encryption key-pair is a first request and the method further comprises:

sending a second request to the browser on the client device to encrypt an authentication token and store the authentication token on the client device, wherein the request comprises a copy of the authentication token.

18. The method of claim 17 , further comprising:

verifying an identity of a user of the client device; and

the second request to encrypt the authentication token and store the authentication token is sent to the browser on the client device in response to a verification of the identity of the user of the client device.

19. The method of claim 18 , further comprising storing an association between the authentication token and the identity of the user.

20. The method of claim 17 , further comprising:

receiving an authentication request from the browser on the client device; and

sending a third request to the browser on the client device for the authentication token, wherein the third request includes a copy of the key-authorization credential.