Cryptographic binding of native application and external browser sessions
Systems and methods are provided for receiving information associated with a final single sign-on page from a native browser, extracting a public key from the information associated with the final single sign-on page, generating a single sign-on token to bind a browser session and a native application session, associating the single sign-on token with the public key extracted from the information associated with the final single sign-on page, and encrypting the single sign-on token with the public key to bind the browser session and the native application session.
1. A computer-implemented method comprising:
receiving, at a server, information associated with a final single sign-on page from a native browser;
extracting, by the server, a public key from the information associated with the final single sign-on page from an HTTP cookie associated with the final single sign-on page;
determining whether the public key matches an active VPN authentication key;
generating, by the server, a single sign-on token to bind a browser session and a native application session;
associating, by the server, the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and
encrypting, by the server, the single sign-on token with the public key to bind the browser session and the native application session.
2. The computer-implemented method of claim 1 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.
3. The computer-implemented method of claim 1 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.
4. The computer-implemented method of claim 1 , wherein the encrypting of the single sign-on token is based on an encryption scheme including at least one of Elliptic Curve Diffie-Hellman (ECDH), Elliptic Curve Integrated Encryption Scheme (ECIES), and Hybrid Public Key Encryption (HPKE).
5. The computer-implemented method of claim 1 , wherein the encrypting of the single sign-on token includes encrypting additional metadata associated with the single sign-on token.
6. A system comprising:
one or more processors; and
at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:
receive information associated with a final single sign-on page from a native browser;
extract a public key from the information associated with the final single sign-on page from an HTTP cookie associated with the final single sign-on page;
determine whether the public key matches an active VPN authentication key;
generate a single sign-on token to bind a browser session and a native application session;
associate the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and
encrypt the single sign-on token with the public key to bind the browser session and the native application session.
7. The system of claim 6 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.
8. The system of claim 6 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.
9. The system of claim 6 , wherein the encrypting of the single sign-on token is based on an encryption scheme including at least one of Elliptic Curve Diffie-Hellman (ECDH), Elliptic Curve Integrated Encryption Scheme (ECIES), and Hybrid Public Key Encryption (HPKE).
10. The system of claim 6 , wherein the encrypting of the single sign-on token includes encrypting additional metadata associated with the single sign-on token.
11. A non-transitory computer-readable storage medium comprising:
instructions stored on the non-transitory computer-readable storage medium, the instructions, when executed by one or more processors, cause the one or more processors to:
receive information associated with a final single sign-on page from a native browser;
extract a public key from the information associated with the final single sign-on page from an HTTP cookie associated with the final single sign-on page;
determine whether the public key matches an active VPN authentication key;
generate a single sign-on token to bind a browser session and a native application session;
associate the single sign-on token with the public key extracted from the information associated with the final single sign-on page; and
encrypt the single sign-on token with the public key to bind the browser session and the native application session.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the single sign-on token is a Security Assertion Markup Language authentication token.
13. The non-transitory computer-readable storage medium of claim 11 , wherein the browser session is an external transport layer security browser session and the native application session is a native application transport layer security session.
14. The non-transitory computer-readable storage medium of claim 11 , wherein the encrypting of the single sign-on token is based on an encryption scheme including at least one of Elliptic Curve Diffie-Hellman (ECDH), Elliptic Curve Integrated Encryption Scheme (ECIES), and Hybrid Public Key Encryption (HPKE).
15. The non-transitory computer-readable storage medium of claim 11 , wherein the encrypting of the single sign-on token includes encrypting additional metadata associated with the single sign-on token.