Client-side security key generation

A computer system comprising:

• one or more hardware processors;
• a memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
• receive an initial request to access an application server by from an application executing on a client device, the application including a security component comprising security code that operates on at least one parameter value;
• in response to the initial request, providing the application one or more parameter values comprising a first parameter from which the security component can generate a secret cryptographic key at the client device by executing the security code by processing the first parameter with other data available at the client device;
• receive a security key used to sign a signed request by the application to the application server, the security key comprising data associated with the signed request that is encrypted using the secret cryptographic key;
• check if the security key is valid by using the secret cryptographic key to decrypt the security key and, after decrypting, analyzing the security key to determine whether the security key contains data collected at the client device that does not match a pattern of data collected when the request is generated by malware executing on the client device;
• in response to determining that the security key is valid, cause processing of the request by the application server.