Browser login sessions via non-extractable asymmetric keys

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of a computing device, cause the one or more processors to perform a method comprising:

• receiving, by the computing device, a first request to log on to a first application;
• generating, by the computing device, a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application;
• storing, by the computing device, the first public-private key pair on a local data store for the computing device;
• sending, by the computing device, a second request to authorize the first public key, wherein the second request comprises the first public key;
• generating, by the computing device, a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with a server computer;
• receiving, by the computing device, credential information;
• sending, by the computing device, an authentication request including the credential information, the first public key and the second public key, to the server computer;
• receiving, by the computing device from the server computer, a server token, wherein the server token is generated based on the second public key;
• storing, by the computing device, the received server token in a second local data store;
• sending, by the computing device, a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key;
• after sending the third request, receiving, by the computing device from the server computer, a first application token;
• and
• after receiving the first application token, authenticating, by the computing device, the first request to log on to the first application.

A computing device, comprising:

• a memory;
• and
• one or more processors configured to:
• receive a first request to log on to a first application;
• generate a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application;
• store the first public-private key pair on a local data store for the computing device;
• send a second request to authorize the first public key, wherein the second request comprises the first public key;
• generate a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with a server computer;
• receive credential information;
• send an authentication request including the credential information, the first public key and the second public key, to the server computer;
• receive a server token, wherein the server token is generated based on the second public key;
• store the received server token in a second local data store;
• send a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key;
• after sending the third request, receive from the server computer, a first application token;
• and
• after receiving the first application token, authenticate the first request to log on to the first application.