Systems and methods for extending cryptographic certificates with target-binding information

A first computing device comprising:

• at least one hardware processor;
• and
• one or more non-transitory computer readable storage media containing instructions that, when executed by the at least one hardware processor, cause the first computing device to perform operations comprising:
• maintaining, in data storage, a first plurality of resource-specific asymmetric keypairs that are each uniquely associated with a different protected resource from among a second plurality of protected resources on the first computing device, a first resource-specific asymmetric keypair from among the first plurality being uniquely associated with a first protected resource from among the second plurality;
• engaging with a second computing device in a first authentication flow based on the first resource-specific asymmetric keypair;
• receiving, from the second computing device as part of the first authentication flow, a first public-key certificate that contains first target-binding data that indicates a first specified asymmetric keypair;
• checking whether the first specified asymmetric keypair matches the first resource-specific asymmetric keypair;
• and
• successfully authenticating the second computing device to the first resource-specific asymmetric keypair in response to each of one or more authentication conditions being met in connection with the first authentication flow, the one or more authentication conditions comprising the first specified asymmetric keypair matching the first resource-specific asymmetric keypair.

One or more non-transitory computer readable storage media containing instructions that, when executed by at least one hardware processor of a first computing device, cause the first computing device to perform operations comprising:

• maintaining, in data storage, a first plurality of resource-specific asymmetric keypairs that are each uniquely associated with a different protected resource from among a second plurality of protected resources on the first computing device, a first resource-specific asymmetric keypair from among the first plurality being uniquely associated with a first protected resource from among the second plurality;
• engaging with a second computing device in a first authentication flow based on the first resource-specific asymmetric keypair;
• receiving, from the second computing device as part of the first authentication flow, a first public-key certificate that contains first target-binding data that indicates a first specified asymmetric keypair;
• checking whether the first specified asymmetric keypair matches the first resource-specific asymmetric keypair;
• and
• successfully authenticating the second computing device to the first resource-specific asymmetric keypair in response to each of one or more authentication conditions being met in connection with the first authentication flow, the one or more authentication conditions comprising the first specified asymmetric keypair matching the first resource-specific asymmetric keypair.