Using Device-Bound Credentials for Enhanced Security of Authentication in Native Applications

A computer program product comprising a computer readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, and wherein the program code is readable and executable by a processor to perform a method comprising:

• receiving, from a native application on a device, an initial authorization grant, a public key of a private/public key pair generated on the device, and an attestation of authenticity of the native application;
• receiving, from the native application on the device, a refresh token and a digital signature of the refresh token that is created with the private key, wherein the authorization server recognizes the refresh token only if the refresh token is verified with the public key that has been previously registered;
• validating the digital signature of the refresh token;
• and
• in response to validating the refresh token from the native application on the device, transmitting a new access token and a new refresh token from the authorization server to the native application on the device, wherein the new access token allows the native application on the device to access the computer resource.

A computer system comprising one or more processors, one or more computer readable memories, and one or more computer readable non-transitory storage mediums, and program instructions stored on at least one of the one or more computer readable non-transitory storage mediums for execution by at least one of the one or more processors via at least one of the one or more computer readable memories, the stored program instructions executed to perform a method comprising:

• receiving, from a native application on a device, an initial authorization grant, a public key of a private/public key pair generated on the device, and an attestation of authenticity of the native application;
• receiving, from the native application on the device, a refresh token and a digital signature of the refresh token that is created with the private key, wherein the authorization server recognizes the refresh token only if the refresh token is verified with the public key that has been previously registered;
• validating the digital signature of the refresh token;
• and
• in response to validating the refresh token from the native application on the device, transmitting a new access token and a new refresh token from the authorization server to the native application on the device, wherein the new access token allows the native application on the device to access the computer resource.