Proof of possession for web browser cookie based security tokens

摘要

In one embodiment, a user device 110 may access a network service 122 using a secure cookie 300. A high trust process may create an authentication proof 360 using a secure key. The high trust process may provide a browsing token 310 and the authentication proof 360 to a low trust process to send to an authentication service 124.

主权项

1. A machine-implemented method, comprising:
sending a login credential to an authentication service for a network service from a system context process executing at an operating system level administrative privilege of a client device; receiving a browsing token and a secure key from the authentication service in the system context process; storing the secure key in a system context of a memory of the client device limiting access to the secure key to the operating system level administrative privilege; creating an authentication proof by creating a time sensitive signature of a browsing token in the system context of the client device using the secure key; and providing the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device to send to the authentication service to access the network service.