A method for establishing mutual authentication between a first software layer and a second software layer of an application on a computing device using a data encryption key (DEK) derived based on a first nonce (RN1) generated by the first software layer and a second nonce (RN2) generated by the second software layer , the method comprising, during an initialization of the application , the steps of: generating, by the first software layer , the first nonce (RN1) and sending the generated first nonce (RN1) to the second software layer ; receiving, by the first software layer , the second nonce (RN2) from the second software layer ; and storing, by the first software layer , encrypted binding information comprising the received second nonce (RN2); the method further comprising, during runtime of the application , the steps of: retrieving, by the first software layer , the binding information stored by the first software layer during the initialization of the application ; decrypting, by the first software layer , the binding information to obtain the second nonce (RN2); receiving, by the first software layer , an encrypted first nonce from the second software layer of the application ; decrypting, by the first software layer , the encrypted first nonce to obtain the first nonce (RN1); deriving, by the first software layer , a data encryption key (DEK) based on the obtained first nonce (RN1) and the obtained second nonce (RN2); and encrypting, by the first software layer , data being sent from the first software layer to the second software layer using the data encryption key (DEK). generating, by the first software layer , the first nonce (RN1) and sending the generated first nonce (RN1) to the second software layer ; receiving, by the first software layer , the second nonce (RN2) from the second software layer ; and storing, by the first software layer , encrypted binding information comprising the received second nonce (RN2); the method further comprising, during runtime of the application , the steps of: retrieving, by the first software layer , the binding information stored by the first software layer during the initialization of the application ; decrypting, by the first software layer , the binding information to obtain the second nonce (RN2); receiving, by the first software layer , an encrypted first nonce from the second software layer of the application ; decrypting, by the first software layer , the encrypted first nonce to obtain the first nonce (RN1); deriving, by the first software layer , a data encryption key (DEK) based on the obtained first nonce (RN1) and the obtained second nonce (RN2); and encrypting, by the first software layer , data being sent from the first software layer to the second software layer using the data encryption key (DEK). retrieving, by the first software layer , the binding information stored by the first software layer during the initialization of the application ; decrypting, by the first software layer , the binding information to obtain the second nonce (RN2); receiving, by the first software layer , an encrypted first nonce from the second software layer of the application ; decrypting, by the first software layer , the encrypted first nonce to obtain the first nonce (RN1); deriving, by the first software layer , a data encryption key (DEK) based on the obtained first nonce (RN1) and the obtained second nonce (RN2); and encrypting, by the first software layer , data being sent from the first software layer to the second software layer using the data encryption key (DEK). <EOS>