Patent ID: 8745390

Claim:
A computer-implemented method for establishing mutual authentication and cryptographic key exchange for communications between service applications on user computing devices, comprising: obtaining, by a first service application on a user computing device, a session key and session key parameters, the session key parameters being usable by one or more computing devices to provide the session key; creating, by the first service application on the user computing device, a pasteboard on the computing device comprising a pasteboard name, wherein the pasteboard is accessible to read and post information by any service application on the computing device possessing the pasteboard name; generating, by the first service application on the user computing device, a random challenge; determining, by the first service application on the user computing device, one or more outputs of session key functions with the random challenge as input; posting, by the first service application on the user computing device, the one or more outputs of the session key functions to the pasteboard; launching, by the first service application on the user computing device, a second service application on the computing device, wherein the second service application is an application on the computing device, is managed by the one or more computing devices, and is trusted by a user of the computing device to collect user credentials; transmitting, by the first service application on the user computing device, the session key parameters and the pasteboard name to the second service application, wherein the second service application requests authentication credentials from the user of the computing device to initiate an authentication session with the one or more computing devices; receiving, by the one or more computing devices, a session key retrieval request from the second service application on the computing device; verifying, by the one or more computing devices, that the user has initiated the authentication session; providing, by the one or more computing devices, the session key to the second service application on the computing device, wherein the second service application verifies the one or more outputs of the session key functions on the pasteboard and solves for the random challenge, wherein the second service application calculates one or more expected values of the session key functions based at least in part on the random challenge, and wherein the second service application posts one or more outputs of the session function to the pasteboard with the one or more expected values as input; verifying, by the first service application on the user computing device, the one or more outputs posted to the pasteboard by the second service application; and communicating, by the first service application on the user computing device, with the second service application on the computing device.