Authentication service for third party applications

A system, comprising:

• an authentication device configured to:
• receive, from an application executing at a mobile device, a first request for an authentication token, wherein the first request includes an application identifier that is assigned to the application and a destination network device, and an encrypted session identifier (SID that uniquely identifies a network connection session originated from the application executing at the mobile device and with the destination network device, and wherein the SID is encrypted using a first public key of a first public/private key pair assigned to an owner of the destination network device,
• retrieve, from a stored data structure using the application identifier, a first private key of the first public/private key pair assigned to the owner of the destination network device, and a second public key of a second public/private key pair assigned to the application identifier,
• decrypt, using the first private key of the first public/private key pair, the encrypted SID to produce a decrypted SID,
• determine a hash value of certain data, wherein the certain data includes the application identifier and session information associated with the network connection session,
• encrypt, using the second public key of the second public/private key pair assigned to the application identifier, the determined hash value and the decrypted SID to produce the requested authentication token, and
• send a message including the application identifier and the requested authentication token to the application at the mobile device.

A non-transitory storage medium storing instructions executable by a computational device, wherein the instructions comprise instructions to:

• receive, at an authentication device from an application at a mobile device, a request for an authentication token, wherein the request for the authentication token includes an application identifier that is assigned to the application and a destination network device, and an encrypted session identifier (SID that uniquely identifies a network connection session originated from the application executing at the mobile device and with the destination network device, and wherein the SID is encrypted using a first public key of a first public/private key pair assigned to an owner of the destination network device;
• retrieve, from a stored data structure using the application identifier, a first private key of the first public/private key pair assigned to the owner of the destination network device, and a second public key of a second public/private key pair assigned to the application identifier;
• decrypt, using the first private key of the first public/private key pair, the encrypted SID to produce a decrypted SID;
• determine a hash value of certain data, wherein the certain data includes the application identifier and session information associated with the network connection session;
• encrypt, using the second public key of the second public/private key pair assigned to the application identifier, the determined hash value and the decrypted SID to produce the requested authentication token;
• and
• cause a message including the application identifier and the requested authentication token to be sent to the application at the mobile device.