I've been working on something related, I called it the Bunny Talk Protocol, named after the module I started writing a few years back.
The protocol allows access to drupal, either retrieving pages or specific elements, using the same token security and access permissions in drupal. For instance you can retrieve a JSON page representation and display it, or call a specific function passing parms, either retreiving JSON or updating data, just as if it were local.
One of the keys to this was the forking drupal instance, where drupal runs in memory and so doesn't need to bootstrap each call.
To see it working, the beta is at https://buuna.dwanta.com. The main page and login pages run on the drupal server in standard drupal mode, but when you get to the "my account" screen, that data (company and network listings) comes through Bunny Talk from a remote server. And then once in the app, those screens and all data come through Bunny Talk from a remote server.
If you find it useful, let me know. I was going to originally release it as "bunny farm", but due to the core hacks involved, it's complicated. I'm on 7.20 at the moment.
The module also includes several other features, including my own "entity" and "bundle" implementations. One of the reasons I created my own implemenations of the entities was to include Bunny Talk, so that entity objects can be local or remote, and the code doesn't know the difference. I also increased the security by moving the data and app off the drupal server.