Encrypted Session Token for Silverlight App

Question

I am building a Sivlerlight app that calls methods on a WCF middle-tier application for its data. I don't want the middle-tier to have to lookup the user/pass in the DB for every call, so I want to use an encrypted token created by the server to be passed from the client to the server as evidence that the requestor is valid. I was wondering if someone could help validate what I am thinking:

1. Client app connects to middle-tier service using HTTPS and passes user name and password
2. Server responds with a token string that looks something like this:

The token will most likely be much longer than this, but basically it should be made up of characters that can be valid in the XML (or in CDATA). When decrypted, the token will contain the following:

1. The user ID of the logged in user.
2. Permissions of the logged in user.
3. The time the session should end.
4. The IP address from which the login request was sent.

On subsequent requests, the client will send this token and the server will decrypt it and validate the following before processing the request:

1. The session end time is greater than the current time
2. The IP address matches the sender
3. The permissions are sufficient for the request

Also, there will be a mechanism for refreshing the token on server responses so the session can continue to stretch on.

Here are my questions:

1. Does this seem functionally appropriate? (secure, scalable, etc.)
2. What enryption algorithm should I use? Is there something already in the .NET framework that will work?

Thank you!

Answer 1

The normal ASP.NET security token should be used