Webservice security design

[Vecta]

I'm hoping someone here can help me, I'm developing a webservice in c# for a legacy system with a fairly fixed architecture. The way its "security" works is that once an initial username/password pair is validated it returns a session ID (a sequential one) and all subsequent requests just require that ID. I've been looking at ws-security and ws-trust, I can manage a secure transaction on the initial login request but once that is done I'm unsure how to securely manage passing around this session ID, I was thinking of caching the "real" session ID in a hashtable on the server and returning a more secure ID to the client. Is this is good idea or are there better / more standard ways of doing this? Thanks Ric.