this is an incredibly detailed and high-level security project. if you can't figure it out on your own, you're best not trying to implement it. a) most people, especially on the C# server, won't have any direct domain knowledge of how to do it correctly, and b) if done wrong, it can be catastrophic for security issues. it is not just meeting the spec, there are also significant nuances to timing and implementation behavior that can open doors for security holes.