What about something like this:
- Have the server send a nonce - 'hash-signed' by server's secret key and timestamp etc.,
- Have a hash based on some internal datastructures + client key and send it to server periodically
- Do this over SSL
And @iamkrillin beat me to it...but I am still gonna post it :)