如何使用web服务通信验证调用者

I inherited a system that gets data from a webmethod in the form of a dataset. The data is potentially sensitive. The one thing that struck me about this was that some methods had no way of knowing, or checking who the caller was, and others that required an integer number to identify the caller. This integer starts at0 and is sequential and associated with a different company/data set. Obviously not good enough. (it was easy for me to see data I shouldn't have had access to by guessing numbersI inherited a system that gets data from a webm