This might be in danger of being too elementary a question for this community but I'm hoping for expert help:
Assuming that TLS is not enough to protect messages transmitted between a client and a server, what is a good way to establish secure communication between a client and a server? In my case this is between a web server and a mobile app, with typical requests and responses between the two.
I have the following idea: Generate an asymmetric key pair, distribute the public key with the mobile client and keep the private key on the server. When initiating communication with the server from the client I could generate a symmetric key for the session, encrypt the key using the public key, send the encrypted key to the server which would then decrypt the symmetric key using the private asymmetric key, and then continue to decrypt requests and encrypt responses using the symmetric key.
Is this anywhere close to an acceptable solution, what are the nuances I should be aware of to achieve an acceptable solution? What algorithm choices should be made?