A method of securely connecting a wireless client device to a wireless LAN access point, wirelessly connected to the wireless client device, using a third party authentication server coupled to the wireless LAN access point, wherein: i) the wireless client device and the authentication server both have wireless client device shared secret data (SSDa); ii) said wireless client device shared secret data (SSDa) is stored on a removable module (120, 1420) inserted into said wireless client device or into a proxy device connected to said wireless client device; iii)the wireless LAN access point and the authentication server both have wireless LAN access point shared secret data (SSDb); and iv) said wireless LAN access point shared secret data (SSDb) is stored on a removable module inserted into said wireless LAN access point or into a proxy device (180, 1490) connected to said wireless LAN access point; the method comprising: receiving a request from the wireless client device at the authentication server; the authentication server and the wireless client device both generating a wireless client device key (K_A) using the wireless client device shared secret data in response to a wireless client device random number (RANDa) sent from the authentication server to the wireless client device; the authentication server and the wireless LAN access point both generating a wireless LAN access point key (K_B) using the wireless LAN access point shared secret data in response to a wireless LAN access point random number (RANDb) sent from the authentication server to the wireless LAN access point; the authentication server securely forwarding to the wireless LAN access point and the wireless client device a common key (K_AB) using the wireless LAN access point and wireless client device keys (K_B, K_A). i) the wireless client device and the authentication server both have wireless client device shared secret data (SSDa); ii) said wireless client device shared secret data (SSDa) is stored on a removable module (120, 1420) inserted into said wireless client device or into a proxy device connected to said wireless client device; iii)the wireless LAN access point and the authentication server both have wireless LAN access point shared secret data (SSDb); and iv) said wireless LAN access point shared secret data (SSDb) is stored on a removable module inserted into said wireless LAN access point or into a proxy device (180, 1490) connected to said wireless LAN access point; receiving a request from the wireless client device at the authentication server; the authentication server and the wireless client device both generating a wireless client device key (K_A) using the wireless client device shared secret data in response to a wireless client device random number (RANDa) sent from the authentication server to the wireless client device; the authentication server and the wireless LAN access point both generating a wireless LAN access point key (K_B) using the wireless LAN access point shared secret data in response to a wireless LAN access point random number (RANDb) sent from the authentication server to the wireless LAN access point; the authentication server securely forwarding to the wireless LAN access point and the wireless client device a common key (K_AB) using the wireless LAN access point and wireless client device keys (K_B, K_A).