The invention provides an external in-line device (“Subnet Box”) placed between a network and an access point to achieve secure Wi-Fi communications without needing to modify the access point. The Subnet Box comprises an embedded token and will authenticate users based on pre-stored access rights. In at least one embodiment of the invention, the Subnet Box comprises: a first communications port for intercepting data packets communicated to and from a wired communications network; a second communications port for intercepting data packets communicated to and from a wireless access point, wherein the wireless access point is an edge device of the wired communications network; a database comprising a number of serial numbers each associated with a client token and a secret cryptographic key; and a processor for determining whether a computing device having a client token can access the wired communications network via the wireless access point. The processor establishes a secure tunnel between the computing device and the first communications port.
1. A method of facilitating authentication and security at an edge of a network, the method permitting both authorized and unauthorized clients to simultaneously connect to a same access point, the method not requiring physical modification of the access point, the method comprising the steps of:
interposing an apparatus between a network and a wireless network access point, the network access point not requiring modification;
receiving, at the apparatus and from a wireless client within a local area network, a packet comprising an packet type indicating an unauthorized wireless client, wherein the local area network is connected to the access point;
determining a final destination for the packet;
determining if a pass-through mode of the apparatus is enabled;
passing the packet from the wireless client to the final destination if pass-through mode is enabled; and
denying the packet if pass-through mode is not enabled.
2. The method of claim 1 , further comprising the step of determining whether the final destination is Koolspan-enabled.
3. The method of claim 2 , further comprising the step of encrypting the packet encrypting the packet if the final destination is Koolspan-enabled.
4. The method of claim 3 , wherein the packet is encrypted using a AES Session Key associated with the final destination.