Wireless security system and method

A method for providing private sidestream transmissions between a first and second client in a wireless network generally includes sending a location discovery request from a first client to an access point and receiving a location discovery response from the access point. The response includes a ticket encrypted with a session key of the second client and containing a sidestream key. The method further includes sending a direct communication request from the first client to the second client. The request includes the ticket and an authenticator encrypted with the sidestream key. A direct communication response including an updated authenticator is received from the second client. A method and apparatus for secure context transfer during client roaming are also disclosed.