In my last 2 jobs we used VPN tunnels with the RSA secure ID card (creates a secure connection to the remote host). I do not know the budget you have but you can get details of the protocols used at http://www.rsasecurity.com/. Secure ID cards now come in a key chain variety (keep getting smaller).

Hope that helps,

Cheers,

Duncan