A method of authenticating a station in a communications system including a first access point, a second access point, a mobility domain controller (506, 606, 706, 806, 907), and an authentication server (501, 601, 701,801, 901), the method comprising: authenticating the station with the first access point and the second access point, wherein authenticating the station with the first access point comprises: receiving at the mobility domain controller (506, 606, 706, 806, 907), an extensible authentication protocol reauthentication response (MSK1, DSRK1, rRK1, rMSK1) for the station from the authentication server (501, 601, 701,801, 901), the extensible authentication protocol reauthentication response (MSK1, DSRK1, rRK1, rMSK1) including a reauthentication master session key; transmitting, at the mobility domain controller (506, 606, 706, 806, 907), a second extensible authentication protocol reauthentication response to the first access point based on the reauthentication master session key; and wherein authenticating the station with the second access point comprises: generating, at the mobility domain controller (506, 606, 706, 806, 907), a fast basic service set transition second level pairwise master key for the second access point based on the reauthentication master session key; generating, at the mobility domain controller (506, 606, 706, 806, 907), a key message to include the fast basic service set transition second level pairwise master key for the second access point; and transmitting, at the mobility domain controller (506, 606, 706, 806, 907), the key message to the second access point. receiving at the mobility domain controller (506, 606, 706, 806, 907), an extensible authentication protocol reauthentication response (MSK1, DSRK1, rRK1, rMSK1) for the station from the authentication server (501, 601, 701,801, 901), the extensible authentication protocol reauthentication response (MSK1, DSRK1, rRK1, rMSK1) including a reauthentication master session key; transmitting, at the mobility domain controller (506, 606, 706, 806, 907), a second extensible authentication protocol reauthentication response to the first access point based on the reauthentication master session key; and wherein authenticating the station with the second access point comprises: generating, at the mobility domain controller (506, 606, 706, 806, 907), a fast basic service set transition second level pairwise master key for the second access point based on the reauthentication master session key; generating, at the mobility domain controller (506, 606, 706, 806, 907), a key message to include the fast basic service set transition second level pairwise master key for the second access point; and transmitting, at the mobility domain controller (506, 606, 706, 806, 907), the key message to the second access point. generating, at the mobility domain controller (506, 606, 706, 806, 907), a fast basic service set transition second level pairwise master key for the second access point based on the reauthentication master session key; generating, at the mobility domain controller (506, 606, 706, 806, 907), a key message to include the fast basic service set transition second level pairwise master key for the second access point; and transmitting, at the mobility domain controller (506, 606, 706, 806, 907), the key message to the second access point.