A method for a wireless router assisted security handoff in a multi-hop communications network comprising: at a mobile station: selecting a wireless router which is a first hop to an access point for assisting in a secure handoff; retrieving a sequence number of the wireless router and an access point media access control address of the access point from a hello message received from the wireless router; generating a pairwise transient key using the SN and the AA; sending a first re-association message including a re-association request from the mobile station to the wireless router; at the wireless router: tunneling the first re-association message securely to the access point; at the access point: receiving the first re-association message from the wireless router; generating the pairwise transient key using the SN and the AA; validating a message integrity of the first re-association message using the PTK; generating a second re-association message including a re-association response/reply using the PTK; sending the second re-association message to the wireless router; at the wireless router: tunneling the second re-association message securely to the mobile station; and at the mobile station: validating a message integrity of the second re-association message using the PTK; and establishing communications between the mobile station and the access point. at a mobile station: selecting a wireless router which is a first hop to an access point for assisting in a secure handoff; retrieving a sequence number of the wireless router and an access point media access control address of the access point from a hello message received from the wireless router; generating a pairwise transient key using the SN and the AA; sending a first re-association message including a re-association request from the mobile station to the wireless router; selecting a wireless router which is a first hop to an access point for assisting in a secure handoff; retrieving a sequence number of the wireless router and an access point media access control address of the access point from a hello message received from the wireless router; generating a pairwise transient key using the SN and the AA; sending a first re-association message including a re-association request from the mobile station to the wireless router; at the wireless router: tunneling the first re-association message securely to the access point; tunneling the first re-association message securely to the access point; at the access point: receiving the first re-association message from the wireless router; generating the pairwise transient key using the SN and the AA; validating a message integrity of the first re-association message using the PTK; generating a second re-association message including a re-association response/reply using the PTK; sending the second re-association message to the wireless router; receiving the first re-association message from the wireless router; generating the pairwise transient key using the SN and the AA; validating a message integrity of the first re-association message using the PTK; generating a second re-association message including a re-association response/reply using the PTK; sending the second re-association message to the wireless router; at the wireless router: tunneling the second re-association message securely to the mobile station; and tunneling the second re-association message securely to the mobile station; and at the mobile station: validating a message integrity of the second re-association message using the PTK; and establishing communications between the mobile station and the access point. validating a message integrity of the second re-association message using the PTK; and establishing communications between the mobile station and the access point.