A method for distributed security control in a communication network system, said communication network comprising a network controller, one or more second network devices (31, 32), and one or more user equipments (11, 12, 13, 14, 15, 16), the method comprising the steps of: c. said network controller dynamically establishing a network security control mechanism, wherein said network security control mechanism comprises network security checking rules and network security checking parameters, by acquiring one or more predetermined address pair combinations of network layer addresses and data link layer addresses by detecting address allocating message sent from address allocating servers to said user equipments (11, 12, 13, 14, 15, 16), wherein, an address allocating server comprises DHCP server, said address allocating message comprises a DHCP ACK message, said communication network system comprises a centralized wireless network, said network controller comprises an access controller, said one or more second network devices (31, 32) comprises one or more wireless termination devices, and said wireless termination device allows said one or more user equipments (11, 12, 13, 14, 15, 16) to access, and by detecting, by said access controller, DHCP ACK messages sent from said DHCP servers to said user equipments (11, 12, 13, 14, 15, 16), said one or more predetermined address pair combinations of network layer addresses and data link layer addresses; dynamically changing a security checking rule and a network security checking parameter for checking the validity of the data package from said user equipment on said one or more second network devices (31, 32), said network security checking parameter comprises said at least one address pair combination of network layer address and data link layer address; d. said access controller of said network controller sending, via a message of a CAPWAP protocol, said network security control mechanism to one or more wireless termination devices; e. said one or more second network devices (31, 32) checking the validity of said data package from said user equipment according to said network security control mechanism, and discarding said data package if said data package is not in accord with said network security control mechanism. c. said network controller dynamically establishing a network security control mechanism, wherein said network security control mechanism comprises network security checking rules and network security checking parameters, by acquiring one or more predetermined address pair combinations of network layer addresses and data link layer addresses by detecting address allocating message sent from address allocating servers to said user equipments (11, 12, 13, 14, 15, 16), wherein, an address allocating server comprises DHCP server, said address allocating message comprises a DHCP ACK message, said communication network system comprises a centralized wireless network, said network controller comprises an access controller, said one or more second network devices (31, 32) comprises one or more wireless termination devices, and said wireless termination device allows said one or more user equipments (11, 12, 13, 14, 15, 16) to access, and by detecting, by said access controller, DHCP ACK messages sent from said DHCP servers to said user equipments (11, 12, 13, 14, 15, 16), said one or more predetermined address pair combinations of network layer addresses and data link layer addresses; dynamically changing a security checking rule and a network security checking parameter for checking the validity of the data package from said user equipment on said one or more second network devices (31, 32), said network security checking parameter comprises said at least one address pair combination of network layer address and data link layer address; d. said access controller of said network controller sending, via a message of a CAPWAP protocol, said network security control mechanism to one or more wireless termination devices; e. said one or more second network devices (31, 32) checking the validity of said data package from said user equipment according to said network security control mechanism, and discarding said data package if said data package is not in accord with said network security control mechanism.