A system for supporting an end point to carry out a secure handover from an access point currently associated with the end point to another access point out of a plurality of access points in an optical multi-cell wireless communication network, the system comprising: - a subsystem (500, 510, 510') configured to: - obtain one or more neighbor relationships among the plurality of access points; - select for the end point a candidate access point out of the plurality of access points, other than the currently associated access point, for a secure handover of the end point, in view of the obtained one or more neighbor relationships; and - inform the end point via the currently associated access point about the candidate access point to trigger the end point to start a procedure for pre-establishing a new pairwise transient key between the end point and the candidate access point for the secure handover; - the end point comprising: - an optical transceiver configured to perform optical wireless communication; - a controller configured to: secure an optical wireless communication link with the currently associated access point by using a pairwise transient key to encrypt or decrypt data communicated on the link; trigger the procedure for pre-establishing the new pairwise transient key between the end point and the candidate access point for a secure handover, upon reception of information related to the candidate access point by the optical transceiver; and wherein the procedure is triggered before the handover to the candidate access point actually takes place; and - the plurality of access points, comprising the currently associated access point and the candidate access point, configured to perform optical wireless communication with the end point and to connect with one another via a backbone connection; and wherein the subsystem (500, 510, 510') is either comprised in one or more access points out of the plurality of access points or is connected to the plurality of access points via a backbone connection. - a subsystem (500, 510, 510') configured to: - obtain one or more neighbor relationships among the plurality of access points; - select for the end point a candidate access point out of the plurality of access points, other than the currently associated access point, for a secure handover of the end point, in view of the obtained one or more neighbor relationships; and - inform the end point via the currently associated access point about the candidate access point to trigger the end point to start a procedure for pre-establishing a new pairwise transient key between the end point and the candidate access point for the secure handover; - the end point comprising: - an optical transceiver configured to perform optical wireless communication; - a controller configured to: secure an optical wireless communication link with the currently associated access point by using a pairwise transient key to encrypt or decrypt data communicated on the link; trigger the procedure for pre-establishing the new pairwise transient key between the end point and the candidate access point for a secure handover, upon reception of information related to the candidate access point by the optical transceiver; and wherein the procedure is triggered before the handover to the candidate access point actually takes place; and - the plurality of access points, comprising the currently associated access point and the candidate access point, configured to perform optical wireless communication with the end point and to connect with one another via a backbone connection; and wherein the subsystem (500, 510, 510') is either comprised in one or more access points out of the plurality of access points or is connected to the plurality of access points via a backbone connection. - an optical transceiver configured to perform optical wireless communication; - a controller configured to: secure an optical wireless communication link with the currently associated access point by using a pairwise transient key to encrypt or decrypt data communicated on the link; trigger the procedure for pre-establishing the new pairwise transient key between the end point and the candidate access point for a secure handover, upon reception of information related to the candidate access point by the optical transceiver; and wherein the procedure is triggered before the handover to the candidate access point actually takes place; and - the plurality of access points, comprising the currently associated access point and the candidate access point, configured to perform optical wireless communication with the end point and to connect with one another via a backbone connection;