A method for relocating an authenticator of a mobile station, MS,, in a communication system, the method comprising: sending a first message for requesting a relocation of an authenticator from a first authenticator to a second authenticator; wherein the first message includes a Media Access Control, MAC, address of the MS and an identifier, ID, information of the first authenticator, sending a second message from the second authenticator to the first authenticator in response to the first message; wherein the second message includes a first hash value for a first authentication parameter used by the MS, a first random parameter, and a second random parameter, the first hash value being generated based on a hash function using the first random parameter and the first authentication parameter, sending a third message from the first authenticator to an authentication, authorization, and accounting, AAA, server; wherein the third message is an AAA request message and includes the first hash value, the first random parameter, an identifier, ID, information of the MS and the ID information of the first authenticator, in the AAA server, determining a validity of the first hash value based on the ID information of the MS, the first random parameter and a second authentication parameter used previously by the MS at the time of authenticating; when the AAA server determines that the first hash value is valid, sending a fourth message from the AAA server to the first authenticator in response to the third message; wherein the fourth message includes the second authentication parameter of the MS, sending a fifth message from the first authenticator to the second authenticator; wherein the fifth message includes a second hash value for the second authentication parameter used by the MS, the second hash value generated based on a hash function using the second random parameter and the second authentication parameter, in the second authenticator, determining a validity of the second hash value based on the first authentication parameter and the second random parameter; when the second authenticator determines that the second hash value is valid, sending a sixth message indicating that the relocation is complete from the second authenticator to the first authenticator in response to the fifth message. sending a first message for requesting a relocation of an authenticator from a first authenticator to a second authenticator; wherein the first message includes a Media Access Control, MAC, address of the MS and an identifier, ID, information of the first authenticator, sending a second message from the second authenticator to the first authenticator in response to the first message; wherein the second message includes a first hash value for a first authentication parameter used by the MS, a first random parameter, and a second random parameter, the first hash value being generated based on a hash function using the first random parameter and the first authentication parameter, sending a third message from the first authenticator to an authentication, authorization, and accounting, AAA, server; wherein the third message is an AAA request message and includes the first hash value, the first random parameter, an identifier, ID, information of the MS and the ID information of the first authenticator, in the AAA server, determining a validity of the first hash value based on the ID information of the MS, the first random parameter and a second authentication parameter used previously by the MS at the time of authenticating; when the AAA server determines that the first hash value is valid, sending a fourth message from the AAA server to the first authenticator in response to the third message; wherein the fourth message includes the second authentication parameter of the MS, sending a fifth message from the first authenticator to the second authenticator; wherein the fifth message includes a second hash value for the second authentication parameter used by the MS, the second hash value generated based on a hash function using the second random parameter and the second authentication parameter, in the second authenticator, determining a validity of the second hash value based on the first authentication parameter and the second random parameter; when the second authenticator determines that the second hash value is valid, sending a sixth message indicating that the relocation is complete from the second authenticator to the first authenticator in response to the fifth message.