A method performed by a first intermediary authentication node, IAN, in a wireless network, the method comprising: receiving a first authentication request message for requesting authentication of a mobile station, MS, from a second IAN; transmitting, to an authentication server, a second authentication request message which is generated by including an ID of the first IAN into the first authentication request message, wherein the first and the second authentication request messages include the ID of the MS, an ID of a base station to which the MS belongs, an ID of the second IAN, an ID of the authentication server, and a MS key ID; receiving, from the authentication server, a first session security context which is generated according to that authentication for the MS at the authentication server is successful, wherein the first session security context includes the ID of the MS, a key ID and a first session key, wherein the first session key is mapped to the ID of the MS and the key ID at the first IAN; transmitting a second session security context to the second IAN, wherein the second session security context includes the ID of the MS, the key ID, and a second session key which is mapped to the ID of the MS and the key ID, wherein the second session key is generated based on the first session key; receiving, from a third IAN, a third authentication request message for requesting the authentication of the MS for a handover, wherein the third authentication request message includes an ID of the third IAN, and an ID of a target base station to which the MS is to be handed over; and inspecting the second session security context to identify that an identifier, ID, of the MS and a key ID further included in the third authentication request message are identical to the ID of the MS and a key ID mapped to the first session key at the first IAN and generating a third session key for the third IAN based on the first session key; transmitting, to the third IAN, a third session security context, wherein the third session security context includes the third session key, the ID of the first IAN, the ID of the third IAN, the ID of the authentication server, and the ID of the target base station to which the MS is to be handed over; wherein the first and the second session security contexts include at least one parameter related to the authentication for the MS, wherein the third session security context includes at least one parameter related to the authentication of the MS at the target base station to which the MS is to be handed over. receiving a first authentication request message for requesting authentication of a mobile station, MS, from a second IAN; transmitting, to an authentication server, a second authentication request message which is generated by including an ID of the first IAN into the first authentication request message, wherein the first and the second authentication request messages include the ID of the MS, an ID of a base station to which the MS belongs, an ID of the second IAN, an ID of the authentication server, and a MS key ID; receiving, from the authentication server, a first session security context which is generated according to that authentication for the MS at the authentication server is successful, wherein the first session security context includes the ID of the MS, a key ID and a first session key, wherein the first session key is mapped to the ID of the MS and the key ID at the first IAN; transmitting a second session security context to the second IAN, wherein the second session security context includes the ID of the MS, the key ID, and a second session key which is mapped to the ID of the MS and the key ID, wherein the second session key is generated based on the first session key; receiving, from a third IAN, a third authentication request message for requesting the authentication of the MS for a handover, wherein the third authentication request message includes an ID of the third IAN, and an ID of a target base station to which the MS is to be handed over; and inspecting the second session security context to identify that an identifier, ID, of the MS and a key ID further included in the third authentication request message are identical to the ID of the MS and a key ID mapped to the first session key at the first IAN and generating a third session key for the third IAN based on the first session key; transmitting, to the third IAN, a third session security context, wherein the third session security context includes the third session key, the ID of the first IAN, the ID of the third IAN, the ID of the authentication server, and the ID of the target base station to which the MS is to be handed over; wherein the first and the second session security contexts include at least one parameter related to the authentication for the MS, wherein the third session security context includes at least one parameter related to the authentication of the MS at the target base station to which the MS is to be handed over.