Because of the line-of-sight character of optical wireless communication and a limited field-of-view of optical receivers, the coverage of an access point and the overlapping coverage area of adjacent access points in an optical system are smaller as compared to a RF system. It turns more challenging to support an end point (110) to roam securely in an optical multi-cell wireless communication network. To speed up the derivation of a new pairwise transient key with a new access point during a handover procedure, the end point of this invention comprises a controller (118) that is configured to act as a second supplicant (1181), on behalf of a first supplicant (1186) comprised in a host processor (1185), to communicate with an authenticator to establish a new pairwise transient key for the end point (110) and a candidate access point, and an active pairwise transient key with the currently associated access point is used to secure the communication for new key derivation.