Embodiments of the present disclosure provide method and apparatus for authentication. A method performed by a session management and gateway entity comprises receiving a create session request comprising an identity of a terminal device from a mobile management entity. The method further comprises determining to use a second authentication method rather than a first authentication method. The second authentication method has a higher security than the first authentication method. The method further comprises triggering a procedure of the second authentication method related to an authentication authorization and accounting (AAA) server.