An access system for restricting access to a wireless network for a mobile device requesting access to the wireless network, wherein the access system comprises: - a mobile device, requesting access to the wireless network and wherein the mobile device comprises: o An internal storage for storing an identification set of the mobile device's user; ∘ A message generator which is adapted for receiving a user key from a key server and which is further adapted for generating a reference message based on applying the received user key to the identification set and which is adapted for sending the reference message to an intermediate node via a second communication channel, being a short range communication channel, wherein a first communication channel, being a wireless communication channel, and the second communication channel are different communication channels; - the intermediate node which comprises: ∘ A first unit for receiving the identification set from the mobile device via the first communication channel, ∘ A second unit which is adapted for receiving the reference message via the second communication channel; ∘ A third interface to the key server, wherein the intermediate node is adapted to receive an operator key from the key server; ∘ A processor which is adapted to apply the received operator key to the received reference message in order to generate a validation result; and ∘ A comparator which is adapted to compare the validation result with the received identification set and in case of identity: the first unit is adapted to proceed with an authentication procedure for accessing the wireless network, using the identification set; - the key server, which is provided and operated by a third party different of an operator's server of the wireless network and which comprises a key pair generation module for generating a key pair, comprising the user key and the bijectively associated operator key, and for sending the user key to the mobile device and for sending the operator key to the intermediate node. - a mobile device, requesting access to the wireless network and wherein the mobile device comprises: o An internal storage for storing an identification set of the mobile device's user; ∘ A message generator which is adapted for receiving a user key from a key server and which is further adapted for generating a reference message based on applying the received user key to the identification set and which is adapted for sending the reference message to an intermediate node via a second communication channel, being a short range communication channel, wherein a first communication channel, being a wireless communication channel, and the second communication channel are different communication channels; o An internal storage for storing an identification set of the mobile device's user; ∘ A message generator which is adapted for receiving a user key from a key server and which is further adapted for generating a reference message based on applying the received user key to the identification set and which is adapted for sending the reference message to an intermediate node via a second communication channel, being a short range communication channel, wherein a first communication channel, being a wireless communication channel, and the second communication channel are different communication channels; - the intermediate node which comprises: ∘ A first unit for receiving the identification set from the mobile device via the first communication channel, ∘ A second unit which is adapted for receiving the reference message via the second communication channel; ∘ A third interface to the key server, wherein the intermediate node is adapted to receive an operator key from the key server; ∘ A processor which is adapted to apply the received operator key to the received reference message in order to generate a validation result; and ∘ A comparator which is adapted to compare the validation result with the received identification set and in case of identity: the first unit is adapted to proceed with an authentication procedure for accessing the wireless network, using the identification set; ∘ A first unit for receiving the identification set from the mobile device via the first communication channel, ∘ A second unit which is adapted for receiving the reference message via the second communication channel; ∘ A third interface to the key server, wherein the intermediate node is adapted to receive an operator key from the key server; ∘ A processor which is adapted to apply the received operator key to the received reference message in order to generate a validation result; and ∘ A comparator which is adapted to compare the validation result with the received identification set and in case of identity: the first unit is adapted to proceed with an authentication procedure for accessing the wireless network, using the identification set; - the key server, which is provided and operated by a third party different of an operator's server of the wireless network and which comprises a key pair generation module for generating a key pair, comprising the user key and the bijectively associated operator key, and for sending the user key to the mobile device and for sending the operator key to the intermediate node.