A method for authentication of a terminal and a user identity module by a service provider, comprising: transmitting (300, 305), to the terminal, a notification message to be transmitted to the user identity module; receiving, from the terminal, a first response message corresponding to the notification message, the first response message including a first identifier as an ID of the terminal, a second ID as an ID of the user identity module, a first digital signature as a digital signature of the terminal, and a second digital signature as a digital signature of the user identity module; verifying each of the first digital signature and the second digital signature based on a public key corresponding to each of the first ID and the second ID; and transmitting, to the terminal and to the user identity module an authentication result message including a verification result for each of the first digital signature and the second digital signature, and information about a time when the service provider transmits the authentication result message, wherein the authentication result message includes a session key to be shared between the service provider and the user identity module based on the verification result for each of the first digital signature and the second digital signature, and wherein the verification result for each of the first digital signature and the second digital signature and the information about the time are used for authentication between the terminal and the user identity module, and the session key is obtained by the user identity module based on an result of the authentication between the terminal and the user identity module.. transmitting (300, 305), to the terminal, a notification message to be transmitted to the user identity module; receiving, from the terminal, a first response message corresponding to the notification message, the first response message including a first identifier as an ID of the terminal, a second ID as an ID of the user identity module, a first digital signature as a digital signature of the terminal, and a second digital signature as a digital signature of the user identity module; verifying each of the first digital signature and the second digital signature based on a public key corresponding to each of the first ID and the second ID; and transmitting, to the terminal and to the user identity module an authentication result message including a verification result for each of the first digital signature and the second digital signature, and information about a time when the service provider transmits the authentication result message, wherein the authentication result message includes a session key to be shared between the service provider and the user identity module based on the verification result for each of the first digital signature and the second digital signature, and wherein the verification result for each of the first digital signature and the second digital signature and the information about the time are used for authentication between the terminal and the user identity module, and the session key is obtained by the user identity module based on an result of the authentication between the terminal and the user identity module..