A method of authenticating a user terminal with an access node providing restricted access to a communication network, comprising: the user terminal transmitting a request for an authentication token to a network node, the request comprising a network identity for a user of the user terminal; the network node verifying the identity of the user using the network identity (S416, S418), and transmitting an authentication token to the user terminal; the user terminal deriving information from the authentication token and providing the information to the access node; and the access node authenticating the information and removing the restricted access such that the communication network can be accessed by the user terminal, wherein the information derived from the authentication token is login information; the network node is a trusted network node that generates the authentication token; and the request for the authentication token, and the authentication token, are transmitted (S414, S424) via an unrestricted channel on the access node, and wherein the method further comprises the steps of, prior to transmitting the request for an authentication token; the user terminal reading an identity of the access node and transmitting the access node identity to the trusted network node via the unrestricted channel on the access node; the method characterised by: the trusted network node determining whether an agreement exists with the identified access node (S404, S406), determining whether the user can pay for access to the communication network via the access node using credit previously purchased from the trusted network node operator and, in the case that an agreement exists and the user can pay for access to the communication network via the access node using credit previously purchased from the trusted network node operator, transmitting a notification message to the user terminal indicating that the user can pay for access to the communication network via the access node using the credit previously purchased from the trusted network node operator. the user terminal transmitting a request for an authentication token to a network node, the request comprising a network identity for a user of the user terminal; the network node verifying the identity of the user using the network identity (S416, S418), and transmitting an authentication token to the user terminal; the user terminal deriving information from the authentication token and providing the information to the access node; and the access node authenticating the information and removing the restricted access such that the communication network can be accessed by the user terminal, wherein the information derived from the authentication token is login information; the network node is a trusted network node that generates the authentication token; and the request for the authentication token, and the authentication token, are transmitted (S414, S424) via an unrestricted channel on the access node, and wherein the method further comprises the steps of, prior to transmitting the request for an authentication token; the user terminal reading an identity of the access node and transmitting the access node identity to the trusted network node via the unrestricted channel on the access node; the method characterised by: the trusted network node determining whether an agreement exists with the identified access node (S404, S406), determining whether the user can pay for access to the communication network via the access node using credit previously purchased from the trusted network node operator and, in the case that an agreement exists and the user can pay for access to the communication network via the access node using credit previously purchased from the trusted network node operator, transmitting a notification message to the user terminal indicating that the user can pay for access to the communication network via the access node using the credit previously purchased from the trusted network node operator.