A network sign-on system for use in an access restricted network comprising: a public key infrastructure ("PKI") provider operable to issue digital certificates to mobile communication devices; an authentication server in data communication with an enrolment database, the enrolment database containing records pairing digital user certificates with one or more of user, workstation and network identifiers; at least one workstation configured to access the network, the workstation having a unique workstation identifier associated with it and an authentication driver operating on it; and at least one mobile communication device associated with a user of the network having a unique digital user certificate installed on it which was previously issued to it by the PKI provider, wherein: the authentication server is operable to receive a sign-on request including the digital user certificate of the mobile communication device from the mobile communication device, to authenticate the mobile communication device using the digital user certificate, to look up one or more of a user, workstation and network identifier in the enrolment database contained in a record associated with the digital user certificate, and to transmit a sign-on command to the authentication driver operating on the workstation identified by the workstation identifier; and the authentication driver is operable to, upon receipt of the sign-on command from the authentication server, sign the workstation onto the network through the authentication server, utilising public key encryption with the digital user certificate of the mobile communication device. a public key infrastructure ("PKI") provider operable to issue digital certificates to mobile communication devices; an authentication server in data communication with an enrolment database, the enrolment database containing records pairing digital user certificates with one or more of user, workstation and network identifiers; at least one workstation configured to access the network, the workstation having a unique workstation identifier associated with it and an authentication driver operating on it; and at least one mobile communication device associated with a user of the network having a unique digital user certificate installed on it which was previously issued to it by the PKI provider, wherein: the authentication server is operable to receive a sign-on request including the digital user certificate of the mobile communication device from the mobile communication device, to authenticate the mobile communication device using the digital user certificate, to look up one or more of a user, workstation and network identifier in the enrolment database contained in a record associated with the digital user certificate, and to transmit a sign-on command to the authentication driver operating on the workstation identified by the workstation identifier; and the authentication driver is operable to, upon receipt of the sign-on command from the authentication server, sign the workstation onto the network through the authentication server, utilising public key encryption with the digital user certificate of the mobile communication device. the authentication server is operable to receive a sign-on request including the digital user certificate of the mobile communication device from the mobile communication device, to authenticate the mobile communication device using the digital user certificate, to look up one or more of a user, workstation and network identifier in the enrolment database contained in a record associated with the digital user certificate, and to transmit a sign-on command to the authentication driver operating on the workstation identified by the workstation identifier; and the authentication driver is operable to, upon receipt of the sign-on command from the authentication server, sign the workstation onto the network through the authentication server, utilising public key encryption with the digital user certificate of the mobile communication device.