A method (300) of authentication and authorization of cognitive radio devices comprises generating a registration request message (S320); sending the registration request to a spectrum manager;receiving a registration response message from the spectrum manager (S330); generating an authorization request message (S360); upon receiving of an authorization response message, generating a verification response message (S370); and sending the verification response message to the cognitive radio device to be authenticated, such that the cognitive radio device is authenticated and authorized to communicate on channels designated in the verification response message (S380).