A roaming authentication method for a GSM system is disclosed. The method sends an IMSI of a user end to a visitor end, generates a challenge code, and sends the IMSI and the challenge code to a home end. The method further generates a random code, a signature code and a communication key and combines them into an authentication data. The method further generates and sends a response code to the visitor end. The user end generates and sends the authentication signature code to the visitor end for authentication purposes. In another embodiment, the visitor end sends one more challenge code to the home end. The home end generates an authentication key that is stored in the visitor end and used to generate an authentication code. The authentication code is sent to the use end which generates and sends an authentication signature code to the visitor end for authentication purposes.