Safety is essential to the interaction process between client and application server in data service. In a number of services ongoing, the authentication between client and application server is limited to the two-side interaction, so it is in a lower level both security and versatility. This paper is based on GBA process, introduces BSF, designed and implemented a method of three-way authentication. This method has high security features and versatility. Therefore, it can be used for both existing businesses and new businesses.