System and method for authenticating users using two or more factors

1. A method for authenticating a user by a system based on a plurality of authentication factors, the method comprising the steps of:

receiving by the system a first authentication factor from a first communication device of the user, the first authentication factor comprising a password;

receiving by the system a second authentication factor, the second authentication factor comprising data transmitted to or received from a second communication device of the user; and

authenticating the user based on at least the received plurality of authentication factors;

wherein the second authentication factor comprises at least one of:

data transmitted by the system to the first communication device of the user and received by the system from the second communication device of the user; and

data transmitted by the system to the second communication device of the user and received by the system from the first communication device of the user.

2. The method of claim 1 , wherein the second authentication factor comprises data transmitted by the system to the first communication device of the user and received by the system from the second communication device of the user.

3. The method of claim 1 , wherein the second authentication factor comprises data transmitted by the system to the second communication device of the user and received by the system from the first communication device of the user.

4. The method of claim 1 , wherein the second authentication factor comprises data transmitted in a text message to the second communication device of the user.

5. The method of claim 1 , wherein the second authentication factor comprises data received in a text message from the second communication device of the user.

6. The method of claim 1 , wherein the second authentication factor comprises data transmitted in a voice message to the second communication device of the user.

7. The method of claim 1 , wherein the second authentication factor comprises data received in a voice message from the second communication device of the user.

8. The method of claim 1 , wherein the data comprises a uniform resource locator.

9. The method of claim 2 , wherein the second authentication factor comprises data output to the user by the first communication device of the user and input by the user into the second communication device of the user.

10. The method of claim 3 , wherein the second authentication factor comprises data output to the user by the second communication device of the user and input by the user into the first communication device of the user.

11. The method of claim 8 , wherein the uniform resource locator is uniquely associated with the user.

12. The method of claim 7 , further comprising the step of obtaining a third authentication factor by performing voice recognition on the voice message.

13. The method of claim 1 , wherein the second authentication factor comprises a generated shared secret.

14. A method for authenticating a user based on a plurality of authentication factors, the method comprising the steps of:

receiving a first authentication factor from a first communication device of the user, the first authentication factor comprising a password;

receiving a second authentication factor from the user, the second authentication factor comprising a device identifier of the first communication device of the user; and

authenticating the user based on at least the received plurality of authentication factors;

wherein the step of receiving a second authentication factor from the user comprises the steps of:

determining whether the first communication device has a device identifier stored therein;

if the first communication device has a device identifier stored therein, receiving the device identifier of the first communication device; and

if the first communication device does not have a device identifier stored therein:

transmitting data to the second communication device of the user, and

receiving back the data transmitted to the second communication device of the user.

15. The method of claim 14 , wherein at least a portion of the device identifier is stored on the first communication device of the user as at least one of a secure cookie or a Flash shared object.

16. The method of claim 15 , wherein the stored portion of the device identifier is modified upon each authentication of the user.

17. An apparatus for authenticating a user based on a plurality of authentication factors, the apparatus comprising:

a memory; and

a processor coupled to the memory and operative to control the apparatus:

to receive a first authentication factor from a first communication device of the user, the first authentication factor comprising a password;

to receive a second authentication factor, the second authentication factor comprising data transmitted to or received from a second communication device of the user; and

to authenticate the user based on at least the received plurality of authentication factors;

wherein the second authentication factor comprises at least one of:

data transmitted by the system to the first communication device of the user and received by the system from the second communication device of the user; and

data transmitted by the system to the second communication device of the user and received by the system from the first communication device of the user.

18. The apparatus of claim 17 , wherein said apparatus comprises a web server.

19. The apparatus of claim 17 , wherein the second authentication factor comprises data transmitted to the first communication device of the user and received from the second communication device of the user.

20. The apparatus of claim 17 , wherein the second authentication factor comprises data transmitted to the second communication device of the user and received from the first communication device of the user.