A method performed by a system for authentication of users requesting access to a restricted data resource from a communication device, the system comprising an authentication server situated in the restricted data resource, an access server, the communication device, and an authentication device, wherein communication between the communication device and the authentication server passes via the access server, wherein the Remote Authentication Dial In User Service, RADIUS, protocol as defined in Internet Engineering Task Force, IETF, Request for Comments, RFC, 2865, published June 2000 is used at least for the communication between the authentication server and the access server, wherein the access server performs any necessary translation between the RADIUS protocol and a communication protocol used outside the restricted data resource, the method comprising: sending, by the communication device to the authentication server, a username and a password received from a user of the communication device in response to a request to enter a username and password for accessing the restricted data resource; triggering checking, by the authentication server, whether the username received from the communication device matches a stored username of any account of the restricted data resource and whether the password received from the communication device matches a stored password for the account matching the username entered by the communication device, sending, by the authentication server to the communication device via the access server, and when the password received from the communication device matches the stored password for the account matching the username received from the communication device, a request to enter an authentication device ID, sending, by the communication device to the authentication server via the access server, an authentication device ID received from the user in response to the request to enter an authentication device ID; checking, by the authentication server, whether the authentication device ID received from the communication device matches any of a plurality of stored authentication device IDs for the account matching the username received from the communication device; performing authentication of the user based on a second authentication procedure using the authentication device ID received from the communication device, when the authentication device ID received from the communication device matches any of the plurality of stored authentication device IDs for the account matching the username received from the communication device; and when the second authentication procedure is successful, granting by the authentication server, the user access to the restricted data resource. sending, by the communication device to the authentication server, a username and a password received from a user of the communication device in response to a request to enter a username and password for accessing the restricted data resource; triggering checking, by the authentication server, whether the username received from the communication device matches a stored username of any account of the restricted data resource and whether the password received from the communication device matches a stored password for the account matching the username entered by the communication device, sending, by the authentication server to the communication device via the access server, and when the password received from the communication device matches the stored password for the account matching the username received from the communication device, a request to enter an authentication device ID, sending, by the communication device to the authentication server via the access server, an authentication device ID received from the user in response to the request to enter an authentication device ID; checking, by the authentication server, whether the authentication device ID received from the communication device matches any of a plurality of stored authentication device IDs for the account matching the username received from the communication device; performing authentication of the user based on a second authentication procedure using the authentication device ID received from the communication device, when the authentication device ID received from the communication device matches any of the plurality of stored authentication device IDs for the account matching the username received from the communication device; and when the second authentication procedure is successful, granting by the authentication server, the user access to the restricted data resource.