Provided is an authentication method including receiving an authentication request; obtaining authentication data for authenticating a user from at least one of a plurality of external devices as when the authentication request is received; obtaining an authentication score based on the obtained authentication data and reliability information assigned to a type of the authentication data in advance; and determining whether additional authentication is necessary based on the obtained authentication score.