To provide an authentication system and authentication method, which prevent an authentication from being easily penetrated by an illicit person while preventing the reduction in convenience for a user.

A database 40 stores read pattern information for a read pattern to be used for reading a plurality of pieces of authentication information stored in a set of IC tags 10 owned by each user by an information reading means 20 as information for identifying the user. When each user makes the information reading means 20 read the plurality of pieces of authentication information stored in the set of IC tags 10 with a predetermined read pattern, a control means 34 recognizes the read pattern in this reading based on the plurality of pieces of authentication information transmitted from the information reading means 20, and determines whether read pattern information matched to the content of the recognized read pattern is present in the database 40. The control means 34 recognizes an authentication request by this user only when the presence is determined.