To provide an attribute authentication system that can guarantee identity while keeping personal information secret and recover damages in case of trouble.

A user terminal 1 requests access to an access control server 2, receives a server policy 24 for access permission, and sends the server policy 24 and electronic money to an attribute certificate issuance server 3 to request the issuance of an attribute certificate. The attribute certificate issuance server 3 extracts personal information about the user of the user terminal 1 from a personal information database 32, issues an attribute certificate with the received amount of electronic money set as an amount of security at an attribute certificate issuance part 34, and sends it to the user terminal 1. The user terminal 1 sends the attribute certificate to the access control server 2. The access control server 2 checks the contents of the attribute certificate against the server policy 24 to determine access availability.