Provided is a two-actor user authentication system with a reduced risk of leakage of authentication information.The two-factor user authentication system is designed to use, as a password, a one-time-password derivation rule to be applied to certain pattern elements included in a presentation pattern at specific positions so as to create a one-time password, and further use, as a second authentication factor, information identifying a client to be used by a user. An authentication server is operable to generate a pattern seed value adapted to uniquely specify a presentation pattern in combination with a client ID, and transmit the pattern seed value to an authentication-requesting client. The authentication-requesting client is operable to create a presentation pattern based on a client ID acquired therefrom, and display the presentation pattern to allow a user to enter thereinto a one-time password based on the presentation pattern.