An authentication method for a user terminal and an authentication server, the method comprising: generating, by the user terminal, a first common authentication key by combining a private password with a unique key of the user terminal and encrypting the combined information if a user of the user terminal enters the private password for user registration, and providing, by the user terminal, a user information to the authentication server, and providing, by the user terminal, the generated first common authentication key to the authentication server, registering, by the authentication server, the first common authentication key and the user information; generating, by the authentication server, a server authentication key by combining an embedded unique key of a certificate authority with the first common authentication key and encrypting the combined information, and generating, by the authentication server, first server authentication information by calculating a first one time password by using the server authentication key as an operation key, and generating, by the user terminal, a second common authentication key by combining the private password with the unique key of the user terminal and encrypting the combined information if the user enters the private password for authentication, generating, by the user terminal, a user authentication key by combining the unique key of the certificate authority previously provided from the authentication server with the second common authentication key and encrypting the combined information, and generating, by the user terminal, first user authentication information by calculating a second one time password by using the user authentication key as an operation key; and performing user authentication or authentication server authentication based on whether the first server authentication information is identical to the first user authentication information. generating, by the user terminal, a first common authentication key by combining a private password with a unique key of the user terminal and encrypting the combined information if a user of the user terminal enters the private password for user registration, and providing, by the user terminal, a user information to the authentication server, and providing, by the user terminal, the generated first common authentication key to the authentication server, registering, by the authentication server, the first common authentication key and the user information; generating, by the authentication server, a server authentication key by combining an embedded unique key of a certificate authority with the first common authentication key and encrypting the combined information, and generating, by the authentication server, first server authentication information by calculating a first one time password by using the server authentication key as an operation key, and generating, by the user terminal, a second common authentication key by combining the private password with the unique key of the user terminal and encrypting the combined information if the user enters the private password for authentication, generating, by the user terminal, a user authentication key by combining the unique key of the certificate authority previously provided from the authentication server with the second common authentication key and encrypting the combined information, and generating, by the user terminal, first user authentication information by calculating a second one time password by using the user authentication key as an operation key; and performing user authentication or authentication server authentication based on whether the first server authentication information is identical to the first user authentication information.