Biblio

In multi-server environments, remote user authentication is an extremely important issue because it provides authorization while users access their data and services. Moreover, the remote user authentication scheme for multi-server environment has resolved the problem of users needing to manage their different identities and passwords. For this reason, many user authentication schemes for multi-server environments have been proposed in recent years. In 2015, Lu et al. improved Mishra et al.'s scheme, and claimed that their scheme is a more secure and practical remote user authentication for multi-server environments. However, we found that Lu et al.'s scheme is actually insecure and incorrect. In this paper, we demonstrate that their scheme is vulnerable to outsider attack, user forgery attack. We then propose a new biometrics and smart card-based authentication scheme. Finally, we show that our proposed scheme is more secure and supports security properties.