n 1981, a remote password authentication scheme was proposed by L. Lamport [4] over an insecure channel. Since then, several schemes [5], [6], [7], [8], [9], [10] have been proposed to address this problem for achieving more functionality and efficiency. In a traditional password scheme, each user has an identity and a secret password. If a person wants to log into a network system, they must submit their identity and the corresponding password.

To avoid storing a plain password table in a public network system, several scheme [4], [11], [12] have proposed a dictionary of verification tables to store each user ID and the corresponding one-way hash value of passwords in the remote system. In 2005, Chien et al. [9] pointed out that Das et al. [8] scheme cannot achieve user anonymity because an attacker can trace user with the static value. In 2010, Lee et al. [13] have analyzed the security of the smart card based user authentication scheme proposed by Lee and Chiu [14]. Their security analysis showed that scheme [9] does not achieve its main security goal of the two-factor security. To demonstrate this, they have shown that the scheme is vulnerable to an o_-line dictionary attack in which an attacker, who has obtained the secret values stored in the users smart card can easily find out its password. Besides reporting the security problem, they showed what really is causing the problem and how to fix it and they proposed a new and improved scheme than Lee and Chius scheme.

In 2012, Francisco et al. have shown security vulnerabilities like Denial of service, server spoong, impersonation in Wang et al. [2] scheme. We propose a scheme that can withstand the above mentioned attacks, we implemented and demonstrated the stated scheme using MATLAB. The paper is organized as follows.

In Section 2, we give a brief review on Wang et al.s scheme. We demon-strate the vulnerabilities of the scheme in Section 3. The proposed scheme and its security analysis are presented in section 4 and 5. Section 6 com-pares the performance of our proposed scheme with other related schemes. Finally, we conclude this paper in Section 7.

Verify T*-T? ?T, if time interval is incorrect then reject login request otherwise accept M i and perform:

Here ID i * and ID i are equals so login request accepted by the server and S performs:

Intercept message M i of User U i

This section proposes a strong, secure authentication scheme which will with-stand the security vulnerabilities which leads to the aforementioned attacks.

In this phase, the user registers with the remote server S through a secure channel to be a authentic user.

Step 1: chooses his/her identity and password and computes

. Then sends the registration request

Step 2: Upon receiving from , S veri_es the validity of and computes

Step 3: computes then captures current date and time in T and create a record in its database.

Step 4: stores into the smart card of and sends the smart card through a secure channel to the user

Step 5: Upon receiving the smart card from stores into smart card and does not need to remember after _nishing registration phase. Finally, smart card contains b) Login phase In this phase, when an authentic user want to login to the remote server S, he/she must perform the following steps:

Step 1: inserts his/her smart card into the card reader and inputs the identity and password The smart card computes where is retrieved from its memory space.

Step 2: The Step 1: reveals M 1 by using the Chinese Remainder Theorem (CRT) with p and q to obtain and . Then veri_es the revealed with the stored corresponding to ID . If _ T, S replaces with new time variable T in its database. Otherwise, rejects login request.

Step 2: If Step 1 holds, S computes and checks if computed equals received . If it holds, would successfully authenticate and computes the session key shared with .

Step 3: computes and send it to .

Step 4: Ui computes M *=H(VIDikRx) and check if computed M * equals received . If it does not hold,

x Rx number generated by random

Volume XVI Issue IV Version I ( ) number generated by Then, the smart card V.

In this section, we analyzed the security of the proposed scheme and shown that our scheme is secure against the following well-known attacks. The security of our proposed authentication scheme is based on the secure hash function and the In the following steps, we analyzed the security of the proposed scheme to verify that the specified security requirements [3] are fulfilled. a) Resistance to user anonymity attack Suppose that the attacker intercepted authentication messages. Then, the adversary cannot retrieve any static parameter from these messages, due to the . Hence, the proposed scheme can preserve user anonymity.

Suppose that a malicious legitimate attacker user has got smart card, and the secret information and can also be revealed under our assumption of the non-tamper resistant smart card. Even after gathering this information, the attacker has to at least guess both and correctly at the same time, because it has been demonstrated that our scheme can provide identity protection. It is impossible to guess these two parameters correctly at the same time, and thus the proposed scheme can resist offine password guessing attack with smart card security breach.

In the proposed scheme no sensitive verifiers corresponding to the users are maintained by . Therefore, the proposed scheme is free from the stolen verifier attack. Based on the dificulty of the one-way hash algorithm, any previously generated session keys cannot be revealed without knowledge of the and . As a result our scheme provides the property of forward secrecy.

In this scheme we have taken 1.0 unit average run time for a single one-way secure hash function operation. The proposed scheme requires lower computation overhead with comparison to other schemes, which is shown in the Table 6 and the Figure 1. Wang et al.s scheme was proposed for resolving security issues presented in pre-vious work of [8]. However, we have discovered some security aws in their scheme making it vulnerable to various attacks such as impersonation, server spoofing and denial of service attack. Moreover, the scheme cannot withstand password change aws. As a remedy to the aforementioned weaknesses, we have presented an enhanced scheme, which overcome the vulnerabilities of [15]