Authentication between user and server has become more and more important in the insecure network. The scheme can complete mutual authentication and resist certain known attacks. But for password guessing attack and denial-of-service attack, it cannot resist. Therefore, an improved scheme to eliminate these weaknesses is proposed in this paper.