  Very recently, Barman et al. proposed a multi-server authentication protocol
using fuzzy commitment. The authors claimed that their protocol provides
anonymity while resisting all known attacks. In this paper, we analyze that
Barman et al.'s protocol is still vulnerable to anonymity violation attack and
impersonation based on the stolen smart attack; moreover, it has scalability
issues. We then propose an improved and enhanced protocol to overcome the
security weaknesses of Barman et al.'s scheme. The security of the proposed
protocol is verified using BAN logic and widely accepted automated AVISPA tool.
The BAN logic and automated AVISPA along with the informal analysis ensures the
robustness of the scheme against all known attacks
