Based on ElGamal digital signature and zero-knowledge, a practical two-way user authentication scheme was presented. It was obtained that reliability and availability of request information could be improved through random number and online challenge-response interactive system. Meantime, the problem about key distribution and storage related to user authentication scheme was solved securely and effectively by using smart card, and highly security of user information was acquired accordingly as well. As a conclusion, the securities of the proposed scheme under the assumption about the difficulty of computing discrete logarithm are analyzed.