  In the distributed environment, authentication and key exchange mechanisms
play a major role. In general, for authentication, the client and the server
mutually exchange a common cryptographic key. In earlier, passwords were stored
on a single server. If an intruder gains access to the server by using some
malicious attacks, then all the passwords stored in the database be
compromised. So the e-commerce application security is endangered. In order to
improve the efficiency and performance of the authentication scheme, we
introduce multiple servers to store the passwords and participate in the key
exchange and authentication schemes. This ensures entire systems' security even
if a single server is compromised. The randomly generated nonce for each
session corresponding to two-level security mechanism where the scope of an
attacker pretends as legitimate user and login to the system is completely
restricted. In this method, passwords are stored in their equivalent hash
values and stored on multiple servers. This makes the attacker difficult to
reverse engineer and intercept to determine the password even from segments of
hash value. In this paper, we model a safe and secure password-based
authentication scheme using a key exchange.
