In the distributed environment, authentication and key exchange mechanisms play a major role. In general, for authentication, the client and the server mutually exchange a common cryptographic key. In earlier, passwords were stored on a single server. If an intruder gains access to the server by using some malicious attacks, then all the passwords stored in the database be compromised. So the e-commerce application security is endangered. In order to improve the efficiency and performance of the authentication scheme, we introduce multiple servers to store the passwords and participate in the key exchange and authentication schemes. This ensures entire systems' security even if a single server is compromised. The randomly generated nonce for each session corresponding to two-level security mechanism where the scope of an attacker pretends as legitimate user and login to the system is completely restricted. In this method, passwords are stored in their equivalent hash values and stored on multiple servers. This makes the attacker difficult to reverse engineer and intercept to determine the password even from segments of hash value. In this paper, we model a safe and secure password-based authentication scheme using a key exchange.