I strongly advise you to seek professional assistance with this. Everyone who has ever attempted to implement any kind of security mechanism without significant

I strongly advise you to seek professional assistance with this. Everyone who has ever attempted to implement any kind of security mechanism without significant previous experience has failed, often spectacularly. This is especially true in authentication and access control, sometimes call IDAM (look that up, read, learn). You may do so well as to cover the vast majority of cases. Yet I guarantee you will leave an exploitable edge case that will leave your systems vulnerable. If they are Internet-facing, these vulnerabilities will be exploited, probably without you knowing it. I encourage to read about prevent, detect, respond, and recover, about defence in depth, about Kerberos, about PKI in general, about SSL and TLS and SSH specifically, and about IDAM. Do NOT attempt this on a production server until you know in your heart and gut and mind what was wrong with SSL v1 and v2, what is wrong with v3, and why we are now at TLS 1.2. Do not attempt this until you understand why having keepalives outside the security envelope is a flaw in any security protocol - or until you can argue clearly and cleanly why it may not be important in your case. Once you understand those things, you may start to understand how much you are missing. Learn about SPEKE, e.g., that will help too. I've been a security consultant for a long time, was a development manager and developer before that. Everybody gets their first implementation wrong. Everyone.