In the TNC architecture, there are several limitations that limit the application scenario of the TNC architecture. Concerning the fact that the TNC architecture is lack of invasive treatment, this paper proposed a intrusion tolerant of redundant servers model and a design of security protocols within the servers group in order to improve the reliability of TNC architecture, which still correctly complete the certification in the case of being attacked. Under the assumption that a secure server’s signature couldn’t be tampered with by a hacker, the model used a server cluster instead of a single point authentication server. The server in the cluster completed the authentication synchronously and determined the scope of the secure servers with several rounds of information exchange. Then the proxy server was elected by the secure servers. The proxy server delivered the final authentication results to the policy execution point. Security analysis and efficiency comparision with other protocals show that the model can significantly improve the reliability of trusted network connection architecture, and the time overhead can be accepted while completing security goals.