diff --git a/src/main/aidl/com/github/shadowsocks/aidl/Config.java b/src/main/aidl/com/github/shadowsocks/aidl/Config.java
index 96060b1b..cade941d 100644
--- a/src/main/aidl/com/github/shadowsocks/aidl/Config.java
+++ b/src/main/aidl/com/github/shadowsocks/aidl/Config.java
@@ -10,6 +10,7 @@ public class Config implements Parcelable {
   public boolean isBypassApps = false;
   public boolean isTrafficStat = false;
   public boolean isUdpDns = false;
+  public boolean isAuth = false;
 
   public String profileName = "Untitled";
   public String proxy = "127.0.0.1";
@@ -33,13 +34,14 @@ public class Config implements Parcelable {
   };
 
   public Config(boolean isGlobalProxy, boolean isGFWList, boolean isBypassApps,
-      boolean isTrafficStat, boolean isUdpDns, String profileName, String proxy, String sitekey,
+      boolean isTrafficStat, boolean isUdpDns, boolean isAuth, String profileName, String proxy, String sitekey,
       String encMethod, String proxiedAppString, String route, int remotePort, int localPort) {
     this.isGlobalProxy = isGlobalProxy;
     this.isGFWList = isGFWList;
     this.isBypassApps = isBypassApps;
     this.isTrafficStat = isTrafficStat;
     this.isUdpDns = isUdpDns;
+    this.isAuth = isAuth;
     this.profileName = profileName;
     this.proxy = proxy;
     this.sitekey = sitekey;
@@ -60,6 +62,7 @@ public class Config implements Parcelable {
     isBypassApps = in.readInt() == 1;
     isTrafficStat = in.readInt() == 1;
     isUdpDns = in.readInt() == 1;
+    isAuth = in.readInt() == 1;
     profileName = in.readString();
     proxy = in.readString();
     sitekey = in.readString();
@@ -80,6 +83,7 @@ public class Config implements Parcelable {
     out.writeInt(isBypassApps ? 1 : 0);
     out.writeInt(isTrafficStat ? 1 : 0);
     out.writeInt(isUdpDns ? 1 : 0);
+    out.writeInt(isAuth ? 1 : 0);
     out.writeString(profileName);
     out.writeString(proxy);
     out.writeString(sitekey);
diff --git a/src/main/jni/shadowsocks-libev b/src/main/jni/shadowsocks-libev
index 7e23ae7a..5ae4df94 160000
--- a/src/main/jni/shadowsocks-libev
+++ b/src/main/jni/shadowsocks-libev
@@ -1 +1 @@
-Subproject commit 7e23ae7a75e26b4362b6a390338d945ac972ca14
+Subproject commit 5ae4df94e440c4f6826a679a62687ad27303d89b
diff --git a/src/main/res/values-zh/strings.xml b/src/main/res/values-zh/strings.xml
index a465c305..37e343cb 100755
--- a/src/main/res/values-zh/strings.xml
+++ b/src/main/res/values-zh/strings.xml
@@ -77,6 +77,9 @@
   <string name="udp_dns">UDP 转发</string>
   <string name="udp_dns_summary">由远程服务器转发 UDP 协议的数据包</string>
 
+  <string name="onetime_auth">一次性认证</string>
+  <string name="onetime_auth_summary">启用一次性认证(实验性)</string>
+
   <!-- profile -->
   <string name="add_profile_dialog">为影梭添加此配置文件？</string>
   <string-array name="add_profile_methods">
diff --git a/src/main/res/values/strings.xml b/src/main/res/values/strings.xml
index c16eb855..d661f273 100644
--- a/src/main/res/values/strings.xml
+++ b/src/main/res/values/strings.xml
@@ -25,6 +25,8 @@
 
   <!-- feature category -->
   <string name="feature_cat">Feature Settings</string>
+  <string name="onetime_auth">Onetime Authentication</string>
+  <string name="onetime_auth_summary">Enable onetime authentication (Experimental)</string>
   <string name="http_proxy">HTTP Proxy</string>
   <string name="http_proxy_summary">Local HTTP Proxy</string>
   <string name="dns_proxy">DNS Proxy</string>
diff --git a/src/main/res/xml/pref_all.xml b/src/main/res/xml/pref_all.xml
index 495b92e0..e9085e50 100644
--- a/src/main/res/xml/pref_all.xml
+++ b/src/main/res/xml/pref_all.xml
@@ -78,6 +78,12 @@
                 android:summary="@string/udp_dns_summary"
                 android:title="@string/udp_dns">
         </CheckBoxPreference>
+        <CheckBoxPreference
+                android:key="isAuth"
+                android:defaultValue="false"
+                android:summary="@string/onetime_auth_summary"
+                android:title="@string/onetime_auth">
+        </CheckBoxPreference>
         <CheckBoxPreference
                 android:key="isAutoConnect"
                 android:summary="@string/auto_connect_summary"
diff --git a/src/main/scala/com/github/shadowsocks/Shadowsocks.scala b/src/main/scala/com/github/shadowsocks/Shadowsocks.scala
index 646b2b08..b3fbf2c8 100644
--- a/src/main/scala/com/github/shadowsocks/Shadowsocks.scala
+++ b/src/main/scala/com/github/shadowsocks/Shadowsocks.scala
@@ -127,7 +127,7 @@ object Shadowsocks {
   val PROXY_PREFS = Array(Key.profileName, Key.proxy, Key.remotePort, Key.localPort, Key.sitekey,
     Key.encMethod)
   val FEATRUE_PREFS = Array(Key.route, Key.isGlobalProxy, Key.proxyedApps,
-    Key.isUdpDns, Key.isAutoConnect)
+    Key.isUdpDns, Key.isAuth, Key.isAutoConnect)
 
   val EXECUTABLES = Array(Executable.PDNSD, Executable.REDSOCKS, Executable.SS_TUNNEL, Executable.SS_LOCAL, Executable.TUN2SOCKS)
 
@@ -166,6 +166,7 @@ object Shadowsocks {
       case Key.route => updateListPreference(pref, profile.route)
       case Key.isGlobalProxy => updateCheckBoxPreference(pref, profile.global)
       case Key.isUdpDns => updateCheckBoxPreference(pref, profile.udpdns)
+      case Key.isAuth => updateCheckBoxPreference(pref, profile.auth)
       case _ =>
     }
   }
diff --git a/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala b/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
index 76a4afdf..68dc32b8 100644
--- a/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
+++ b/src/main/scala/com/github/shadowsocks/ShadowsocksNatService.scala
@@ -205,6 +205,8 @@ class ShadowsocksNatService extends Service with BaseService {
           , "-c" , Path.BASE + "ss-local-nat.conf"
           , "-f" , Path.BASE + "ss-local-nat.pid")
 
+    if (config.isAuth) cmd += "-A"
+
     if (config.route != Route.ALL) {
       cmd += "--acl"
       cmd += (Path.BASE + "acl.list")
@@ -233,6 +235,8 @@ class ShadowsocksNatService extends Service with BaseService {
 
       cmd += ("-l" , "8153")
 
+      if (config.isAuth) cmd += "-A"
+
       if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
 
       Console.runCommand(cmd.mkString(" "))
@@ -254,6 +258,8 @@ class ShadowsocksNatService extends Service with BaseService {
         , "-c" , Path.BASE + "ss-tunnel-nat.conf"
         , "-f" , Path.BASE + "ss-tunnel-nat.pid")
 
+      if (config.isAuth) cmdBuf += "-A"
+
       if (BuildConfig.DEBUG) Log.d(TAG, cmdBuf.mkString(" "))
       Console.runCommand(cmdBuf.mkString(" "))
     }
diff --git a/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala b/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
index 6e8b3984..2e1b3cfc 100644
--- a/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
+++ b/src/main/scala/com/github/shadowsocks/ShadowsocksVpnService.scala
@@ -302,12 +302,14 @@ class ShadowsocksVpnService extends VpnService with BaseService {
     })
 
     val cmd = new ArrayBuffer[String]
-    cmd +=(Path.BASE + "ss-local", "-V", "-u"
+    cmd += (Path.BASE + "ss-local", "-V", "-u"
       , "-b", "127.0.0.1"
       , "-t", "600"
       , "-c", Path.BASE + "ss-local-vpn.conf"
       , "-f", Path.BASE + "ss-local-vpn.pid")
 
+    if (config.isAuth) cmd += "-A"
+
     if (config.route != Route.ALL) {
       cmd += "--acl"
       cmd += (Path.BASE + "acl.list")
@@ -325,7 +327,7 @@ class ShadowsocksVpnService extends VpnService with BaseService {
       p.println(conf)
     })
     val cmd = new ArrayBuffer[String]
-    cmd +=(Path.BASE + "ss-tunnel"
+    cmd += (Path.BASE + "ss-tunnel"
       , "-V"
       , "-u"
       , "-t", "10"
@@ -335,6 +337,8 @@ class ShadowsocksVpnService extends VpnService with BaseService {
       , "-c", Path.BASE + "ss-tunnel-vpn.conf"
       , "-f", Path.BASE + "ss-tunnel-vpn.pid")
 
+    if (config.isAuth) cmd += "-A"
+
     if (BuildConfig.DEBUG) Log.d(TAG, cmd.mkString(" "))
     Console.runCommand(cmd.mkString(" "))
   }
diff --git a/src/main/scala/com/github/shadowsocks/database/DBHelper.scala b/src/main/scala/com/github/shadowsocks/database/DBHelper.scala
index 946bcb51..fd08afb8 100644
--- a/src/main/scala/com/github/shadowsocks/database/DBHelper.scala
+++ b/src/main/scala/com/github/shadowsocks/database/DBHelper.scala
@@ -51,7 +51,7 @@ object DBHelper {
 }
 
 class DBHelper(val context: Context)
-  extends OrmLiteSqliteOpenHelper(context, DBHelper.PROFILE, null, 9) {
+  extends OrmLiteSqliteOpenHelper(context, DBHelper.PROFILE, null, 10) {
 
   lazy val profileDao: Dao[Profile, Int] = getDao(classOf[Profile])
 
@@ -67,6 +67,8 @@ class DBHelper(val context: Context)
         profileDao.executeRaw("ALTER TABLE `profile` ADD COLUMN route VARCHAR;")
       } else if (oldVersion < 9) {
         profileDao.executeRaw("ALTER TABLE `profile` ADD COLUMN route VARCHAR;")
+      } else if (oldVersion < 10) {
+        profileDao.executeRaw("ALTER TABLE `profile` ADD COLUMN auth SMALLINT;")
       } else {
         profileDao.executeRaw("DROP TABLE IF EXISTS 'profile';")
         onCreate(database, connectionSource)
diff --git a/src/main/scala/com/github/shadowsocks/database/Profile.scala b/src/main/scala/com/github/shadowsocks/database/Profile.scala
index 8c5caa90..4b444d26 100644
--- a/src/main/scala/com/github/shadowsocks/database/Profile.scala
+++ b/src/main/scala/com/github/shadowsocks/database/Profile.scala
@@ -90,6 +90,9 @@ class Profile {
   @DatabaseField
   var udpdns: Boolean = false
 
+  @DatabaseField
+  var auth: Boolean = false
+
   @DatabaseField(dataType = DataType.LONG_STRING)
   var individual: String = ""
 
diff --git a/src/main/scala/com/github/shadowsocks/database/ProfileManager.scala b/src/main/scala/com/github/shadowsocks/database/ProfileManager.scala
index 34e2d3fd..f70973f9 100644
--- a/src/main/scala/com/github/shadowsocks/database/ProfileManager.scala
+++ b/src/main/scala/com/github/shadowsocks/database/ProfileManager.scala
@@ -122,6 +122,7 @@ class ProfileManager(settings: SharedPreferences, dbHelper: DBHelper) {
     edit.putBoolean(Key.isBypassApps, profile.bypass)
     edit.putBoolean(Key.isTrafficStat, profile.traffic)
     edit.putBoolean(Key.isUdpDns, profile.udpdns)
+    edit.putBoolean(Key.isAuth, profile.auth)
     edit.putString(Key.profileName, profile.name)
     edit.putString(Key.proxy, profile.host)
     edit.putString(Key.sitekey, profile.password)
@@ -146,6 +147,7 @@ class ProfileManager(settings: SharedPreferences, dbHelper: DBHelper) {
     profile.bypass = settings.getBoolean(Key.isBypassApps, false)
     profile.traffic = settings.getBoolean(Key.isTrafficStat, false)
     profile.udpdns = settings.getBoolean(Key.isUdpDns, false)
+    profile.auth = settings.getBoolean(Key.isAuth, false)
     profile.name = settings.getString(Key.profileName, "default")
     profile.host = settings.getString(Key.proxy, "127.0.0.1")
     profile.password = settings.getString(Key.sitekey, "default")
diff --git a/src/main/scala/com/github/shadowsocks/utils/ConfigUtils.scala b/src/main/scala/com/github/shadowsocks/utils/ConfigUtils.scala
index 811b82ce..57319974 100644
--- a/src/main/scala/com/github/shadowsocks/utils/ConfigUtils.scala
+++ b/src/main/scala/com/github/shadowsocks/utils/ConfigUtils.scala
@@ -242,7 +242,7 @@ object ConfigUtils {
     val method = proxy(3).trim
 
     new Config(config.isGlobalProxy, config.isGFWList, config.isBypassApps, config.isTrafficStat,
-      config.isUdpDns, config.profileName, host, password, method, config.proxiedAppString, config.route, port,
+      config.isUdpDns, config.isAuth, config.profileName, host, password, method, config.proxiedAppString, config.route, port,
       config.localPort)
   }
 
@@ -252,6 +252,7 @@ object ConfigUtils {
     val isBypassApps = settings.getBoolean(Key.isBypassApps, false)
     val isTrafficStat = settings.getBoolean(Key.isTrafficStat, false)
     val isUdpDns = settings.getBoolean(Key.isUdpDns, false)
+    val isAuth = settings.getBoolean(Key.isAuth, false)
 
     val profileName = settings.getString(Key.profileName, "default")
     val proxy = settings.getString(Key.proxy, "127.0.0.1")
@@ -273,7 +274,7 @@ object ConfigUtils {
     }
     val proxiedAppString = settings.getString(Key.proxied, "")
 
-    new Config(isGlobalProxy, isGFWList, isBypassApps, isTrafficStat, isUdpDns, profileName, proxy,
+    new Config(isGlobalProxy, isGFWList, isBypassApps, isTrafficStat, isUdpDns, isAuth, profileName, proxy,
       sitekey, encMethod, proxiedAppString, route, remotePort, localPort)
   }
 }
diff --git a/src/main/scala/com/github/shadowsocks/utils/Constants.scala b/src/main/scala/com/github/shadowsocks/utils/Constants.scala
index bcd3dafa..389c3d66 100644
--- a/src/main/scala/com/github/shadowsocks/utils/Constants.scala
+++ b/src/main/scala/com/github/shadowsocks/utils/Constants.scala
@@ -79,6 +79,7 @@ object Key {
   val isBypassApps = "isBypassApps"
   val isTrafficStat = "isTrafficStat"
   val isUdpDns = "isUdpDns"
+  val isAuth= "isAuth"
 
   val proxy = "proxy"
   val sitekey = "sitekey"