Design a real-time Authentication System

Question

Design a real-time authentication system that handles millions of requests. Discuss trade-offs in consistency, availability, and performance.

Codemia · Accepted Answer

### Functional Requirements
1. **User Registration**: Allow users to create accounts with email and password.
2. **User Login**: Authenticate users using credentials (email/password) or OAuth (Google, Facebook).
3. **Session Management**: Maintain user sessions with JWT tokens for stateless authentication.
4. **Password Management**: Provide functionality for password reset and recovery via email.
5. **Two-Factor Authentication (2FA)**: Support optional 2FA using TOTP apps (e.g., Google Authenticator).

### Non-Functional Requirements
1. **Scalability**: Support millions of requests per second (QPS) with low latency.
2. **Availability**: Ensure the system is highly available, targeting 99.99% uptime.
3. **Security**: Protect user data with encryption at rest and in transit, and implement rate limiting to prevent abuse.
4. **Consistency**: Ensure strong consistency for user authentication states while allowing eventual consistency for user data updates.

### Back-of-Envelope Calculations
- **User Base**: Assume 50 million active users.
- **Login Requests**: Estimate 10% of users log in daily, resulting in 5 million logins.
- **Peak Traffic**: During peak hours, assume a 50% increase, which translates to 7.5 million logins per day.
- **QPS Calculation**: If peak login activity lasts for 2 hours, that results in 7.5 million logins / (2 hours * 3600 seconds) = ~1041 QPS.
- **2FA Requests**: Assume 30% of users enable 2FA, accounting for an additional 1.5 million requests, leading to a peak of 1250 QPS during peak access periods.

### Storage Needs
- **User Data**: Assuming an average size of 1 KB per user for authentication data, total storage would be around 50 GB for user records.

### Component Diagram
- **Load Balancer**: Distributes incoming requests across multiple authentication service instances.
- **Authentication Service**: Stateless microservices handling login, registration, and session management. Technology: Node.js with Express for handling requests.
- **Database**: Use PostgreSQL for user data storage with replication for high availability. Redis as an in-memory store for session management and caching JWT tokens.
- **Message Queue**: Use RabbitMQ for asynchronous processing of email verifications and password resets.
- **Monitoring**: Implement Prometheus and Grafana for real-time monitoring of system health and performance metrics.

### Component Responsibilities
- **Load Balancer**: Routes requests efficiently.
- **Auth Service**: Handles authentication logic.
- **Database**: Stores user credentials securely.
- **Cache**: Speeds up repeated authentication checks.

### Schema Design
- **User Table**:
  - `user_id` (UUID, PK)
  - `email` (VARCHAR, unique)
  - `hashed_password` (VARCHAR)
  - `created_at` (TIMESTAMP)
  - `is_active` (BOOLEAN)
- **Session Table**:
  - `session_id` (UUID, PK)
  - `user_id` (UUID, FK)
  - `jwt_token` (VARCHAR)
  - `expiry` (TIMESTAMP)
- **2FA Table**:
  - `user_id` (UUID, PK)
  - `secret` (VARCHAR)
  - `is_enabled` (BOOLEAN)

### Access Patterns
- Frequent reads for session verification and user status.
- Writes to User and Session tables during login and registration processes.

### Architectural Decisions
1. **Consistency vs. Availability**: Opted for eventual consistency for user data updates (e.g., email verification) to maximize availability during peak traffic, while ensuring strong consistency for login authentication.
2. **Caching Strategy**: Using Redis to cache session tokens provides faster access and reduces load on the primary database, but introduces complexity in cache invalidation.
3. **2FA Implementation**: 2FA increases security but adds complexity and potential user friction during the login process. This is mitigated by allowing users to opt-in.
4. **Database Choices**: PostgreSQL ensures ACID compliance for user data but may require read replicas to handle high read loads, impacting write latency during peak times.

Design a real-time Authentication System

Reddit

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Practice a Similar Problem on Codemia

Sample Answer

Requirements

Functional Requirements

Capacity Estimation

Back-of-Envelope Calculations

Submit Your Answer

Reddit Software Engineer Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search