Design Authentication Infrastructure for global users

Question

Design a high-throughput authentication system that handles millions of requests. Discuss trade-offs in consistency, availability, and performance.

Codemia · Accepted Answer

### Functional Requirements
1. **User Registration**: Allow global users to register with unique usernames and passwords.
2. **Authentication**: Support login with username/password and multi-factor authentication (MFA).
3. **Session Management**: Maintain user sessions securely, allowing for session expiration and invalidation.
4. **Password Recovery**: Implement a secure method for users to recover forgotten passwords.
5. **Rate Limiting**: Prevent brute-force attacks by limiting login attempts per user.

### Non-Functional Requirements
1. **High Availability**: System should be operational 99.99% of the time.
2. **Scalability**: Handle millions of authentication requests per second.
3. **Latency**: Authentication requests should be processed in under 100ms.
4. **Security**: Ensure data is encrypted at rest and in transit, adhering to compliance standards like GDPR.
5. **Monitoring and Alerting**: Real-time monitoring of authentication metrics and alerts for anomalies.

Assuming Two Sigma has a user base of 10 million users and expects:
- Peak login rate: 300 requests/second.
- Average session duration: 30 minutes.
- Estimated login attempts during peak hours: 1.5 billion requests/day.

### Back-of-Envelope Calculation:
- **Total requests per second**: 300
- **Daily requests**: 300 requests/sec * 60 sec/min * 60 min/hr * 24 hr = 25.9 million requests/day
- **Scaling Factor**: To account for spikes and future growth, we can expect a scaling factor of 2x over the next 5 years, leading to an estimated 600 requests/sec.

### Component Diagram
- **Load Balancer**: Distributes incoming authentication requests across multiple application servers.
- **Authentication Service**: Handles user login, registration, and session management. Built using Node.js for asynchronous processing.
- **Database**: A distributed NoSQL database (like DynamoDB or Cassandra) for user credentials and session data.
- **Cache Layer**: A Redis cluster for session state and recently authenticated users to reduce database load.
- **MFA Service**: A dedicated service for handling multi-factor authentication via SMS or email.
- **Monitoring Service**: Collects metrics and logs, triggering alerts via a tool like Prometheus and Grafana.

### Schema Design
1. **User Table**:
   - `user_id` (Primary Key, UUID)
   - `username` (Unique, String)
   - `hashed_password` (String)
   - `email` (String)
   - `created_at` (Timestamp)
   - `last_login` (Timestamp)

2. **Session Table**:
   - `session_id` (Primary Key, UUID)
   - `user_id` (Foreign Key)
   - `created_at` (Timestamp)
   - `expires_at` (Timestamp)
   - `ip_address` (String)

### Access Patterns
- Frequent read operations for session validation and user details during authentication.
- Write operations during user registration and login.

1. **Consistency vs. Availability**: Choosing a distributed NoSQL database like DynamoDB offers high availability but may sacrifice strong consistency. Eventual consistency can be acceptable for user session data.
2. **Caching Strategy**: Using Redis introduces complexity but significantly improves performance. The trade-off is the risk of stale session data, which can be mitigated through cache expiration policies.
3. **Rate Limiting**: Implementing rate limiting at the application layer can reduce brute-force attacks but may impact legitimate users during peak times. A balance must be struck between security and user experience.
4. **MFA Implementation**: While MFA significantly improves security, it can add friction to the user experience. A phased approach for enabling MFA for sensitive actions may be a good strategy.

Design Authentication Infrastructure for global users

Two Sigma

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Practice a Similar Problem on Codemia

Sample Answer

Requirements

Functional Requirements

Capacity Estimation

Submit Your Answer

Two Sigma Software Engineer Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search