Design Authentication Infrastructure for IoT devices

Question

Design a distributed authentication system that handles millions of requests. Discuss trade-offs in consistency, availability, and performance.

Codemia · Accepted Answer

### Functional Requirements:
1. **User Authentication**: Support for OAuth2, password-based, and token-based authentication for IoT devices.
2. **Device Registration**: Allow IoT devices to register and authenticate securely with the system.
3. **Session Management**: Manage user sessions, including token issuance, renewal, and revocation.
4. **Audit Logging**: Log authentication attempts, both successful and failed, for security auditing.

### Non-Functional Requirements:
1. **Scalability**: Handle millions of authentication requests per day with the ability to scale horizontally.
2. **Availability**: 99.99% uptime, ensuring that authentication services are always accessible.
3. **Latency**: Response time for authentication requests should be under 200ms.
4. **Security**: Implement strong encryption (TLS) and follow best practices for secure storage of sensitive information.

Assuming Booking.com may have approximately 10 million active IoT devices, with each device authenticating 10 times per day on average, we can estimate:
- **Total Auth Requests per Day**: 10 million devices * 10 requests/device = 100 million requests/day.
- **Requests per Second**: 100 million requests/day / 86400 seconds = ~1157 requests/second.
To accommodate peak traffic, we should design for at least 2-3 times this amount, targeting around 3000 requests/second.

### Component Diagram:
- **API Gateway**: Handles incoming requests and routes them to appropriate microservices.
- **Authentication Service**: Core service responsible for authenticating users and devices using JWT tokens.
- **User Management Service**: Manages user accounts and device registrations.
- **Database**: A distributed NoSQL database (e.g., DynamoDB or Cassandra) for user and device data.
- **Message Queue**: Use RabbitMQ or Kafka for asynchronous processing of authentication requests and log entries.
- **Monitoring & Logging**: Prometheus for monitoring and ELK stack for logging.

### Technology Choices:
- **API Gateway**: Kong or AWS API Gateway.
- **Authentication Service**: Node.js with Express for rapid development.
- **Database**: DynamoDB for scalability and low latency.
- **Message Queue**: Kafka for handling high throughput.

### Schema Design:
1. **Users Table**:  
   - `user_id` (PK)  
   - `email`  
   - `password_hash`  
   - `created_at`  
   - `updated_at`

2. **Devices Table**:  
   - `device_id` (PK)  
   - `user_id` (FK)  
   - `device_type`  
   - `last_authenticated`  
   - `status`

3. **Sessions Table**:  
   - `session_id` (PK)  
   - `user_id` (FK)  
   - `token`  
   - `expires_at`  
   - `created_at`

### Access Patterns:
- Frequent reads for authentication verification and session checks.
- Writes for device registration and session creation.

### Trade-offs Considered:
1. **Consistency vs. Availability**: Given the need for high availability, we may opt for eventual consistency in our database to ensure that the system remains responsive during high loads.
2. **Synchronous vs. Asynchronous Processing**: Using asynchronous processing for logging and audit trails to prevent blocking authentication requests, but risking potential delays in log availability for real-time monitoring.
3. **Database Choice**: Choosing NoSQL (DynamoDB) offers scalability and flexibility, but at the cost of complex querying capabilities compared to traditional RDBMS.
4. **Caching**: Implementing Redis for caching frequently accessed user sessions, which can improve performance but adds complexity with cache invalidation.

Design Authentication Infrastructure for IoT devices

Booking.com

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Practice a Similar Problem on Codemia

Sample Answer

Requirements

Functional Requirements:

Capacity Estimation

Submit Your Answer

Booking.com Product Manager Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search