Design Authentication Infrastructure for mobile apps

Question

Design a multi-tenant authentication system that handles millions of requests. Discuss trade-offs in consistency, availability, and performance.

Codemia · Accepted Answer

### Functional Requirements
1. **User Authentication**: Support login, registration, password reset, and multi-factor authentication (MFA).
2. **API Rate Limiting**: Implement rate limiting to prevent abuse and ensure fair usage.
3. **Token Management**: Generate, validate, and revoke access tokens efficiently.
4. **Multi-tenancy**: Allow different organizations to maintain separate user bases and configurations.
5. **Audit Logging**: Keep logs of authentication events for security and compliance.

### Non-Functional Requirements
1. **Scalability**: Handle millions of requests per day, with an initial estimation of 1 million active users.
2. **Availability**: 99.99% uptime, with failover strategies in place.
3. **Performance**: Latency under 100 ms for 95th percentile response times across global regions.
4. **Security**: Ensure data encryption both in transit and at rest, and comply with regulations such as GDPR.

### Back-of-Envelope Calculations
1. **User Base**: Assume 1 million active users with 3 authentication requests per user per day.
2. **Total Requests**: 1,000,000 users * 3 requests = 3,000,000 requests per day.
3. **Peak Load**: Assuming peak usage times account for 10% of the daily total, we estimate around 300 requests per second.
4. **Storage Needs**: If each user requires 1 KB of data for their profile and authentication tokens, total storage = 1,000,000 users * 1 KB = ~1 GB.
5. **Scaling Considerations**: Design should accommodate growth to 10 million users, requiring load balancing and distribution across multiple regions.

### Component Diagram
1. **API Gateway**: Use AWS API Gateway for secure, scalable API management.
2. **Authentication Service**: Implement using Node.js with Express for handling requests and managing user sessions.
3. **Database**: Utilize Amazon DynamoDB for a NoSQL solution, providing fast access and scalability for user profiles and token storage.
4. **Caching Layer**: Use Redis to cache frequently accessed data like token validation results and session states, reducing database load.
5. **Load Balancer**: AWS Elastic Load Balancer to distribute incoming requests across multiple instances of the authentication service.
6. **Monitoring & Logging**: Integrate with AWS CloudWatch for performance monitoring and log aggregation.

### Schema Design
1. **User Table**:  
   - `user_id` (PK, string)  
   - `email` (string, unique)  
   - `hashed_password` (string)  
   - `tenant_id` (string)  
   - `created_at` (timestamp)  
   - `updated_at` (timestamp)

2. **Session Table**:  
   - `session_id` (PK, string)  
   - `user_id` (FK, string)  
   - `token` (string)  
   - `expires_at` (timestamp)  
   - `created_at` (timestamp)

3. **Audit Log Table**:  
   - `log_id` (PK, string)  
   - `user_id` (FK, string)  
   - `action` (string)  
   - `timestamp` (timestamp)  
   - `ip_address` (string)

### Access Patterns
- Users primarily read their session and profile data, while authentication requests involve both reading and writing to the session table.

### Architectural Decisions
1. **Consistency vs. Availability**: Opt for eventual consistency for user profile updates to enhance availability. Use strong consistency for authentication requests to ensure valid logins.
2. **Caching**: While caching improves performance, it introduces potential stale data issues. Implement cache invalidation strategies on user profile updates.
3. **Global Scale**: Use AWS services in multiple regions to reduce latency for global users. This adds complexity in data synchronization and consistency management.
4. **Rate Limiting**: Rate limiting on the API Gateway can prevent abuse but may impact legitimate users during peak times. Consider implementing dynamic rate limits based on user behavior.
5. **Deployment Strategy**: Use blue-green deployments to ensure zero downtime during updates, but this requires additional infrastructure and monitoring.

Design Authentication Infrastructure for mobile apps

Stripe

What the Interviewer Expects

Key Topics to Cover

How to Approach This

Possible Follow-up Questions

Practice a Similar Problem on Codemia

Sample Answer

Requirements

Functional Requirements

Capacity Estimation

Back-of-Envelope Calculations

Submit Your Answer

Stripe Software Engineer Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search