Design a High-Scale Random Number Generation Service

Design a high-scale service capable of generating random numbers, exposing both RESTful and streaming interfaces. The service must support secure and non-secure modes, ensure per-tenant isolation, and provide robust observability. Assume internet-facing clients and a multi-region deployment strategy.

Requirements

1. API Contracts and Versioning

   • Define REST endpoints for generating bytes, integers, and floats, supporting bulk requests. Specify request/response schemas, error codes, idempotency considerations, and content types.
   • Define streaming endpoints (e.g., using Server-Sent Events, WebSockets, or gRPC) for continuous random data delivery. Detail connection setup, backpressure mechanisms, and data chunking strategies.
   • Describe the versioning strategy and guarantees for backward compatibility.

2. Entropy Sources and RNG Choices

   • Select appropriate Cryptographically Secure Pseudo-Random Number Generators (CSPRNGs) for secure mode and faster Pseudo-Random Number Generators (PRNGs) for non-secure mode. Justify these choices, including any FIPS-validated options.
   • Describe the entropy sources (e.g., operating system or hardware-based) and the reseed strategy for RNGs.

3. Seeding and Reproducibility

   • Define how clients can request deterministic sequences of random numbers (e.g., by providing a seed, stream ID, and offset).
   • Describe methods for unbiased range mapping for integers, precision handling for floats, and ensuring identical output across different regions or service instances for deterministic sequences.

4. Rate Limiting, Quotas, and Multi-Tenant Isolation

   • Specify per-tenant and per-token rate limits and quotas, including burst behavior, relevant HTTP headers, and error handling.
   • Describe how RNG state and cryptographic keys are isolated to prevent tenants from affecting or inferring each other’s random number outputs.

5. Security and Abuse Prevention

   • Define authentication and authorization mechanisms, transport security (e.g., TLS), request validation, and strategies for DDoS/WAF controls.
   • Address secure storage and handling of seeds, along with audit considerations.

6. Observability

   • Define key metrics, logging strategies, and tracing mechanisms. This should include RNG health checks, entropy pool telemetry, and quality testing (e.g., periodic Dieharder or NIST Statistical Test Suite).

7. Deployment and Scaling Strategy

   • Propose a multi-region architecture, including autoscaling, failover mechanisms, and a zero-downtime rollout plan.
   • Detail the worker design (e.g., vectorized generation, prefetch buffers), state placement considerations, and strategies for stream stickiness.

8. SLAs/SLOs

   • Propose specific latency and availability targets for both REST and streaming interfaces. This should cover startup latency, sustained throughput, and error budgets.

Assumptions and Scale

• Assume a peak scale of 100,000 REST requests per second per region.
• Assume up to 5 Gigabits per second (Gbps) of streaming throughput per region.
• Candidates should note any additional assumptions made during the design process.