Optimal strategies for managing complex authentication systems

We study an authentication system that receives requests from different types of users. A centralized controller must assign an authentication method to each request, considering the type, the state of the system and the characteristics of several available methods. Each authentication method has different capacity, service rate, level of security, level of usability and operating cost. We seek to optimize security, usability and operating cost, simultaneously by assigning authentication methods dynamically, in real time. To do this, we model the system as a network of parallel multi-server queues, where each queue represents an authentication method and each customer represents a request. We use two different approaches to handle the multiple objectives: a weighted total cost function, and treating security and latency as constraints while minimizing operating cost. We employ constrained and unconstrained Markov decision processes to determine the structure of policies that effectively balance these three objectives. We conclude that if there are infinitely many servers for each authentication method, then the optimal policy is static. We also show that if one method has finite capacity, then the optimal policy is of trunk reservation form. Our results regarding the structure of the optimal policy are consistent for both modeling approaches. Our work shows that optimal policies have intuitive, easy-to-implement structures that are useful in practice. Under certain assumptions, we provide a straightforward way to obtain an optimal policy. We also offer strategies to use our models to explore non-dominated solutions over the three objective functions.