Dynamic access control in a content-based publish/subscribe system with delivery guarantees

Abstract

Improved access control techniques for distributed messaging systems such as content-based publish / subscribe systems are disclosed. For example, a method for providing access control in a content-based publish / subscribe system, wherein messages are delivered from publishing clients to subscribing clients via a plurality of brokers, includes the following steps / operations. One or more changes to an access control policy are specified. An access control version identifier is associated to the one or more changes. The one or more changes are sent to one or more brokers of the plurality of brokers that have a publishing client or a subscribing client associated therewith that is affected by the one or more changes. The access control version identifier associated with the one or more changes is sent to each of the plurality of brokers.

Description

FIELD OF THE INVENTION [0001] The present application generally relates to distributed messaging systems and, more particularly to access control techniques in such systems. BACKGROUND OF THE INVENTION [0002] A popular approach employed in distributed messaging systems for use with asynchronous distributed applications is the content-based publish / subscribe (pub / sub) messaging approach. A content-based pub / sub system includes publishing client devices or machines (“publishers”) that generate messages and subscribing client devices or machines (“subscribers”) that register interest in messages matching the predicate / Boolean filter specified in their subscription. The system ensures timely delivery of published messages to all interested subscribers, and typically contains routing broker devices or machines (“brokers”) for this purpose. Thus, in the content-based pub / sub paradigm, the information providers (i.e., publishers) and consumers (i.e., subscribers) are decoupled, since publi...

AI Technical Summary

Benefits of technology

The present invention provides improved access control techniques for distributed messaging systems such as content-based publish / subscribe systems. The invention involves specifying, associating, and sending changes to an access control policy, with an access control version identifier associated with each change. The access control version identifier is used to uniquely identify the access control policy in the system. The changes can be sent to brokers and can be applied to both publishing clients and subscribing clients. The system ensures deterministic and uniform access control semantics to all subscribers on behalf of the same principals in the system, even when there are failures or network failures. The plurality of brokers and the at least one administrator work together to implement the access control policy. The system also includes a mechanism for persisting the access control policy at a central point in the system, with multiple paths between the different brokers. The invention provides improved access control in distributed messaging systems and ensures reliable delivery of access control rules.

Problems solved by technology

A closely related problem is accounting and auditing which enables the billing of subscribers based on usage.

This issue of access control in pub / sub systems is further complicated by the issue of changing access control policies.

One problem associated with a change in the access control policy is the disruption in pub / sub service that occurs when the change is being made.

Images