Dynamic access control in a content-based publish/subscribe system with delivery guarantees

Abstract

Improved access control techniques for distributed messaging systems such as content-based publish/subscribe systems are disclosed. For example, a method for providing access control in a content-based publish/subscribe system, wherein messages are delivered from publishing clients to subscribing clients via a plurality of brokers, includes the following steps/operations. One or more changes to an access control policy are specified. An access control version identifier is associated to the one or more changes. The one or more changes are sent to one or more brokers of the plurality of brokers that have a publishing client or a subscribing client associated therewith that is affected by the one or more changes. The access control version identifier associated with the one or more changes is sent to each of the plurality of brokers.

1 . A method of providing access control in a content-based publish/subscribe system, wherein messages are delivered from publishing clients to subscribing clients via a plurality of brokers, the method comprising the steps of: 
 specifying one or more changes to an access control policy;    associating an access control version identifier to the one or more changes;    sending the one or more changes to one or more brokers of the plurality of brokers that have a publishing client or a subscribing client associated therewith that is affected by the one or more changes; and    sending the access control version identifier associated with the one or more changes to each of the plurality of brokers.    
   
   
       2 . The method of  claim 1 , wherein each of the one or more changes to the existing access control policy are stored and implemented in the system as a batch, having the access control version identifier associated therewith, so as to uniquely identify the one or more changes from one or more previous changes to the existing access control policy of the system.  
   
   
       3 . The method of  claim 1 , wherein each of the plurality of brokers is at least one of a publisher hosting broker (PHB), a subscriber hosting broker (SHB) and an intermediate broker (IB), and wherein the specifying, associating and sending steps are performed in accordance with a security administrator.  
   
   
       4 . The method of  claim 3 , wherein the security administrator sends the one or more changes and the associated access control version identifier to PHBs and SHBs that have a publishing client or a subscribing client associated therewith that is affected by the one or more changes.  
   
   
       5 . The method of  claim 3 , wherein an SHB, upon receipt of the one or more changes, computes a restricted subscription for an affected client.  
   
   
       6 . The method of  claim 5 , wherein the SHB sends the restricted subscription along with the access control number to one or more other brokers.  
   
   
       7 . The method of  claim 3 , wherein a PHB performs at least one of the steps of: 
 upon receipt of the one or more changes, applying the one or more changes to the access control policy to obtain the latest publishing rights and the access control version identifier; and    upon receipt of a data message to be published, applying the latest publishing rights to the message.    
   
   
       8 . The method of  claim 7 , wherein the PHB sends the data message along with the access control number to one or more other brokers.  
   
   
       9 . The method of  claim 3 , wherein an IB maintains a control version vector.  
   
   
       10 . Apparatus for providing access control in a content-based publish/subscribe system, wherein messages are delivered from publishing clients to subscribing clients via a plurality of brokers, comprising: 
 a memory; and    at least one processor coupled to the memory and operative to: (i) specify one or more changes to an access control policy; (ii) associate an access control version identifier to the one or more changes; (iii) send the one or more changes to one or more brokers of the plurality of brokers that have a publishing client or a subscribing client associated therewith that is affected by the one or more changes; and (iv) send the access control version identifier associated with the one or more changes to each of the plurality of brokers.    
   
   
       11 . A content-based publish/subscribe system for providing message delivery from a publishing client to a subscribing client, the system comprising: 
 a plurality of brokers operatively coupled to one another via a network, each of the brokers being configured as at least one of a publisher hosting broker (PHB), a subscriber hosting broker (SHB) and an intermediate broker (IB);    at least one administrator being operatively coupled to at least a portion of the plurality of brokers, and being configured to store and update at least one access control policy within the system; and    wherein at least a portion of the plurality of brokers and the at least one administrator are configured to implement a change to the access control policy within the system by including an access control version identifier with one or more messages sent therebetween, wherein the access control identifier uniquely identifies the access control policy that is in effect, such that the change in the access control policy deterministically and uniformly applies to publishing clients and subscribing clients associated with one or more principals affected by the change in the access control policy.    
   
   
       12 . The system of  claim 11 , wherein the plurality of brokers are configured to eliminate a need for persistent storage of access control state at brokers other than the PHBs.  
   
   
       13 . The system of  claim 11 , wherein at least one PHB is configured to persistently store the control version identifier associated with the latest access control policy.  
   
   
       14 . The system of  claim 13 , wherein at least one PHB is configured to persistently store access control version identifiers associated with access control policies that were in effect at the time a message was published.  
   
   
       15 . The system of  claim 11 , wherein multiple paths exist between a PHB and SHB, and IBs on different paths need not maintain identical access control state.  
   
   
       16 . The system of  claim 11 , wherein at least a portion of the IBs maintain access control version vectors, with one version per SHB, rather than maintaining access control rules.  
   
   
       17 . The system of  claim 11 , wherein each SHB maintains the latest access control rules for principals that are connected thereto.  
   
   
       18 . The system of  claim 11 , wherein: (i) an SHB subscribes to access control rule changes for principals connected thereto; (ii) IBs filter access control rule changes by principal, (iii) reliable delivery is used to ensure that access control rule changes are received by the SHBs that need them, and (iv) an SHB that accepts a connection from a new principal uses a request-response protocol to initialize the access control rules for that principal.  
   
   
       19 . The system of  claim 18 , wherein: (i) an SHB intersects subscriptions with the latest access control rules and assigns and maintains the control versions of the intersected subscriptions using the version of the control rules; (ii) the SHB propagates the resulting subscription with the access control version identifier to upstream IBs; and (iii) IBs maintain subscription state with access control version identifiers.  
   
   
       20 . The system of  claim 19 , wherein: (i) PHBs include the access control version identifier in data messages, (ii) IBs use subscription state to filter the message if the access control version identifier in the data message is no more than the access control version number in the subscription state, and otherwise send the message downstream; (iii) an SHB checks equality of the control version identifier of the intersected subscriptions that match a message with the control version of the message to enforce subscribing access control rules.