Access control for message channels in a messaging system

Patent metadata

Field	Value
Publication number	US-9967203-B2
Application number	US-201615231044-A
Country	US
Kind code	B2
Filing date	Aug 8, 2016
Priority date	Aug 8, 2016
Publication date	May 8, 2018
Grant date	May 8, 2018

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for receiving one or more subscription requests, wherein each subscription request is received from a respective subscriber client and is for a respective channel, authorizing one or more of the subscription requests, wherein each authorized subscription request permits the subscriber client of the request to receive messages published to the channel of the request, receiving one or more messages for publication, wherein each message is received from a respective publisher client and is for publication on a respective channel, for each of the messages, placing the message in a respective buffer for the channel of the message, wherein the messages are present in the buffer during a finite time-to-live period for the buffer, and for one or more of the buffers, sending any messages in the buffer to subscriber clients that are authorized.

First claim

What is claimed is:

1. A method, comprising:
receiving at least one subscription request, wherein each subscription request is received from a respective subscriber client and is for a respective channel;
authorizing one or more of the at least one subscription request, wherein each authorized subscription request permits a subscriber client of the request to receive messages published to a channel of the request;
receiving one or more messages for publication, wherein each message is received from a respective publisher client and is for publication on a respective channel;
for each message, placing, by one or more computer processors, the message in a respective buffer for the respective channel of the message according to an order, wherein messages are present in the respective buffer during a finite time-to-live period for the respective buffer; and
for each buffer that has not expired, sending any messages in the buffer according to the order to subscriber clients that are authorized to subscribe to the channel associated with the buffer.

2. The method of claim 1 , wherein authorizing one or more of the at least one subscription request comprises:
determining that the channel of a particular subscription request matches a pattern; and
authorizing the subscriber client of the particular subscription request based on a permission corresponding to the pattern.

3. The method of claim 2 , wherein determining that the channel of the particular subscription request matches the pattern comprises:
determining that one or more name spaces of the channel matches the pattern.

4. The method of claim 1 , further comprising:
receiving at least one publication request, wherein each publication request is received from a respective publisher client and is for a respective channel; and
authorizing one or more of the at least one publication request, wherein each authorized publication request permits the respective publisher client to publish one or more messages to the channel of the request.

5. The method of claim 4 , wherein placing the message in the respective buffer for the respective channel of the message comprises:
determining that the publisher client from which a particular message was received is authorized to publish messages to the channel of the particular message.

6. The method of claim 4 , wherein authorizing one or more of the at least one publication request comprises:
determining that the channel of a particular publication request matches a pattern; and
authorizing the publisher client of the particular publication request based on a permission corresponding to the pattern.

7. The method of claim 1 , wherein placing the message in the respective buffer for the respective channel of the message further comprises:
deleting any messages in the respective buffer upon expiration of a time-to-live for the buffer.

8. The method of claim 1 , further comprising:
receiving one or more authentication requests through respective connections, wherein each authentication request comprises one or more credentials of a respective client; and
for each authentication request:
publishing, to a first channel, a first message requesting to authenticate the respective client, wherein the first message comprises the one or more credentials;
retrieving, from the first channel, a published second message, wherein the published second message comprises an authentication confirmation provided in response to the first message; and
based thereon, authenticating the respective client.

9. The method of claim 8 , further comprising:
storing, in information associated with the respective connection, an indication of the authentication confirmation.

10. The method of claim 9 , further comprising:
determining that the respective connection has ceased to exist; and
based thereon, removing the information.

11. The method of claim 8 , wherein the first channel is not accessible to the respective client.

12. A computing device, comprising:
one or more computer processors to:
receive at least one subscription request, wherein each subscription request is received from a respective subscriber client and is for a respective channel;
authorize one or more of the at least one subscription request, wherein each authorized subscription request permits a subscriber client of the request to receive messages published to a channel of the request;
receive one or more messages for publication, wherein each message is received from a respective publisher client and is for publication on a respective channel;
for each message, place the message in a respective buffer for the respective channel of the message according to an order, wherein messages are present in the respective buffer during a finite time-to-live period for the respective buffer; and
for each buffer that has not expired, send any messages in the buffer according to the order to subscriber clients that are authorized to subscribe to the channel associated with the buffer.

13. The computing device of claim 12 , wherein to authorize one or more the at least one subscription request the one or more processors are further to:
determine that the channel of a particular subscription request matches a pattern; and
authorize the subscriber client of the particular subscription request based on a permission corresponding to the pattern.

14. The computing device of claim 12 , wherein the one or more processors are further to:
receive at least one publication request, wherein each publication request is received from a respective publisher client and is for a respective channel; and
authorize one or more of the at least one publication request, wherein each authorized publication request permits the respective publisher client to publish one or more messages to the channel of the request.

15. The computing device of claim 14 , wherein to place the message in the respective buffer for the channel of the message the one or more processors are further to:
determine that the publisher client from which a particular message was received is authorized to publish messages to the channel of the particular message.

16. The computing device of claim 14 , wherein to authorize one or more of the at least one publication request the one or more processors are further to:
determine that the channel of a particular publication request matches a pattern; and
authorize the publisher client of the particular publication request based on a permission corresponding to the pattern.

17. The computing device of claim 12 , wherein to place the message in the respective buffer for the channel of the message the one or more processors are further to:
delete any messages in the respective buffer upon expiration of a time-to-live for the buffer.

18. The computing device of claim 12 , wherein the one or more processors are further to:
receive one or more authentication requests through respective connections, wherein each authentication request is received from a respective client and comprises one or more credentials of a respective client; and
for each authentication request:
publish, to a first channel, a first message requesting to authenticate the respective client, wherein the first message comprises the one or more credentials;
retrieve, from the first channel, a published message, wherein the second published message comprises an authentication confirmation provided in response to the first message; and
based thereon, authenticate the respective client.

19. The computing devic

Assignees

• Machine Zone Inc
• Satori Worldwide Llc

Inventors

• Walkin Lev
• Milyakov Igor
• Khabinov Oleg
• Demeschchuk Dmitry

Classifications

• H04L51/06

  Message adaptation to terminal or network requirements · CPC title

• H04L67/42

  Electricity · mapped topic

• H04W12/08 Primary

  Access security · CPC title

• H04L47/722 Primary

  at the destination endpoint, e.g. reservation of terminal resources or buffer space · CPC title

• H04L51/214

  using selective forwarding · CPC title