Access Control Within a Publish/Subscribe System

• US 20080103854A1
• Filed: 10/24/2007
• Published: 05/01/2008
• Est. Priority Date: 10/27/2006
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Rowe, Martin James, Masters, Peter Brian, Adam, Florence, Osborne, Andrew James
• Application Number:
  US11/923,003
• Publication Number:
  US 20080103854A1
• Time in Patent Office: Days
• US Class Current: 705/7
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

There is disclosed a method for access control in a publish/subscribe system. Identification information is associated with the client'"'"'s connection. A request is subsequently received from the client to publish or subscribe to a topic hosted by the system and that request has an identifier associated with it. It is then determined whether the identification information is consistent with the identifier provided with the request. Only if this is true is the request to publish or subscribe granted. In this way it is possible to determine that there is an appropriate level of trust. For example, when a user says that they are person x, the publish/subscribe system has already established that they too believe this to be true.

Claims

1. A method for access control in a publish/subscribe system, comprising:

associating identification information with a client'"'"'s connection;

receiving a request from the client to publish or subscribe to a topic hosted by the system, the request having an identifier associated therewith; and

determining whether the identification information is consistent with the identifier provided with the request; and

granting the publish or subscribe request only if there is consistency.

2. The method of claim 1, further comprising:

applying at least one template rule to a request to publish or subscribe to a topic in order to determine whether to grant said request.

3. The method of claim 1, wherein the identification information is authentication information determined in response to authenticating the client'"'"'s connection.

4. The method of claim 1, wherein the identifier is received as part of the topic string to which publication or subscription is requested.

5. The method of claim 1, further comprising:

responsive to granting a publish request, publishing the request to a topic including the identifier.

6. The method of claim 1, further comprising:

responsive to granting a subscribe request, subscribing the client to the requested topic.

7. The method of claim 1, wherein the identifier comprises a userid or a token.

8. The method of claim 1, wherein the identifier comprises a token and the token has a type associated therewith, the method further comprising:

applying template rules from a set of template rules, the applied template rules being those that expect a token of the type associated with the token provided as an identifier.

9. Apparatus for access control in a publish/subscribe system, apparatus comprising:

means for associating identification information with a client'"'"'s connection;

means for receiving a request from the client to publish or subscribe to a topic hosted by the system, the request having an identifier associated therewith; and

means for determining whether the identification information is consistent with the identifier provided with the request; and

means for granting the publish or subscribe request only if there is consistency.

10. The apparatus of claim 9, further comprising:

means for applying at least one template rule to a request to publish or subscribe to a topic in order to determine whether to grant said request.

11. The apparatus of claim 9, wherein the identification information is authentication information determined in response to authenticating the client'"'"'s connection.

12. The apparatus of claim 9, wherein the identifier is received as part of the topic string to which publication or subscription is requested.

13. The apparatus of claim 9, further comprising:

means, responsive to granting a publish request, for publishing the request to a topic including the identifier.

14. The apparatus of claim 9, further comprising:

means, responsive to granting a subscribe request, for subscribing the client to the requested topic.

15. The apparatus of claim 9, wherein the identifier comprises a userid or a token.

16. The apparatus of claim 9, wherein the identifier comprises a token and the token has a type associated therewith, the apparatus further comprising:

means for applying template rules from a set of template rules, the applied template rules being those that expect a token of the type associated with the token provided as an identifier.

17. A computer usable medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

associating identification information with a client'"'"'s connection;

receiving a request from the client to publish or subscribe to a topic hosted by the system, the request having an identifier associated therewith; and

determining whether the identification information is consistent with the identifier provided with the request; and

granting the publish or subscribe request only if there is consistency.

18. The computer-usable medium of claim 17, wherein the embodied computer program code further comprises computer executable instructions configured for:

applying at least one template rule to a request to publish or subscribe to a topic in order to determine whether to grant said request.

19. The computer-usable medium of claim 17, wherein the identification information is authentication information determined in response to authenticating the client'"'"'s connection.

20. The computer-usable medium of claim 17, wherein the identifier is received as part of the topic string to which publication or subscription is requested.