Topology Changes in a Reliable Publish/Subscribe System

Publish/Subscribe Middleware is an important infrastructure component in many enterprises, and must support both best-effort and reliable delivery of messages. For availability and scalability, such middleware should be deployed as a redundant overlay network of routing brokers. This paper examines the problem of changing the topology of such a network, without stopping delivery of messages, and without degrading the reliability guarantees.

Unlike the vast amount of recent research on self-organizing overlay networks, the focus of our work is on managed networks, which is how messaging middleware is typically deployed. A major drawback of self-organizing overlays is that they can only support reliable delivery protocols that are purely end-to-end. Such protocols do not work for content-based routing since intermediate brokers can filter messages not needed by downstream subscribers, and perform aggregation of acknowledgements.

We develop a formal and practical system model, which separates this problem into multiple layers: Administrators, the Topology Change Subsystem (TCS), the Topology Database and routing brokers. We describe topology change programs executed by the TCS on behalf of administrators, prove their correctness, and discuss how ordering between programs can be relaxed without impacting the predictability of the final topology. Our solution only requires eventual convergence of topology state cached by running brokers.