Pusher/PubNub 1000s of Private Channels

Question

I have a specific use case where I need to send account balances of users to their browser and/or mobile device. These balances are of course private but I need to send the balance updates to each connected user when the balance changes, however, I'm concerned about pushing out to 1000s of private channels all at once.

Is there any limitations between Pusher and PubNub for this kind of use case?

EDIT: I'm specifically looking at https://pusher.com/docs/server_api_guide/interact_rest_api#example-publish-an-event-on-multiple-channels/lang=cs and publishing to multiple channels at once. Would I be able to publish to 100,000 private channels potentially in a single batch?

Answer 1

PubNub Publishing Limits and Security with Realtime Account Balance Notifications

There is no hard limit for publishes per second per channel. PubNub reserves the right to change this limit. Contact support@pubnub.com to confirm your limit.

Publish Realtime Account Balances Securely

So you need to send realtime account balance information to many people securely. When you want to transmit a person's realtime account balance you will need a checklist of security considerations. Since you are transmitting the realtime account balance from a trusted code execution environment, you do not need to implement PKI (Public Key Infrastructure) security. However you do need session token security authorization, user authentication and dual layer encryption.

1. Session Token Security: PubNub Access Manager will provide the mechanism to allow for Session based user level Access Management.

2. User Authentication: You will need to authenticate a user by email/password. After successful authentication you will use a grant() API to issue a Session Token for usage with PubNub Access Manager. You will also generate a security string (random long unpredictable key) that will be used in item 3.

3. Dual Layer Encryption: In addition to TLS, you will also use PubNub AES256 message encryption. You will provide a cipher_key on SDK initialization. In item 2 above, you will need to generate and send the cipher key in addition to the token session key to the user. Both the Cipher Key and Auth Key (token session key) should be long, random and unpredictable.

Good example of a Session Token Key (Auth Key) and a Cipher Key:

cHRiSEZPVkdnd1RqTktNVnB0YkdWS1UxSlRVbXNVMUpyV201U05XUlhSak

Note: The uuid (the user's id) should be treated the same as a cipher key and session token in regards to long and unpredictable.

User Initialization Example for Receiving Realtime Updates

Now you can security connect to PubNub using the following JavaScript example.

<!-- User Initialization Example -->
<script src="https://cdn.pubnub.com/pubnub-3.7.17.min.js"></script>
<script>(function(){

    // Init User Connection
    var pubnub = PUBNUB({
    ,   subscribe_key : 'sub-c-your-subscribe-key-here'
    ,   auth_key      : 'user-session-token-here'
    ,   cipher_key    : 'user-cipher-key-here'
    ,   uuid          : 'user-id-here'
    ,   ssl           : true
    });

    // Subscribe to a Private User Channel
    pubnub.subscribe({
        channel : 'user-private-channel-here'
    ,   message : function(message) { console.log(message) }
    });

})()</script>

Server Initialization Example for Sending Realtime Updates

Now for your server code in a trusted execution environment, you can publish a message to the end-user client.

// Server Initialization Example
var pubnub = PUBNUB({
    publish_key   : 'pub-c-your-publish-key-here'
,   subscribe_key : 'sub-c-your-subscribe-key-here'
,   secret_key    : 'sec-c-your-secret-key-here'
,   auth_key      : 'server-admin-session-token-here'
,   cipher_key    : 'destination-user-cipher-key-here'
,   uuid          : 'server-id-here'
,   ssl           : true
});

// Send Realtime Balance when User's Balance Changes
pubnub.publish({
    channel : 'destination-user-private-channel-here'
,   message : { "balance" : 10.00 }
});

Note: You must pre-grant access to the user's auth_key before they can subscribe to their user channel on the client device. The server must grant using the grant API.

// Send Realtime Balance when User's Balance Changes
pubnub.grant({
    channel  : 'destination-user-private-channel-here'
,   auth_key : 'user-session-token-here'
,   ttl      : 1440   // minutes of session time to live
,   read     : true   // user can read-only
,   write    : false  // user can't write
});

Following these guidelines above will allow you to provide modern security to delivering sensitive information to your end-users. Note that we did not cover PKI Public Key Infrastructure which you will need when publishing from untrusted code execution environments. However with your needs you will not need PKI because you are publishing from your server's trusted code.