Capabilities based management of virtual areas

Abstract

Apparatus and methods of managing a virtual area based on communicant capabilities are described. The communicant capabilities are updated based on rules in response to events in the virtual area. An action by one communicant can affect the capabilities of another communicant. Communicant capabilities can be stored in respective server-side proxies and the virtual area can be managed without transmitting any of the capabilities to the communicants' client network nodes. Capability-based permissions checks can be performed against communicant capabilities with wildcarded attribute fields.

1 . In a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, a method comprising:
 for each of one or more of the communicants in the virtual area, maintaining a respective set of capabilities;   responsive to an action by a first one of the communicants involving a second one of the communicants, identifying one of more permission rules associated with the action, each of one or more of the permissions rules defining a respective action with respect to at least one capability contingent on an associated set of one or more capability requirements;   based at least in part on a determination that the respective set of capabilities of at least one of the first communicant and the second communicant meets the capability requirements associated with all the identified permission rules, determining one or more changes in the at least one capability of the second communicant based on the identified permission rules; and   updating the respective set of capabilities of the second communicant to reflect the determined changes.   
     
     
         2 . The method of  claim 1 , wherein at least one of the permission rules defines a grant of at least one capability contingent on an associated set of one or more capability requirements. 
     
     
         3 . The method of  claim 1 , wherein at least one of the permission rules defines a revocation of at least one capability contingent on an associated set of one or more capability requirements. 
     
     
         4 . The method of  claim 1 , wherein:
 the virtual area comprises a spatial arrangement of room objects associated with respective door objects;   the action by the first communicant involves a grant of a capability to enter a particular one of the room objects by the first communicant to the second communicant; and   the updating comprises granting the second communicant the capability to enter the particular room object based on a determination that the first communicant has a respective set of capabilities meeting the capability requirements of all the permission rules identified as being associated with the grant of the capability to enter the particular room object.   
     
     
         5 . The method of  claim 4 , wherein at least one of the permission rules identified as being associated with the grant of the capability to enter the particular room object conditions the granting of the capability to enter the particular room object on the first communicant being present in the particular room object. 
     
     
         6 . The method of  claim 4 , further comprising, in response to a determination that the first communicant is an owner of the particular room object, automatically granting to the first communicant a capability to grant to the second communicant the capability to enter the particular room object. 
     
     
         7 . The method of  claim 1 , wherein the action is a request by the first communicant to bring the second communicant into the particular room object. 
     
     
         8 . The method of  claim 1 , wherein the action is a response by the first communicant to a request by the second communicant to enter the particular room object. 
     
     
         9 . The method of  claim 1 , further comprising disallowing the action responsive to a determination that the respective set of capabilities of at least one of the first communicant and the second communicant fails to meet the capability requirements associated with all the identified permission rules. 
     
     
         10 . Apparatus, comprising:
 a memory storing processor-readable instructions; and   a processor coupled to the memory, operable to execute the instructions, and based at least in part on the execution of the instructions operable to perform operations in a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, the operations comprising
 for each of one or more of the communicants in the virtual area, maintaining a respective set of capabilities, 
 responsive to an action by a first one of the communicants involving a second one of the communicants, identifying one of more permission rules associated with the action, each of one or more of the permissions rules defining a respective action with respect to at least one capability contingent on an associated set of one or more capability requirements, 
 based at least in part on a determination that the respective set of capabilities of at least one of the first communicant and the second communicant meets the capability requirements associated with all the identified permission rules, determining one or more changes in the at least one capability of the second communicant based on the identified permission rules, and 
 updating the respective set of capabilities of the second communicant to reflect the determined changes. 
   
     
     
         11 . At least one computer-readable medium having processor-readable program code embodied therein, the processor-readable program code adapted to be executed by a processor to perform operations in a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, the operations comprising:
 for each of one or more of the communicants in the virtual area, maintaining a respective set of capabilities;   responsive to an action by a first one of the communicants involving a second one of the communicants, identifying one of more permission rules associated with the action, each of one or more of the permissions rules defining a respective action with respect to at least one capability contingent on an associated set of one or more capability requirements;   based at least in part on a determination that the respective set of capabilities of at least one of the first communicant and the second communicant meets the capability requirements associated with all the identified permission rules, determining one or more changes in the at least one capability of the second communicant based on the identified permission rules; and   updating the respective set of capabilities of the second communicant to reflect the determined changes.   
     
     
         12 . In a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, a method, comprising:
 for each of one or more of the communicants in the virtual area, maintaining a respective proxy comprising a respective set of capabilities of the communicant, and   managing the virtual area based on the communicant's respective capabilities proxy without transmitting any of the capabilities of the communicant's respective proxy to the respective client network node being operated by the communicant.   
     
     
         13 . The method of  claim 12 , wherein the maintaining comprises
 for each of one or more of the communicants in the virtual area, maintaining the respective proxy on a network node other than the respective client network node being operated by the communicant.   
     
     
         14 . The method of  claim 12 , wherein the maintaining comprises determining one or more changes in the sets of capabilities based on one or more rules. 
     
     
         15 . The method of  claim 14 , wherein each of one or more of the rules defines a respective action with respect to a respective one of the capabilities contingent at least in part on a respective context in the virtual area. 
     
     
         16 . The method of  claim 15 , wherein at least one of the rules defines the respective action with respect to a respective capability that permits a communicant to interact with an object in the virtual area. 
     
     
         17 . The method of  claim 15 , wherein at least one of the rules defines the respective action with respect to a respective capability that permits a communicant to receive information associated with the virtual area. 
     
     
         18 . The method of  claim 15 , wherein each respective action comprises one of a granting of the respective capability or a revoking of the respective capability. 
     
     
         19 . The method of  claim 15 , wherein for each of the one or more capability rules the respective context is defined by at least one of: an attribute of a communicant; a capability of a communicant; an attribute of the virtual area; a policy associated with the virtual area; an action performed by a communicant in the virtual area; and a functionality associated with the virtual area. 
     
     
         20 . The method of  claim 12 , wherein the managing comprises for each of at least one of the communicants who is present in the virtual transmitting to the communicant's respective client network node a list of the communicant's capabilities associated with a location in the virtual area where the communicant is present. 
     
     
         21 . The method of  claim 12 , wherein the managing comprises:
 granting a particular capability to a particular one of the communicants;   after the granting, receiving from the respective client network node of the particular communicant a request to perform an action the availability of which is conditioned on the particular communicant having the particular capability;   responsive to receipt of the request, verifying that the particular communicant has the particular capability; and   after the verifying,
 responsive to a determination that the particular communicant has the particular capability, allowing the action to be performed, and 
 responsive to a determination that the particular communicant fails to have the particular capability, disallowing the action to be performed. 
   
     
     
         22 . Apparatus, comprising:
 a memory storing processor-readable instructions; and   a processor coupled to the memory, operable to execute the instructions, and based at least in part on the execution of the instructions operable to perform operations in a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, the operations comprising
 for each of one or more of the communicants in the virtual area, maintaining a respective proxy comprising a respective set of capabilities of the communicant, and 
 managing the virtual area based on the communicant's respective capabilities proxy without transmitting any of the capabilities of the communicant's respective proxy to the respective client network node being operated by the communicant. 
   
     
     
         23 . At least one computer-readable medium having processor-readable program code embodied therein, the processor-readable program code adapted to be executed by a processor to perform operations in a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, the operations comprising:
 for each of one or more of the communicants in the virtual area, maintaining a respective proxy comprising a respective set of capabilities of the communicant; and   managing the virtual area based on the communicant's respective capabilities proxy without transmitting any of the capabilities of the communicant's respective proxy to the respective client network node being operated by the communicant.   
     
     
         24 . In a network communication environment in which communicants operating respective client network nodes connect to a virtual area in which ones of the communicants are able to establish respective presences, and the virtual area comprising objects, including avatar objects that represent the ones of the communicants who are present in the virtual area, a method, comprising:
 for each of one or more of the communicants in the virtual area, maintaining a respective set of capabilities, wherein each of one or more of the capabilities has respective capability attribute fields comprising a capability identifier capability attribute field containing an identifier that identifies the capability, a grantee identifier capability attribute field containing an identifier that identifies a respective one of the communicants who is granted the capability, and a target identifier capability attribute field containing a value for identifying one or more objects with respect to which the capability is applicable;   performing a permission check against the respective sets of capabilities based on a search query comprising a particular capability identifier, a target identifier search field, and a grantee identifier search field, wherein at least one of the target identifier search field and the grantee identifier search field contains a wildcard value that matches all possible identifier values in the corresponding capability attribute field; and   managing the virtual area based on results of the permission check.   
     
     
         25 . The method of  claim 24 , wherein at least one of the target identifier fields contains a wildcard value that matches all possible target identifier search field values.