Browse Prior Art Database

On-demand method of authenticating all participants in an instant messaging session and securing sessions from casual view

IP.com Disclosure Number: IPCOM000173305D
Original Publication Date: 2008-Jul-30
Included in the Prior Art Database: 2008-Jul-30
Document File: 2 page(s) / 27K

Publishing Venue

IBM

Abstract

Instant messaging programs require a user to authenticate when first launched, but no further authentication is required during program execution. If a user leaves an instant messaging program unattended, other users may walk up and impersonate him. This article describes on-demand identity verification methods that can be employed to minimize this problem. When an instant messaging session is initiated, the sender may require each recipient to authenticate before being allowed to participate in the messaging session. At any time during an instant messaging session, any participant may lock the session from all participants until each has re-authenticated. Users may be automatically locked from a session if they have been inactive for a period of time. Users must authenticate before viewing the saved transcript of the instant messaging session.

This text was extracted from a PDF file.
This is the abbreviated version, containing approximately 52% of the total text.

Page 1 of 2

On-demand method of authenticating all participants in an instant messaging session and securing sessions from casual view

Instant messaging software may require a user to authenticate when the program is launched, but the user is never required to authenticate later during program execution. If an instant messaging program is left unattended, other users may impersonate the user. Innocent impersonations may occur when a person is using someone else's computer with permission. Incoming instant messages are immediately displayed on the screen in the clear and can be responded to by anyone accessing the computer's user interface. The originator of the instant message has no way to demand authentication of the recipient(s); likewise the recipient has no method of demanding identity verification of the sender. For instant messaging conversations that are private or confidential, such as two managers discussing an employee's job performance, a level of on-demand security and authentication is required.

Feature #1 - All users must be authenticated in order to view and participate in the instant messaging session

      The instant messaging client's user interface contains a way for users to initiate authenticated instant messaging sessions with other users. All users that receive the invitation and the user originating the invitation are prompted to re-authenticate with the instant messaging service. Re-authentication might entail re-entering the login name and password, or an alternate authentication procedure might be used. Once each person has been verified, the user interface for the instant messaging session is displayed, and the user may view and participate in the session. Any user who fails verification will not be able to view or participate in the session. The other users may be notified of an individual user's verification failure.

Feature #2 - At any time during the session, any user may request that all users re-authenticate

      The instant messaging session's user interface contains controls that allow any participant to demand re-authentication of all participants in the session. All users that receive the re-authentication request immediately lose their ability to view and participate in the session and are prompted to re-authenticate with the instant messaging service. Once a user has been verified, the session is displayed with its entire history, including any instant messages that were exchanged while the user was re-authenticating. The user may continue participating in the session.

Feature #3 - The instant messaging session may be locked for individuals so that it is no longer displayed on the computer screen

      At any...