Introduction

Instant messaging is an increasingly popular method of Internet communication. So much so in fact, that one of the most popular clients, ICQ^1.1, is almost ubiquitous amongst Cambridge undergraduates with a computer and network connection in their college room.

In a way, the idea is simple - take the UNIX write command that allows a logged in user to send a simple message to another logged in user and add in the ability for a user to set a ``Status Message'' indicating whether they are away from their computer and/or if they are too busy to chat. There are many reasons why instant messaging has become so popular, although much is probably due to the design of early clients. They were much easier to understand, install and use than traditional systems such as IRC, but they were also designed to be as unobtrusive as possible when not in use, only popping up when a message was received, thereby allowing the user to carry on with other tasks while still being available to chat to their fellow users. Once instant messaging began to take off, it snowballed, the clients actively encouraging users to invite their existing friends to join the network so they could chat.

Figure 1.1: Overview of operation of a typical IM system

Typically an instant messaging system consists of a client and a server, as shown in figure 1.1. The server keeps track of the status (e.g. online, offline, busy, away from computer) of each user and stores sufficient information about them to allow another user to set up a peer-to-peer communication channel with them (typically an IP address and port number).

Each user has a list of other users with whom they communicate, generally known as a Contact or Buddy list. When the user logs into the system, the current status of each of their contacts (or buddies)^1.2 is downloaded to their client. Once the one-to-one communication channel between users has been established, the server plays no further part other than to inform the clients of updates to the status of their contacts. Unlike e-mail, if a user is not currently logged into the system, they cannot be sent a message.^1.3

As someone who uses ICQ everyday, I have noticed a number of problems with the system. The most frustrating from a user's point of view is the fact that the server represents a single point of failure, and even if the server is reliable, the network may not be. In Cambridge, at one time the JANET link to the outside world was liable to frequent interruption, rendering ICQ useless despite the fact that internal traffic on the Cambridge University Data Network (CUDN) was unaffected. A second problem with ICQ is that it is not mobile; i.e. your contact list resides on your PC and if you move to another one you have to manually recreate it; a time-consuming business. The final problem is security, in particular authentication, as spoofing a message from another user is trivial. Encrypted user-to-user messaging is another useful feature that ICQ is currently lacking, but is not really a problem for current users. However, an instant messaging system that was secure (i.e. had authentication of messages and encrypted messaging) would be a useful tool for business as well.

While there are other instant messaging systems (both proprietary and open source) available, these problems with ICQ inspired me to design and implement a reliable and mobile instant messaging system and address some of the security issues at the same time.