Securing IM and P2P Applications for the Enterprise

America Online (AOL) has been offering twonearly identical clients for instant messaging, Buddy List and AIM. What separates these clients isthat the Buddy List software is exclusive to AOL subscribers and is integrated into AOL sproprietary access software. This Buddy list software was the first instant messaging clientproduced by AOL in the mid 1990 s and was available to subscribers of AOL only, providing a way formembers of the AOL service to communicate with each other. In 1996, Mirabilis, an Israeli-basedcompany, released an instant messaging client that was freely available and compatible with mostworkstations and Internet Service Providers (ISPs). This software, ICQ, was met with immediatesuccess, and after only 6 months of availability had registered 850,000 users. AOL, noticing therapid increase in popularity of ICQ and the increased interest in instant messaging, released theirown client to compete with this freely available software. AIM was released for multiple platformsas a competitor to ICQ and was released to be available to all Internet users, regardless of theISP they were using. In 1998, AOL acquired Mirabilis, and ran the ICQ service separately from AIM.In late 2002, AOL began testing interoperability of AIM and ICQ, enabling users of both services tocommunicate with each other and share contact lists between services.
AIM s architecture is like most instant messaging services in that it employs a client-servermodel for authentication to the service and for communication with other clients. Importantly, thedefault behavior of AIM is to send messages to an intermediate server, which routes them to thecorrect...