Presence awareness in collaborative systems

[0002] This invention relates to collaborative systems and, more particularly, to presence awareness in such systems.

[0003] The ability to convey presence awareness information is rapidly becoming an important component of collaborative system applications. Indeed, any detectable user event could conceivably have a legitimate use in some presence awareness application. However, from a user's point of view, there is a fundamental tradeoff between access to presence data for legitimate users, and concerns about privacy. Precisely to the extent that one user is able to identify what another user is doing, the user can communicate with the other user when the need arises, make his or her communications more timely and convenient for the other user, and generally be a more effective colleague or more accessible and responsive friend, acquaintance, or family member. This is the sort of information, however, that users would generally not like to provide to strangers, nor perhaps to managers, competitors, or family members and friends. Moreover, the data are largely generated automatically and potentially quite frequently, so users cannot be expected to monitor all presence events in order to ensure appropriate levels of privacy. Existing collaborative systems only offer rudimentary presence awareness information. This is because these systems cannot provide sufficient privacy and security guarantees.

[0004] Problems and limitations of prior presence awareness initiatives in collaborative systems are overcome in a presence awareness system that enables a user to set presence awareness policies, and that provides a reasonably high assurance that the presence awareness system will correctly implement those policies. Specifically, the presence awareness system is such as to enable users to specify complex presence awareness policies. The presence awareness system is also such as to have been verified by employing systematic state-space exploration tools to establish a high level of assurance that the presence awareness system has the capability to implement correctly, substantially all possible presence awareness policies. Further, in accordance with another aspect of the invention, the presence awareness policy specifications are modular relative to the rest of the presence awareness system, and can be modified without having to modify computational modules or user interface program code of the presence awareness system.

[0005] In accordance with another aspect of the invention, a user has the capability to update his or her presence information.

[0006] In accordance with still another aspect of the invention, the presence awareness system automatically collects presence information about the user and automatically updates his or her presence information.

[0007] In accordance with yet another aspect of the invention, the presence awareness system may use specification-based testing at run-time to monitor whether some users' presence awareness policies have inadvertently been violated, further strengthening the reliability of the system.

[0008] FIG. 1 shows, in simplified block diagram form, details of a collaborative communications system in which the invention may advantageously be employed;

[0009] FIG. 2 is a flow diagram illustrating steps in processes employed in implementing embodiments of the invention;

[0010] FIG. 3 is a flow diagram illustrating steps of possible processes employed in the embodiments of FIG. 2;

[0011] FIG. 4 is a flow diagram illustrating steps of possible processes which may be employed in the embodiments of FIG. 2;

[0012] FIG. 5 is a flow diagram illustrating steps of possible processes which may be employed in the embodiments of FIG. 2; and

[0013] FIG. 6 is a flow diagram illustrating steps of possible processes that may be employed in the embodiments of FIG. 2.

[0014] At the outset it is felt best to highlight some issues regarding presence awareness. The ability to convey “presence awareness” is rapidly becoming an important component of many collaborative applications. For example, many calendar programs support sharing, so that coworkers can see when others are busy, or even see the contents of others' calendar entries. This detailed information can be extremely valuable for quickly locating colleagues, or for reviewing agendas of ongoing meetings to stay abreast of current issues and decisions.

[0015] Awareness information is particularly important for large, global organizations. In geographically distributed software development, for example, one of the most serious problems is the time it takes to resolve issues involving people at more than one site. Presence information could go a long way toward alleviating problems like phone tag by informing distant colleagues about who is actually available, and when.

[0016] Similarly, simple kinds of presence awareness (as in by AOL Instant Messenger) have gained tremendous popularity in the general population. For example, teenagers actively use these features to communicate with friends. Family members use these features to communicate with relatives that live elsewhere.

[0017] Many kinds of data can be used by current applications for presence awareness purposes, including whether a person is logged on (as in AOL Instant Messenger), audio and video of varying resolution, location information, and information about current environment (e.g., has the screen saver engaged, what web site is the user currently browsing, what file is currently being edited). Many kinds of “presence” data are generated automatically by the user's activities. Applications will be able to take advantage of additional sources of information as networks move toward convergence, i.e., carrying telephony and video, as well as, data from networked applications. Nearly any detectable event could conceivably find a legitimate use in some “presence aware” application.

[0018] From the users' point of view, there is a fundamental tradeoff between access to presence data for legitimate uses, and concerns about privacy. Precisely to the extent that a user A is able to identify what another user B is doing, user A can communicate with user B when the need arises, make his/her communications more timely and convenient for user B, and generally be a more effective colleague, or more accessible or responsive friend or family member. This is the sort of information, however, that users would generally not like to provide to strangers, nor perhaps to managers, competitors, or friends and family members. Moreover, the data are largely generated automatically and potentially quite frequently, so users cannot be expected to monitor all presence events in order to ensure appropriate levels of privacy.

[0019] There are similar issues, of course, in managing access privileges more generally, for example in a file system. While implementations vary considerably, a good solution is conceptually quite simple. Each user has control over their own data, and the ability to determine what, if anything is available to other individuals, groups, or even roles. In a similar way, one could specify the availability of the various types of “presence” data. Presence awareness data in collaborative applications, however, presents several software engineering challenges that evade such solutions.

[0020] Policies regarding access to data in collaborative applications have subtle complexities, and the data to which they are applied are highly dynamic. For example, applications such as NetMeeting allow everyone in an application-sharing collaborative session to see many windows open on one user's (user 1) desktop. It may be the case that this user has permission to view certain “presence” data about another user (user 2), for example, current phone activity, current location, calendar entries, or the contents of a chat window. If this is displayed on user 1's desktop, it may inadvertently be made available to everyone else in the application sharing session, even if the other participants do not have the correct access privileges. One might call this a violation of a“non-transitivity” policy.

[0021] Another example of the subtleties of these policies comes from the practice of “lurking”, i.e., listening and/or viewing without otherwise participating, and perhaps without others' knowledge. This may often be desirable, for example, allowing students to observe ongoing scientific data collection and analysis activities and the accompanying conversation first hand. In other situations, it may be considered rude or even threatening to allow a user to acquire data about other users that he or she does not permit them to acquire data about him or her. One would like to be able to define a complex presence awareness policy, for example, of “mandatory reciprocity,” which would allow user 1 to access information concerning user 2 only if user 1 allows user 2 to access the same data about user 1.

[0022] It is desirable to be able to specify complex presence awareness policies. For example, such complex presence awareness policies may include fine-grained privileges, mandatory reciprocity, non-transitivity or the like. Fine-grained privileges are, for example:

[0023] A user “A” can explicitly or implicitly set access privileges to other users on an individual or group basis. The access privileges and presence information to individual ones or groups of other users may differ. For example, user “B” may have access to user A's real name, while user “C” may only have access to user A's pseudonym. Importantly, neither user B nor user C can discover, via the system, the access privileges of the other. Furthermore, any user “D” can access information concerning user A or contact user A only in accordance with the access privileges explicitly or implicitly granted to user D by user A.

[0024] Mandatory Reciprocity is, for Example:

[0025] A user A can access information concerning a user B, if and only if, user A allows user B access to same information about user A, and user A can contact user B, if and only if, user A allows user B to contact user A in the same manner.

[0026] Non-transitivity, is for Example:

[0027] A user A allowing access to a user B allowing access to a user C does not necessarily imply that user A allows access to user C, i.e., user C cam access user A's information only if explicitly or implicitly allowed to do so by user A.

[0028] Policy specifications must be modular and easily modifiable during collaboration. In general, it is impossible to specify the “correct” policy in advance of actual use of a given collaborative application. Builders of collaborative tools must generally be able to try out various policies and quickly adjust them to suit the sensitivities of their user communities. Further, the desired policies may change rapidly as users gain more experience with the system. There may also be considerable variation in the policies desired by different groups of users within a single company. Moreover, a user would like to be able to add people to a session, change the level of permissions, and so on, without concerns that user's privacy will be violated. Today's collaborative systems are not amenable to rapid policy specification and modification, since data access policies are generally embedded in computation modules and user interface code.

[0029] Users must be able to have a high degree of confidence that the implementations of these policies are correct. Otherwise, users will abandon an application very quickly.

[0030] Collaborative systems, by their very nature, are highly concurrent. Users are typically represented as concurrent elements, whose behavior cannot be serialized without unduly constraining their actions. Such systems are notably hard to test because their components may interact in many unexpected ways. Traditional testing techniques are of limited help since test coverage is bound to be only a minute fraction of the possible behaviors of the system. Hence, these techniques do not provide sufficient confidence of the correctness of subtle and complex user policies.

[0031] Rapid, modular specification and modification of policies, even the complex policies described above, are achieved through the use of a collaborative architecture, one example of which is a Collaborative Objects Coordination Architecture (COCA). Testing for violations of policies specified in COCA is achieved by using a tool for systematically testing concurrent systems, one example, being VeriSoft, and through runtime specification based testing. Regarding VeriSoft, see an article authored by P. I. Godefroid entitled “Model Checking for Programming Languages using VeriSoft”, In ACM Symposium on Principles of Programming Languagespages 174-186, January 1997, and U.S. Pat. application Ser. No. 09/083069, filed May 21, 1998, now U.S. Pat. No. 6,102,968 issued to C. Coby et al. on Aug. 15, 2000.

[0032] Referring now to FIG. 1, it shows, in simplified block diagram form, details of a collaborative communications system 100 in which the invention may advantageously be employed. The collaborative communications system 100 (hereinafter referred to as Presence Awareness (PA) system) of FIG. 1 includes the following functions.

[0033] It allows users to inquire about more sophisticated (and sensitive) kinds of presence information about others.

[0034] It allows users to dynamically specify their presence awareness policies, in order to control others' access to their own presence information.

[0035] Specifically, shown in FIG. 1 are collaborative infrastructure 101, user interface 102, a first group of user interfaces 103-1 through 103-N, a second group of user interfaces 104-1 through 104-Y and presence awareness (PA) database 105. Note that users of user interfaces 102, 103 and 104 are herein also referred to as user 102, a user 103 and a user 104. Thus, only one single user 102 and two groups of users, namely, 103-1 through 103-N and 104-1 through 104-Y, are shown for simplicity and clarity of exposition. It will be apparent that any desired number of so-called individual users and/or groups of users may utilize the collaborative system 100 including embodiments of the invention. Each of user interfaces 102, 103 and 104 includes one or more collaboration tools such as web browsers, a whiteboard, various audio/video (A/V) tools or the like to collaborate with each other. Additionally, the user interfaces may also include persistent memory units.

[0036] User interfaces 102, 103 and 104 of FIG. 1 support the following user activities.

[0037] Presence Information About a User May be Updated Explicitly Through User Actions, or Implicitly Through Sensors.

[0038] A user may explicitly update his presence information by logging in or logging out. The willingness to interact is iconified, for example, by the state of a door on the user's screen. An implicit presence awareness change may occur through sensors that detect and report the time-varying activities of a user, e.g., GPS (Global Positioning System) for user location tracking. In the Presence Awareness (PA) System 100 (FIG. 1), implicit presence awareness changes are modeled through a screen saver that reports user screen activities. For example, when a user has not been actively using input devices (e.g., mouse and keyboard) for a given period of time, a screensaver comes on. When the user touches some input device after a period of inactivity, the screensaver goes off. The screensaver off and on events are automatically generated by the user interface.

[0039] For these user activities, the user interface sends the following kinds of messages to the rest of the Presence Awareness System:

[0040] login, logout, screensaver(on), screensaver(off)

[0041] Users May Inquire About the Presence of Other Users.

[0042] For example, users may be interested in:

[0043] Login status of a user X, e.g. is X currently logged on and since when?

[0044] Screen saver status of X, e.g. is X's screen saver on or off, and since when?

[0045] Is X currently in a collaborative session, such as chat? Who are the other participants? How long has he or she been chatting?

[0046] What is the door status of X? What are the access rules and settings of X?

[0047] What is X's calendar, location, phone number, email address, etc.?

[0048] In some situations, e.g. a group discussion, anonymous participation often encourages contributions. All participants are anonymous by default, i.e., after a user X logs in, other participants only see a pseudo name unless the disclosure of X's real name is allowed explicitly by user X. Thus, users may be interested in finding out the real names of others.

[0049] For these user activities, the user interface sends the following kinds of messages to the rest of the system:

[0050] check-availability (X), check-name(X),

[0051] check-chatters(X)

[0052] The messages received by the user interface from the rest of the Presence Awareness System are:

[0053] available(X), unavailable(X), name(real(X), pseudo(Y)),

[0054] chatters(SID, SetOfChatters)

[0055] where each chat session is identified by a globally unique id “SID”.

[0056] Users May Communicate With Other Users.

[0057] Users can interact with other users through collaborative communication, including for example, multi-party text chat. Users may initiate a collaborative communication session, invite others to join an existing session, request to participate in an existing session, accept or decline others' requests to join a session, or leave a session. Once a user becomes a participant in a collaborative communication session, he or she can send messages to other users (in a multi-party text chat, for example, these messages will appear on other participants' screen. Customized admission control policies dictate the rules for joining sessions; for example, it may require the session initiator's consent, or a vote of all participants that shows the consent of the majority.

[0058] Multiple collaborative sessions can be active simultaneously across the Presence Awareness system 100 users. For these activities, the user interface may send or receive the following kinds of messages from the rest of the Presence Awareness System:

[0059] invite(SID, Inviter, Invitees), apply(SID, X),

[0060] accept(X, SID), reject(X, SID), message(SID, X,Text),

[0061] leave(SID, X)

[0062] Users May Set/Modify Their Presence Awareness Policies.

[0063] This PA system 100 gives a user the capability to express his willingness to engage in casual interactions and to control which part of his private data can be accessed by whom. If the door is set open, then the user is ready for invitations to join collaborative sessions from any other users. If otherwise the door is closed, then in principle this user should not be interrupted by any invitations.

[0064] Exceptions exist however, and are critical for collaborations. For example, in a closely coupled work team, a user may give (some of) his colleagues the privilege to interrupt his even if his door is closed. Queries regarding the private data of a user, for example, whether the user is available, what is the real name of the user, the recent collaborative activities of the user can also be explicitly allowed or disallowed. All these motivate the specification of exception rules that are in the following form

[0065] set(Condition→Action)

[0066] where Condition is a boolean expression and Action is an action expression. When it is in the form p^<i> it means that user i can take action p. When it is in the form, p^<i> it means user i can not take action p. An exception rule as such means if Condition evaluates to true then Action is enabled. For example, rule door(closed)→invited^<j> means even if the door of the user in question say i is closed, user j can send an invitation to i to join a collaborative session. Rule true→check(name, pseudo(i))^<j> means under no circumstances should user j check the real name of user i by i's pseudonym. The right of access can be granted to individuals, set of designated users, user groups, even sets of users dynamically decided by a predicate.

[0067] To economize, one often defines implicit rules and explicit rules instead. For example, the implicit rule is, when the door of a user say X is open, in general, any other users can send X an invitation to join a collaborative session; and when X's door is closed, in general, nobody can send X the invitation. To explicitly exclude a user say j from sending an invitation to user i even if i's door is open, the following exception rule can be set

[0068] door^<i> (open)→invite^<j>

[0069] And to explicitly grant j the permission to invite i even if i's door is closed, the exception rule can be set

[0070] door^<i> (closed)→invite^<j>

[0071] A more sophisticated complex presence awareness policy, reciprocal permission, may say that j can invite i when i's door is closed given that i can invite j; a similar policy can be specified for finding out real names instead of pseudonyms.

[0072] For these user activities, the user interface sends out the following kinds of messages to the rest of the system:

[0073] set(door(open)), set(door(closed)), set(ExceptionRule)

[0074] The collaborative infrastructure 101 of FIG. 1 includes a presence awareness controller (PA Controller), namely, PA Controller 106 associated with user interface 102, PA Controllers 107-1 through 107-N associated with user interfaces 103-1 through 103-N, respectively, PA Controllers 108-1 through 108-Y associated with user 104-1 through 104-Y, respectively, and PA server 109 associated with PA database 105. Each PA Controller 106, 107 and 107 includes a processor implementing an inference engine, database and storage (role units) for storing presence awareness policy specifications. The database provides an associate memory for capturing and recording state information regarding the associated user during an ongoing collaboration. Additionally, the system allows run-time changes to the roles in collaboration, including modifications to the associated presence awareness policies.

[0075] PA Controllers 106, 107 and 108 handle the collaboration system 100 interaction among the participants, i.e., users 102, 103 and 104, respectively. PA Database 105 that stores awareness information such as users' private data, user activities, and awareness preference settings. PA Server 109 controls access to the PA Database 105. Note that specifying coordination policies is equivalent to defining the behavior of the PA Controller and the PA Server roles and how they coordinate with each other. Each PA Controller and/or PA Server has three so-called gates, i.e., channels: g_into receive messages from its associated user interface (or database), g_outto send messages to its associated user interface (or database), and g_remoteto communicate messages with other PA Controllers and/or PA Servers. Since channel g_remoteis defined on the collaboration bus 110, it can be used to both send and receive.

[0076] Each of the PA Controllers 106, 107 and 108 specifies how a user interacts with other users through the Presence Awareness System 100. A PA Controller 106, 107 or 108 communicates and coordinates with other PA Controllers and the PA Server 109 for the user it represents. In particular, all the PA Controllers together form an intelligent middleware layer in the PA system 100. Some examples of its functionality follow:

[0077] The PA Controller decides whether to forward certain messages either from the local user to other sites (other PA Controllers or the PA Server), or from remote sites to the local user interface, based on the local user's policies.

[0078] Policies are specified by the user in the form of inference rules. The inference engine is part of the PA Controller. Upon receipt of a message from either the local user interface or from remote sites, the engine evaluates the inference rules for a match. The corresponding inference rule is then fired.

[0079] The PA Controller usually “piggybacks” extra information on some messages, for example, digital signature to identify the sender and linear timestamps or vector timestamps to timestamp the messages.

[0080] For efficiency, the PA Controller also buffers some (if not all) of the policy settings and the status of the local user. When the user is sending a command say to reset some policies, the new version is checked with the buffered old version, and only those that are different are forwarded to update the PA Server.

[0081] In the PA system 100, the PA Database 105 and PA Server 109 form a centralized database which stores all awareness information, such as all users' private data, users' activities, and awareness preferences settings. More specifically, the following data are included for all users:

[0082] the time a user is logged on and logged out;

[0083] the time a user's screen saver is activated and deactivated;

[0084] the start time and end time of a collaborative session, who initiated the session, who are involved in the session, and who received the invitation but did not accept;

[0085] a user's accessibility settings, for example, the user's willingness to engage in interactions (door status), who is allowed to see which part of the user private data, who can check the user's availability, who can only see the availability conclusion and who can see how the conclusion is reached as well, exception rules, and so forth.

[0086] When a user logs on to the Presence Awareness system 100, his or her previous anonymity and access settings are retrieved from the database. All the availability checking and notifications are performed by the database. For example, the four messages login, logout, screensaver(on), and screensaver(off) modify the availability of a participant. These messages are sent from a user interface to its PA Controller 106, 107 or 108, which passes them along to the PA Server 109. Upon receipt of any of these four messages, the PA Server 109 queries the PA Database 105 to determine the availability of the participant in question. In particular, a user is said to be available if and only if the user has not logged out since the last login, and either the screen saver has not gone on since the last time it went off or it has always been off.

[0087] The PA Server 109 stores the latest status of a user, and then notifies all participants of any update to anyone's availability status in accordance with the users' policies. When a user, for example 102, wants to check the availability of another user, for example 103, the PA Controller 106 for user 102 passes the request message to the PA Server 109. After querying the database, the PA Server 109 sends an available(user 103) or unavailable(user 103) message to user 102, depending on the actual availability of user 103 and in accordance with the policies of the user 102 and the user 103.

[0088] FIG. 2 is a flow diagram illustrating steps in processes employed in implementing embodiments of the invention. Specifically, the processes are started in step 201 by, for example, user 102 logging into the system. That is the PA system 100 enables a prescribed user to log on. Then, step 202 tests to determine if user 102 wants to modify his/her existing presence awareness policies. If the test result in step 202 is YES, step 203 allows, i.e., enables, the user 102 to modify his/her presence awareness policies and control is passed to step 204. If the test result in step 202 is NO, control is passed directly to step 204. Step 204 is a so-called place-holder in the processes, i.e., a place waiting for some action to be taken. To this end, control may be transferred to step 205 where anyone of a number of sub-processes may be effected as shown in FIG. 3, 4, 5 or 6. Upon complete of the processes of step 205 control is returned to step 204.

[0089] FIG. 3 is a flow diagram illustrating steps of possible sub-processes that may be employed in the embodiments of FIG. 2. Specifically, the processes are started in step 301 which is a so-called source state, i.e., an initial state, that could be, for example, the place-holder state 204 in FIG. 2. Thus, step 302 allows, i.e., enables, in this example, the user 102 to manually update his/her presence information. This presence information may include their door status, availability information, location, calendar information, phone number, email address, or the like. Then, control is returned to state 301. Step 303 causes the system to automatically collect presence information, in this example, about user 102 and automatically updates his/her presence information in accordance with the collected information. This information may include login status, screen saver status, information about which collaborative sessions user 102 is currently involved, or the like. Then, control is returned to state 301. Step 304 allows, i.e., enables, in this example, user 102, to inquire about the presence information of another user, for example, one of users 103-1 through 103-N. Then, in step 305 PA system 100 provides information about the particular user 103 to user 102 in accordance with the user 103's presence awareness policies. Thereafter, control is returned to state 301. Step 306 allows, i.e., enables, in this example, one of users 103-1 through 103-N, to inquire about the presence information of another user, for example, user 102. Then, in step 307 PA system 100 provides information about the user 102 to the particular user 103 in accordance with the user 102's presence awareness policies. Thereafter, control is returned to state 301. In steps 305 and/or step 307, the system may use specification-based testing at run-time to check that users' policies have not inadvertently been violated.

[0090] FIG. 4 is a flow diagram illustrating steps of possible sub-processes that may be employed in the embodiments of FIG. 2. The steps in the sub-processes of FIG. 4 that are identical to those steps in FIG. 3 have been similarly numbered and will not be discussed again. As shown, after completion of either step 302 or step 303, control is transferred to step 401. Step 401 causes PA system 100 to automatically update all users that have been informed of, for example, user 102's presence information with new presence information about user 102's presence obtained in either of steps 302 or 303, in accordance with user 102's presence awareness policies. Thereafter, control is returned to state 301. In step 401, the system may use specification-based testing at run-time to check that users' policies have not inadvertently been violated.

[0091] FIG. 5 is a flow diagram illustrating steps of possible sub-processes that may be employed in the embodiments of FIG. 2. The steps in the sub-processes of FIG. 5 that are identical to those steps in FIG. 3 have been similarly numbered and will not be discussed again. Thus, step 501 allows, in this example, user 102 to manually modify his/her presence awareness policies or, alternatively, PA system 100 automatically modifies user 102's presence awareness policies in a manner pre-specified by user 102. Then, control is returned to state 301.

[0092] FIG. 6 is a flow diagram illustrating steps of possible processes that may be employed in the embodiments of FIG. 2. The steps in the sub-processes of FIG. 6 that are identical to those steps in FIG. 4 and FIG. 5 have been similarly numbered and will not be discussed again. Thus, on the completion of step 501 control is transferred to step 601. Step 601 causes PA system 100 to automatically update all users that have been informed of, for example, user 102's presence information with new presence information about user 102's presence obtained in either of steps 302, 303 and 501, in accordance with user 102's presence awareness policies. Thereafter, control is transferred to state 301. In step 601, the system may use specification-based testing at run-time to check that users' policies have not inadvertently been violated.

[0093] Returning to FIG. 2, in step 206, user 102 indicates to PA system 100 via user interface 102 that he/she wants to join an existing collaborative session. Step 207 tests to determine if the policies of the existing session and those of the current participants in the session allow user 102 to join, i.e., participate, in the session. If the test result in step 207 is NO, step 208 so notifies user 102 and control is returned to step 204. If the test result in step 207 is YES, control is transferred to step 209, and AP system 100 is caused to allow, i.e., enable, user 102 and current participants in the ongoing session to communicate via the session. In step 209, the system may use specification-based testing at run-time to check that users' policies have not inadvertently been violated. While in step 209 control may be transferred to step 210, and either of the sub-processes shown in FIG. 3, 4, 5 or 6 may be employed therein. It should be noted, however, the sub-process employed in step 210 will be the same sub-process that is employed in step 205, and described above. That is, if the sub-process shown in FIG. 3 is employed in step 205 the same sub-process is employed in step 210. The same is true for the sub-processes shown in FIGS. 4, 5 and 6. After completing the sub-process in step 210 control is return to step 209 and the session continues until some other indication occurs. Step 211 will cause PA system 100 to return control back to step 204 if, in this example, user 102 drops out of the ongoing session, or the current session is terminated by the participants or PA system 100, or user 102 indicates that he/she wants to join another existing session, or user 102 indicates that he/she wants to set up a new session. Then, control is returned to step 204, where appropriate action is initiated by PA system 100. That is, PA system 100 causes either steps 205 through 211 to be effected in joining another existing session, or steps 205, 212 though 215, 210 and 216 to be effected to set a new session.

[0094] While in step 204, user 102 in this example, in step 212 may indicate to PA system 100 that he/she wants to set up a new collaborative session to communicate with, for example, one or more of users 103-1 through 103-N. Then, step 213 tests to determine if the policies of the one or more of users 103-1 through 103-N and the PA system 100 policies for that type of session allow user 102 to set up such a session. If the test result in step 213 is NO, step 214 so notifies user 102 and control is returned to step 204. If the test result in step 213 is YES, control is transferred to step 215. Step 215 causes PA system 100 to allow, i.e., enable, in this example, user 102 and one or more of users 103-1 through 103-N to communicate via the session. In step 215, the system may use specification-based testing at run-time to check that users' policies have not inadvertently been violated. While in step 215 control may be transferred to step 210, and either of the sub-processes shown in FIG. 3, 4, 5 or 6 may be employed therein. It should be noted, however, the sub-process employed in step 210 will be the same subprocess that is employed in step 205, and described above. That is, if the sub-process shown in FIG. 3 is employed in step 205 the same sub-process is employed in step 210. The same is true for the sub-processes shown in FIGS. 4, 5 and 6. After completing the sub-process in step 210 control is returned to step 215 and the session continues until some other indication occurs. Step 216 will cause PA system 100 to return control back to step 204 if, in this example, user 102 drops out of the ongoing session, or the current session is terminated by the participants or PA system 100, or user 102 indicates that he/she wants to join an existing session, or user 102 indicates that he/she wants to set up another new session. Then, control is returned to step 204, where the appropriate action is initiated by PA system 100. That is, PA system 100 causes either steps 205 through 211 to be effected in joining an existing session, or steps 205, 212 though 215, 210 and 216 to be effected to set another new session.

[0095] The above-described embodiments are, of course, merely illustrative of the principles of the invention. Indeed, numerous other methods or apparatus may be devised by those skilled in the art without departing from the spirit and scope of the invention.