text:
In scalable multi-process and possibly multi-node application environments, the management of sensitive data, such as cryptographic keys, is complicated by the number of processes, the frequency at which they are created and destroyed, and by the desire to avoid storing any keys in the clear in these processes or in data files. The present invention defines a central autonomous process, called the Key Repository process, which is tasked with many functions, including controlling and limiting the distribution of the relevant sensitive information, authenticating operators and policy owners, and performing key renewal operations. The Key Repository process is initiated by multiple acts of human intervention, in combination, thus allowing for the shared responsibility of ownership. Once the Key Repository process is initiated and configured, it enforces the policy decisions of the enterprise. At no point is the sensitive data written to the disk in the clear.
1.-6. (canceled)
7. A method implemented in a computer system, comprising:
generating a public key/private key pair;
encrypting data using the public key;
generating a protection key;
encrypting the public key using the protection key;
storing the encrypted data and the encrypted public key in a first database record;
encrypting the protection key; and
storing the encrypted protection key in a second database record.
8. The method of
generating a symmetric key based on a unique user identifier; and
encrypting the private key using the symmetric key.
9. The method of
10. The method of
11. The method of
generating an integrity key;
decrypting the encrypted public key using the integrity key; and
storing the integrity key in a third database record in encrypted form.
12. The method of
receiving a request from a requestor for access to the data;
authorizing the request based on a list of authorized requestors;
sending the requested data to the requestor if the requestor is authorized; and
refusing the request for data if the requestor is not authorized.
13. A system, comprising:
a computer;
a database comprising encrypted data, the database accessible to the computer;
a key management process executing on the computer;
an encrypted public key stored in the database, the public key used to encrypt the data; and
an encrypted private key stored in the database, the private key used to decrypt the data;
wherein the key management process executing on the computer uses a first master key to encrypt the public key; and
wherein the key management process executing on the computer uses a unique user identifier to generate a symmetric key, the symmetric key used to encrypt the private key.
14. The system of
an application process executing on the computer, the application process interacting with the key management process to access the data;
wherein the application process provides the unique user identifier used to generate the symmetric key, the symmetric key further used to decrypt the private key.
15. The system of
a list of processes authorized to access the database;
wherein the data from the database is provided to the application process by the key management process if the list of processes authorized to access the database comprises the application process.
16. The system of
17. The system of
18. The system of
19. The system of
20. The system of
a physical memory storing a decrypted master key;
wherein the decrypted master key is not swapped or paged out of the physical memory.
21. A storage medium containing software that can be executed on a processor and that causes the processor to:
generate a public key used to encrypt data;
generate a private key used to decrypt the data;
generate a protection key used to encrypt the public key;
store the data, the public key, the private key, and the protection key in encrypted form in a database; and
generate a symmetric key used to encrypt and decrypt the private key, the symmetric key generation based on one or more unique user-ID/password pairs.
22. The storage medium of
23. The storage medium of
generate an integrity key used to decrypt the public key; and
store the integrity key in encrypted form in the database.
24. The storage medium of
accept a request for access to the data by a requestor;
grant the request for access to the data if a list of authorized requestors comprises the requestor; and
refuse the request for access to the data if the list of authorized requestors does not comprise the requestor.
This application is related to and incorporates herein by reference U.S. applications entitled as Follows:
�Scalable Computer System Using Password-Based Private Key Encryption� (Docket No. 20206.30 (P003014)), Ser. No. ______, Filed ______;
�Method And Apparatus For Enforcing The Separation Of Computer Operations And Business Management Roles In A Cryptographic System� (Docket No. 20206.31 (P003015)), Ser. No. ______, Filed ______;
�Software Process Pre-Authorization Scheme For Applications On A Computer System� (Docket No. 20206-32 (P00-3016)), Ser. No. ______, Filed ______;
�Multiple Cryptographic Key Linking Scheme On A Computer System� (Docket No. 20206-33 (P00-3017)), Ser. No. ______, Filed ______;
�Centralized Cryptographic Key Administration Scheme For Enabling Secure Context-Free Application Operation� (Docket No. 20206-34 (P00-3416)), Ser. No. ______, Filed ______;
�Scalable Computer System Using Remote Agents To Manipulate Cryptographic Keys� (Docket No. 20206-35 (P00-3417)), Ser. No. ______, Filed ______;
�Method And Apparatus For Cryptographic Key Rollover During Operation� (Docket No. 20206-36 (P00-3418)), Ser. No. ______, Filed ______; and
�Computer System Employing A Split-Secret Cryptographic Key Linked To A Password-Based Cryptographic Key Security Scheme� (Docket No. 20206-38 (P00-3420)), Ser. No. ______, Filed ______.
1. Field of the Invention
The present invention is related to computer security. More specifically, the present invention is related to cryptographic systems on computer servers.
2. Description of the Related Art
The advent of the Internet has spawned a new means for conducting business. Commerce that is conducted online, such as via the Internet or virtual private networks, is called e-commerce. E-commerce mimics many of the steps of regular commerce. However, because of the nature of cyberspace, the parties may never have met and may never meet. To accommodate business transactions where the parties never meet or know each other, various schemes have been devised to ensure secure and verifiable business transactions.
The security of the e-commerce transaction is accomplished through encryption schemes. The authenticity and other necessary aspects of commerce are handled through trust relationships. Often, these trust relationships are implemented through trusted third parties and are erected as part of the online business infrastructure.
Computing systems evolved away from mainframe computers in the 1960's and 1970's to a distributed environment consisting mainly of personal computers in the 1980's and early 1990's. However, with the advent of the Internet, powerful servers (descendants of the old mainframe computers) have regained their former importance. Internet-connected servers now run software applications for client systems and perform business-to-business transactions and business-to-consumer transactions. In many cases, these transactions include sensitive information, which must be protected against unwanted exposure (privacy) or modification (integrity), or both. In some cases, there's a requirement that there be strong evidence of an event having taken place (non-repudiation), to further the resolution of disputes. People worlding in the field of cryptography have developed various schemes and methods have to provide such facilities. One of the crucial infrastructures of online business is trust A trust relationship can be erected using computer servers (and clients) that are equipped with software encryption applications.
A typical prior art public key encryption scheme is the RSA scheme, which is described in U.S. Pat. No. 4,405,829 to Rivest et al; R. L. Rivest, A. Shamir, and L. M. Adleman, �A Method for Obtaining Digital Signatures and Public-Key Cryptosystems,� Communications of the ACM, v. 21, n. 2, February 1978, pp. 120-126; �R. L. Rivest, A. Shamir, and L. M. Adleman, �On Digital Signatures and Public Key Cryptosystems,� MIT Laboratory for Computer Science, Technical Report, MIT/LCS/TR-212, January, 1979. The RSA scheme is used both for encryption and digital signatures. The RSA scheme is often combined with other technologies to provide privacy, integrity, and non-repudiation. Cryptographic systems, and the terminology used in the discipline, are described in �Applied Cryptograpy� by Bruce Schneier (John Wiley & Sons, Inc., New York, 1996).
RSA Scheme
According to Bruce Schneier, �RSA gets its security from the difficulty of factoring large numbers. The public and private keys are functions of a pair of large prime numbers (100 to 200 digits or even larger). Recovering the plaintext from the public key and the ciphertext conjectured to be equivalent to factoring the product of the two primes.� Bruce Schneier, �Applied Cryptography� Second Edition, John Wiley & Sons, Inc., New York, 1996, pp. 467.
Under the RSA scheme, to generate the two keys, one chooses two random large prime numbers, p and q. For maximum security, one chooses both p and q to be equal in length. Next, one computes the product:
Again, referring to Schneier, to encrypt a message, you first divide the message into numerical blocks smaller than n (with binary data, one simply chooses the largest power of 2 less than n). For example, if both p and q are 100-digit primes, then n will have just under 200 digits and each message block, mi, should be just under 200 digits long. The encrypted message, c, will be made up of similarly sized message blocks, ci, of about the same length. The encryption formula is simply:
There is another prior-art scheme that deals with the problem of splitting a secret into several components so that no one individual or group of individuals can produce the secret unless the required number of components are available. Often called an M-out-of-N scheme, it allows the customer to reduce the risk of malfeasance by requiring that M out of N (where M is one or more but less than N) people all agree to certain acts. One such M-out-of-N implementing algorithm is the Bloom-Shamir algorithm that is defined in �Generalized Linear Threshold Scheme� by S. C. Kothari, (Proceedings of CRYPTO 84). See also: S. C. Kothari, �Generalized Linear Threshold Scheme,� in Advances in Cryptology�CRYPTO '84�, G. R. Blakley and D. Chaum, eds.; and Lecture Notes in Computer Science volume 196 (1985), pages 231-241.
Software tools are available for implementing cryptographic schemes into software applications and user-interfaces. One such tool kit is called �BSAFE� and is produced by RSA Security of Bedford, Mass. Information regarding BSAFE and other products, and about public key infrastructure, is available at the RSA web site at http://www.rsasecurity.com/.
Public Key Cryptographic Standards (PKCS)
Widely used methods of performing cryptographic operations are described in the Public Key Cryptographic Standards (PKCS), a set of standards for public-key cryptography developed by RSA Laboratories [PKCS]. The present invention makes use of:
The Microsoft Corporation of Redmond, Wash., developed a technology in 1996 that enables users of the Internet's World Wide Web to download binary code (libraries and programs) in a manner that ensures the authenticity of the code. This technology has been dubbed �Authenticode� and is the subject of a white paper published by Microsoft in 1996 entitled �Microsoft Authenticode Technology, Ensuring Accountability and Authenticity for Software Components on the Internet.� The document is available via the Internet at: http://msdn.microsoft.com/workshop/security/authcode/authwp.asp and is herein incorporated by reference.
According to the white paper,
The Operational Paradigms
The growth of e-commerce requires that end-users be assured that their transactions are private, unmodified, and provable. The cryptographic techniques described above are often used to provide these attributes. In such a transaction, it is important to note the role of the originator of the transaction in exercising independent will to do the transaction. In the workstation paradigm, it is possible to follow the steps of a transaction from the originator's perspective as follows, assuming that the originator is using, for example, a personal computer or terminal:
The originator decides what is to be done. This is the act of independent will, and will most often by done by a live person. Using the computer, the originator supplies the necessary information defining the nature of the transaction. This could be something like �Please transfer $100.00 from my checking account to my savings account.� How this is done is not really important. The originator instructs the computer to sign and encrypt the data. The encryption step will ensure the privacy of the information as it flows from the computer to its destination (perhaps a bank). The digital signature will provide integrity and dissuade repudiation. The digital signature is evidence that the originator did create the event and that the event actually happened. This is useful in case the recipient of the request wants to prove that the originator requested it rather than some impersonator.
Signing the data requires that the computer have access to the private keys (cryptographic secrets) of the originator. Encrypting the data requires that the computer have access to the public key of the intended recipient, and the authenticity of that key can be proven provided the computer program has access to a trust root. The computer will ask for a secret that known only to the originator, such as a password, which will unlock the private keys and trust roots, and allow the signing and encryption to go forward. After the data has been signed and encrypted, the computer will erase the secret keys and passwords to reduce the risk of their being used again without obtaining the originator's active consent. It is important to note, in the above sequence of steps, that the originator was personally involved in the process, and only with consent did the digital signing occur.
Unlike the above workstation situation, servers usually need access to keys all the time. Whereas the originator was present to provide needed passwords, servers are often unattended. Similarly, in the workstation paradigm, a small number of events are occurring concurrently. However, in the server paradigm, large numbers of concurrent events are occurring, each of which may require the use of secret information.
In the workstation paradigm, the originator is involved in credential renewal, comparable to renewing one's driver's license. In the server paradigm, one cannot suspend business operations while new keys are issued.
Additionally, the need to protect keys against exposure can be different. In a workstation environment, exposure of keys could cause problems with the originators resources, but the damage would be confined to this one person, and the cost of that damage contained. On the other hand, in a server, compromise of the keys could jeopardize all the users and their accounts. For example, one is generally willing to spend more effort protecting a bank's resources than one is willing to spend to protect an individual's resources.
In the past, the problem of the server environment has been addressed by a variety of efforts. Application designers are faced with a dilemma of how to protect these secrets (typically cryptographic keys). Storing them in a text file, or within a program, or even in an independent box, is an open invitation to fraud. Text files can be copied and examined easily by most anyone with access to the computer (in fact, really protecting a file system is difficult). Keys stored in programs can make the program files themselves a valuable target of fraud. Keys stored in independent boxes become vulnerable because it is difficult to control which programs or which agents access the box.
Furthermore, relying upon firewalls helps protect the secrets against external attack, but leaves unguarded fraud from corruptible employees. Traditional banking practice requires multiple individuals to perform certain tasks, such as opening a vault. To enforce this requirement, separate keys are entrusted to separate trusted officers, although requiring both keys to unlock the vault.
The prior art public key infrastructure (PKI) schemes are built upon a �workstation paradigm.� The workstation paradigm has an individual user, at a given workstation, that utilizes encryption technology on the workstation to send encrypted messages to another person, or themselves at another workstation. In the workstation paradigm, servers are used only as transport mechanisms. The advent of the worldwide web of the Internet has eroded many of the underlying assumptions of the workstation paradigm. Unfortunately, the prior art PKI schemes have not kept pace. There is, therefore, a need for a crypto-system that allows multiple simultaneous users having multiple sessions while preserving security and integrity of both keys, signatures, access rights, and an apparatus and method to enable automated trust relationships on computer server for multiple applications and multiple users.
The present invention provides a paradigm shift from the workstation-centric cryptographic system to a server-centric cryptographic system. The core of the present invention is a Key Repository process that acts as the centralized administrator for the retention and maintenance of cryptographic keys.
Specifically, the Key Repository process of the present invention addresses the management of trust within an enterprise. The Key Repository process of the present invention does not replace the traditional functions performed by firewalls and sound security policy, it simply augments them. A Key Repository process is initiated with human action, and after the necessary steps of authentication and authorization, the keying material is made available to this process. The Key Repository process is the only program in the computer system that knows the critical secrets. The Key Repository process will supply selected keying material to pre-authorized applications, thus limiting the spread of the secret information, and eliminating the need for human intervention after system startup. The Key Repository process enforces policy decisions in such areas as identifying authorized applications, changes in parameters, and does so by requiring multiple approvals before changes are implemented. In addition, software programs can be pre-authenticated to act as an extension to the Key Repository process.
The Key Repository process never records sensitive data in the clear on disks, avoiding the problems that could occur if there was any unauthorized access to the disk storage, or to the disk or backup media. Should someone have access to such disk or backup media, uncovering the secrets would be infeasible since the attacker would have to have access to multiple distributed passwords. The memory and internal data transfer paths are presumed to be secure enough to handle the movement of sensitive data. The Key Repository process also enforces a variety of security policies, such as authenticating operators and owners, controlling the lifetime and quality of generated keys, requiring multiple approvals before changing security parameters, etc.
Application programs, implementing the customer's business functions, may request copies of keys or other cryptographic secrets. To prevent some rogue or unauthorized programs from obtaining keys, each program entitled to receive keys must be authorized by the key owners. This removes the necessity for programmers to embed keys within a program, to store them in the clear on data files, or to be present to supply passwords when the application program is initiated.
In most environments, the Key Repository process can be expected to be present and provide the needed services on demand, allowing it to partake in mission-critical business applications. The Key Repository process can thus be expected to survive even in the face of the usual single points of failure that are allowed for by the computer system. This means that the human restart of the Key Repository process is needed only rarely.
Using commands or directives issued to Key Repository process, the customer's staff interacts with the Key Repository process. Many of the activities are considered security related, in that they involve the extension of trust. For these activities to become effective, the approval of one or more individuals is required. Initially, the system requires just one approved individual, but this number can be changed to any number (the change itself is of course a security-related operation). For example, the customer might want to require that any five out of nine key owners to approve of certain security parameters. These key owners are individuals with a name and password, known to the Key Repository process' database.
Security related operations include the following types of functions:
These features permit the enterprise to manage and control e-commerce applications, while enforcing the security policy that fits the business model. Authorized application programs have access to the cryptographic secrets needed to fulfill the business functions, but no single individual (or small group of individuals) can easily compromise the security of the system.
The present invention solves the problems inherent in the prior art by providing an apparatus and method for mimicking the human login process for specific and individual processes on a server-based computer system. Although the present invention may be deployed on a wide variety of computer architectures, in its best mode, the present invention is used on high-availability servers, such as the Non-Stop� Himalaya server systems produced by the Compaq Computer Corporation of Houston, Tex.
The method and apparatus of the present invention enable end entities to conduct commerce over unprotected networks (such as the Internet) in a secure fashion. In cryptographic parlance, an end entity is a person, router, server, software process, or other entity that uses a digital certificate to identify itself In the context of the present invention, the definition of �consumer� includes any end entity. However, the definition of �consumer� for the present invention is broader in that it can include both people and organizations (both de facto and de jure). �Consumer� is, interchangeably, also referred to herein as a �client.� In this sense, the consumer of the present invention can be an individual (with or without their own digital certificate) sitting at home trying to access their bank accounts. It can also be a business enterprise that has an automated software agent purchasing products based upon some pre-defined criteria. It will be apparent to those skilled in the art that the consumer of the present invention can be a wide variety of entities (real, legal, and abstract).
The term �enterprise,� in the context of the present invention, has essentially the same definition of �consumer.� A separate term is used in order to illustrate more clearly the two sides of a transaction using the present invention. In practice, however, a consumer is typically a person or small business organization. An enterprise can be a business organization of any size. While this is not necessarily always the case, for purposes of the following illustration, a consumer can be thought of as an individual person and an enterprise can be thought of as a business organization even if owned/operated by one person.
The Processes of the Present Invention
The basic architecture of the present invention includes several components as shown in
The present invention uses cryptographic keys to manage confidential information on a database. Two keys form a set of master keys in the present invention. Each of the two master keys performs a specific function within the cryptographic scheme of the present invention. One of the keys is configured within a Key Repository process to maintain the integrity of critical information on the database. The other master key is used within the Key Repository process to protect the confidential information on the database.
An alternate embodiment of the present invention can utilize one master key in the Key Repository process. This single master key would be used both for integrity of the critical information on the database as well as to protect the confidential information. However, use of a single key may give the user pause to let operators have access to a complete key. Therefore, a single master key may require reformulation of the administrative procedures for the generation and use of the single master key.
According to
Password-Based Public-Key Encryption
When the Operator or Owner is introduced to the system, the process of the present invention first obtains a name and a password from the command interface. Second, the process invents a salt value and a public/private RSA key pair. None of these values are revealed to the individual. The RSA encryption scheme requires the use of two keys, one of which is usually public and is not hidden, the other that is private. For purposes of the present invention, a salt value is a random number whose value is known and saved, but itself has no information encoded in it. A salt value is also sometimes called a nonce.
Third, the Operator's or Owner's password is combined with the salt value to compute a symmetric key and initialization vector, and, using any of a number of symmetric encryption algorithms in cipher block chaining (CBC) mode, the operator's or owner's RSA private key that was invented above, is encrypted. The methodology for this is described by RSA's PKCS #5 (password-based encryption), although the method described by RSA has been extended by allowing the customer to specify which hashing algorithm is used, the hash-iteration count, and the symmetric encryption algorithm. For purposes of this application, a hash (also known as a message digest) is a function that takes input data and produces a short answer (typically 128 or 160 bits in length) with the property that, given the answer, it is unfeasible to construct input data, other than the true data, which will produce the same answer. A hash function is often called a �one-way� function. By repeating a hash function, one increases the amount of time it would take to break the one way function by trial-and-error. Thus, hashes are often repeated thousands of times. In addition, the present invention uses the value of the protection key (one of the master keys) to encrypt the RSA public key. This prevents an undetected modification of the protected secret unless the true RSA public key can be exposed.
The secret, which for Operators is the value of the Integrity Key, and for Owner is their share of the value of the Protection Key, is then encrypted by the RSA public key, using the methodology described by RSA's PKCS#1. The database record for the Owner (or Operator) is then written, and contains:
As implied above, the Protection Key 24 is divided into shares. In an embodiment, the Bloom-Shamir sharing algorithm is used for the division. The number of shares is dictated by the count of Owners known to the system. The order of the algorithm (i.e., the number of shares that will be needed to reconstitute the secret) is dictated by the current value of the Approval Count parameter, which can be any number between one and one less than the number of Operators known to the computer system 10.
Although the system of the present invention initially is activated with an Approval Count of one, customers are advised to change the approval count to a higher number in accordance with their own security policy. For example, a banking institution could require that seven out of fifty individuals be required to recreate the bank's Protection Key 24. The use of seven reduces the fraud-risk, and the availability of fifty candidates increases the chances of locating at least seven. In the present invention, the individuals needed to expose the Integrity Key 22 need not be the same set of individuals needed to re-compute the Protection Key 24.
The crucial information in the database 30 is protected against modification by an Integrity Key 22. The confidential data is protected by the Protection Key 24. When the Key Repository process 20 is restarted, one of the Operators known to the system exposes the Integrity Key 22 by use of the correct identity and password, as described below. The Protection Key 24 is assembled from a set of secrets that are split among multiple individuals, known as Owners, according to the Bloom-Shamir methodology. When the requisite number of Owners have exposed their share of the split Protection Key 24, using the methodology described below, the Protection Key 24 can be recovered.
Operators and Owners
In the present invention, two distinct classes of system operators are needed. Operators are responsible for the overall computing environment. Any operator can start the Key Repository process, and in so doing, asserts that the computer system is indeed what it claims to be. In alternate embodiments of this invention, this assertion is used to unlock and expose a set of cryptographic credentials with which the Key Repository process can communicate in a trusted and secure fashion with resources external to the platform, allowing that resource to be, but not limited to, the following set of functions:
Initial Key Creation
When the Key Repository process 20 is executed for the first time, that is, without a database 30 from a prior run, the person initiating the process provides the program with the following information:
The Key Repository process 20 defines these individuals in the database 30, as described above, and creates both a Protection Key 24 and an Integrity Key 22, encoding these values in the database 30 as described above. The values of both the Protection Key 24 and the Integrity Key 22 are then erased from the computer memory, and can be reconstituted by an Operator in conjunction with one or more of the Owners by supplying their respective identity and password.
The method of creating the keys is illustrated in
At this point, because the initial passwords may not have been well protected, it is recommended practice, and part of an embodiment of the present invention, to require that each operator and owner modify his/her respective password without allowing other individuals to see the keystrokes, and that additional Operators and Owners be added to the list of legitimate operators/owners, as required by the customer's security policy, and that other security parameters (such as the approval count, the algorithm selections) are adjusted, as required by the customer's security policy. All of the above suggestions are, however, optional, and it is within the scope of alternate embodiments of the present invention to not use the elements of the above-recommended practice.
In an embodiment of the present invention, the value of the Integrity Key 22, as well as each value of a share of the Protection Key 24, is stored on the database 30 encrypted using the password-based public-key technique. The Operator or Owner by entering his name allows the Key Repository process 20 to find the relevant record in the database 30. The password supplied by the Operator or Owner is combined with a salt value that is stored in the database 30. These values allow the Key Repository process 20 to compute the symmetric encryption key, Esynkey, and an initialization vector IV, as defined by the well known RSA PKCS #5 methodology. These values are then used to decrypt the secret using the methodology defined by RSA PKCS #1. For Operators, the PKCS #1 methodology will expose the Integrity Key 22. For owners, the PKCS #1 methodology will expose their portion of the Protection Key 24. The RSA key pair alluded to is generated by the Key Repository process 20 at the time that the operator or owner entry is initially defined.
The double encryption password-based public-key encryption technique enables the Key Repository process 20 to change the value of either or both the Integrity Key 22 and the Protection Key 24 once the existing key values are known. Moreover, the changes to the keys can be done without access to operator or owner passwords. In an embodiment of the present invention, this key change occurs in several situations, including:
In addition to the secrets and other information mentioned above, the database 30 also contains policy values and entity credentials that include the enterprise's 31 credentials 32. The database 30 also includes the certificates, private keys and trust root. Trust roots (also known as a trust points) are verification certificates known to be authentic, and which can be used to derive the trustworthiness of other certificates using the methodology defined by the Public Key and Attribute Certificate Frameworks ITU X.509, CCIT: Recommendation X.509, ISO/IEC 9594 which is available from the American National Standards Institute (ANSI) 1819 L. Street, NW, Washington, D.C. 20036. Note, the end entity is normally an organization (such as an institution or enterprise). However, alternate embodiments of the present invention include humans in the list of enterprises 32, such as humans or other groupings or entities that own cryptographic keys to be entrusted in a computer program.
The enterprise end-entity 31, whose secrets the Key Repository process 20 is protecting in the form of enterprise credentials 32, is often an institution or enterprise. These secrets are frequently of significant value, and must not be given to unauthorized application programs. For this reason, the Key Repository process 20 records in the database 30 those applications 40 that are authorized to have access to the enterprise credentials 32.
When an application is initially authorized by the key owners (those with portions of the Protection Key 24), the Key Repository process 20 calculates a checksum (akin to the checksum used with Microsoft's Authenticode) that enables the Key Repository process 20 to detect any future modification in the content of the program binary (executable) file. In the embodiment of the present invention, additional commands are available to the owners that direct the Key Repository process 20 to record in the database 30 authorizations that list the enterprise's 31 name and the name of the application 40 and associated program authentication information for which that enterprise's credentials 32 are authorized. This list is used by the Key Repository process 20 to ensure that the application program 40 is authorized to run and to obtain the enterprise credentials 32 of the specific enterprise 31.
Unlike prior art cryptographic schemes where all of the vital keys, or the passwords to unlock those keys, are kept in memory, and where that memory could be recorded on some storage device (perhaps by operating-system functions such as swapping), in an embodiment of the present invention, the clear version of these vital keys and passwords are retained in protected physical memory. In this way, the security of the system is enhanced by making it impractical to recover the keys from non-volatile storage. However, alternate embodiments of the present invention can keep the keys in virtual memory.
Processing Requests for Enterprise End-Entity Keys
Alternate embodiments of the present invention are illustrated in
The alternate embodiment that is illustrated in
It should be noted, however, that remote computer systems, such as the computer system 11 of
Referring to
In both cases illustrated in
The decision whether to grant or to refuse the request is made based upon the information stored in the Key Repository process' database 30. In this database 30, the integrity of information is protected by the Integrity Key 22, and confidential information (such as private keys) is protected by the Protection Key 24. Both of these values are known to the Key Repository process 20, and thus the decision can be then rendered based upon authenticated data.
If the decision is made to grant the access, the enterprise credentials 32 are extracted from the database 30, decrypted using the Protection Key 24, re-encrypted, and returned to the requesting application 40 as a response along with a password to decrypt the data In the example illustrated in
Operation of the Present Invention
Control of Enterprise Credentials and Authentication of Application Programs
The method of the present invention is illustrated in the flow chart of
Next, in step 204, work arrives that is to be performed by the application on behalf of one of the consumers known to the system. The application contacts the Key Repository process in step 206. Next, in step 208, the Key Repository process attempts to authenticate the application, i.e., to determine if the application has been tampered with since it was first registered with the Key Repository process. If the application has not been tampered with (and is one of the applications that is allowed access to the Key Repository process) it is granted access to the Key Repository process, and execution continues to step 210. Otherwise, access to the Key Repository process is denied and execution skips to the end with, optionally, an appropriate error message in step 213 and termination in step 220. If the application has been authenticated, it next requests the enterprise credentials of the enterprise on whose behalf the application is tasked to act, step 210. The Key Repository process then checks, in step 212, whether the requesting application is allowed to have access to the enterprise's credentials. If the Key Repository process determines that access is to be denied, an indication of that result is returned to the requesting application, which, after optionally indicating an error in step 213 and terminates at step 220. If, however, access is to be approved, execution continues to step 214, where the Key Repository process builds a credential file of the end entity for use by the application. Thereafter, in step 216, the Key Repository process transmits (gives) the new credential file, to the application along with a password that enables the application to perform its mission. Thus enabled, the application performs the work on behalf of the consumer (and/or the enterprise) in step 218. In any case, the execution of this method ends in step 220.
Enterprise End-Entity Key Rollover
The Key Repository process is entrusted with the safe-keeping of the private keys and trust roots of an enterprise end-entity. The public keys are contained in digital certificates signed by an issuing authority (such as a Certification Authority). There are several situations which can occur that warrant the potential re-issuance of the certificates. These situations include but are not limited to:
In the workstation model, this is usually performed when the user goes through manual logon, and when the individual's keys are currently not in use. In the server model, however, the keys can be in use at any time, and a �logon� event never really happens.
In an embodiment of the current invention, this issue is addressed directly by the Key Repository process. On a time periodic basis, typically once per day but adjustable by the customer, the Key Repository process will check to see if a certificate re-issuance is called for. While this check is going on, and until it is resolved, one way or another, the old keys remain available to applications. During this check, the Key Repository process may utilize the services of a specialized application that acts as an extension of the Key Repository process, but if so, that application has been duly authenticated and authorized to perform such a function.
If the rollover operation results in new or revised keys, the Key Repository process will store these new values in its database. When that storage operation is completed, subsequent requests from applications will receive the new key values. While the applications are still running, however, they can continue to use the older keys. Such requests from application programs can be stimulated by notification, timeout, encountering stale keys, or other events.
Secure Preservation of Intermediate State
In addition to the above activities, the Key Repository process 20 (of
Context-free programs normally run on what are called context-free servers. It is within the scope of the present invention that the computer system 10 of the present invention can be a context-free server running context-free programs. An example of a context-free program is a web server because the underlying protocol for web transactions, hypertext transfer protocol (http), is stateless and thus free of context. To provide contextual transactions between computer software processes, the embodiments of the present invention can be equipped to retain state (context) information, including confidential information or sensitive information (or data), across one or more instantiations of application processes using the symmetric keys maintained by the Key Repository process. The application in this instance is configured to convey the sensitive context information first by encrypting the sensitive information and then passing the encrypted sensitive information to another instance of the application.
Many transactions involve multiple messages between the submitter and the server. There is often a significant time delay between these messages, especially if the submitter must respond manually, for example, by entering some data at a keyboard. During this delay, however, there is contextual information concerning the transaction that must be saved in order to allow the transaction to continue in an orderly fashion. There are many popular ways to save this information.
One way to save context information is to keep it in the working memory of the server process, and to implement the system such that this same server process instance processes the next incoming message. Unfortunately, this method is expensive, not scalable and not fault-tolerant. The reason this method is expensive is that significant system resources are otherwise unavailable during the waiting period. These significant extra resources must be added to compensate for the processes that are tied up and therefore this method is also not scalable. Moreover, if the process that retains a state fails (or the process in which that process is running fails) the state data is lost and as a result this method is also not fault-tolerant. Accordingly, most modern designs avoid retaining intermediate state in active processes.
A second popular way is to send the contextual information back to the client, and require its re-transmission with the next part of the transaction. Although this method is commonly used by web-based systems using �cookies�, it is expensive in terms of communications bandwidth. However, because it does not matter which server instance is invoked, the application is context-free. Unfortunately, if the information includes security information such as secrets, the key that decrypts that data must then be shared among all possible instances of servers which might receive the continuation of the request. The problems associated with the distribution and control of such a key raise the issues addressed in this specification.
A third popular way is to save the contextual information on a database, and to retrieve it when the next part of the transaction takes place. Unlike the well-known cookie method, the database retention method does not increase communications cost, but is still context free.
Server applications written in the second and third methods can be context-free, scalable and fault-tolerant. Within the scope of the present invention, the contextual information will usually include sensitive data (such as cryptographic keys) whose values must be kept private and unmodified. The present invention facilitates the retention of sensitive context by providing authorized application instances with a set of shared symmetric keys, whereby one instance of the server application can use the keys to protect contextual information and another, possibly different application instance, can recover the contextual information because it has access to the same keys. This contextual information can then be transmitted either through the cookie method or in a local database.
Increasing the Security of the Integrity Key
The Integrity Key 22, being accessible by any operator, is more vulnerable than the Protection Key 24, which requires knowledge of multiple passwords. By linking them together, additional protection of the integrity key is achieved.
As noted above, the Integrity Key 22 protects the integrity of the database 30. The Protection Key 24 protects the confidentiality of sensitive data within the database 30. In addition, the Key Repository process 20 stores within the database 30 a cryptographic link between the two keys, thus making it impossible to modify one without the other.
In the present invention, this cryptographic link is constructed as illustrated in
The process begins at step 602. In step 602, a random number source is used to obtain a salt value. Typically, that salt value is 64 bits in length, although salt values of other lengths (longer and shorter) can be used depending upon the desired level of security. In step 606, the Protection Key is obtained. Similarly, in step 608, the Integrity key is obtained. The Integrity Key and the Protection key each consist of the name of the symmetric encryption algorithm, an initialization vector and a key value. In step 610, the Protection Key value, the Salt value, and the Integrity Key value are concatenated together. The concatenated value is then used as input to the hashing algorithm in step 612 to produce a Hash value (i.e. Hash (<Protection-key>|<Salt>|<Integrity Key>) produces the Hash value). The Hash value, the Salt value, and the name of the hashing algorithm are then written to the database in step 614 and the process ends in step 616.
The Integrity Key 22 is revealed by having any operator provide a name and a correct password. Thus, any malicious and sufficiently skilled operator could obtain a copy of the database, use the password to reveal the Integrity Key 22, modify the database 30, and rewrite it. However, since the Protection Key is still safe, none of the private information can be modified without detection, and this includes the shares of the protection key in owner entries. When this corrupted database is returned to the running system and any operator (not necessarily the malicious one) activates the system, the integrity checks in the database will succeed, and the Key Repository process 20 will be unable to differentiate this corrupt database from a legitimate one.
Unfortunately for the malicious operator, he did not modify the Protection Key 24. The Key Repository process 20 will detect that the database 30 is invalid (corrupt) at a later time when the owners identify themselves and the original Protection Key 24 is recovered, and the actual key does not produce a valid answer, or the cryptographic link between the keys is tested.
Safeguarding Policy Values
One ramification of the arrangement and the application of the present invention is that a change to a policy (numbers, values, etc.) requires the approval of those members of the enterprise that build the master keys. In this way, single individuals cannot grant themselves unauthorized access to the computer system 10.
Thus, the present invention contains centralized repository processes for keys, policy, policy decisions, authentication of application programs 40, and authorizations to use enterprise credentials 32. An important security feature of the present invention is the status of Key Repository process 20 as a process. The Key Repository process 20 has a data storage function, in that it stores the Integrity Key 22 and the Protection Key 24 in the working memory of the Key Repository process 20. To protect the security of the master keys within the Key Repository process 20, special functionality on the computer system 10 is utilized to prevent the contents of the Key Repository process from being copied to a swap file or page file. If this lock memory functionality is not used, the Integrity Key 22 and/or the Protection Key 24 could be copied onto the swap file and be compromised. An embodiment of the present invention keeps the Key Repository process 20 in non-swappable protected physical memory.
Alternate embodiments of the present invention are provided with a gateway 60. The gateway 60 provides a separate process that mimics the workstation paradigm for communication with the certification authority 70 per the certification authority's protocol. This enables the system of the present invention to make use of existing libraries that implement the workstation models (paradigms) to communicate with their respective certification authority (in search of the certification authority certificate), without requiring the modification of that library to make it work with the Key Repository process, since those libraries will have access to the enterprise credentials 32. As a result, gateway programs are authorized to the Key Repository process 20 using methods similar to that used to authenticate and authorize application programs 40.
Summary of Normal Operation Flows
To restate the normal operation of the present invention in terms of the block diagram of
In an embodiment of the present invention, the application 40 asks the Key Repository process 20 for access to an encrypted copy of the enterprise credentials 32. The Key Repository process 20 either provides the password or refuses to provide the password based upon the authorization setup for the enterprise 31 and the application 40. A predefined policy will decide whether or not the Key Repository process 20 provides the password. As mentioned before, the policy framework is stored within the database 30. The enterprise credentials 32, containing the certificates and trust roots of the enterprise 31, are protected by the Integrity Key 22 and the Protection Key 24.
The Integrity Key 22 also protects the policy value that defines the number of Owners needed to change policy values. It also protects the Owner entries needed to re-compute the Protection Key 24, and would detect any tampering with those values.
Parameters and Methods
The following is a detailed illustrative discussion of parameters and methods that can be used to implement an embodiment of the present invention. However, it will be recognized by those skilled in the art that considerable modification of this example is possible without departing from the spirit and scope of the present invention.
The Keys
All cryptographic systems are based on the concept of keys. For software cryptographic schemes, the longer the key (i.e., the more bits that comprise the key), the more secure the system. Sophisticated cryptography systems utilize multiple keys in schemes that require multiple individuals to be involved with the invocation of system. Multiple keys preclude the compromise of the system by a single individual, thereby increasing the security of the information contained within the system.
The following keying material is used:
The Integrity Key
The Integrity Key 22 is a strong symmetric encryption key used to provide integrity for most of the database 30. The method used is a Symmetric Message Authentication Code (MAC) as described by Schneier, and uses any of the symmetric encryption algorithms supported by the Key Repository process 20. The key is generated by the Key Repository process 20 when the database is created, and is regenerated whenever the database is rewritten. The new value of the key is stored in each operator entry, encrypted with that operator's public key, and then saved in the database.
Whenever an operator logs on as part of the initial activation of the Key Repository process 20, the operator's password and salt are used to decrypt the private key, which in turn is used to decrypt the Integrity Key 22, which enables the computer program to ascertain that the database has not been tampered with. If the database is already open, this logon provides the Key Repository process 20 with the ability to update the operator's public/private key pair in case one of the parameters which control this operation has changed.
As each subsystem operator is established and the manual password entered, the Key Repository process 20 generates the salt and RSA keys as described above, and the Integrity Key 22 is encrypted with the RSA private key. The reverse step of logging on is as follows:
The Protection Key
The Protection Key 24 is a strong symmetric encryption key used to provide secrecy for sensitive data in the database 30. It is never kept on the database 30 but instead is reconstructed by combining information from the requisite number of Protection Key 24 Owners. This key can be changed upon request.
As each owner is introduced to the Key Repository process 20, the Owner's name and password are used to generate the salt and RSA keys as described above.
At a later time, either at database 30 creation, or when the addition of this owner has been approved, a valid Protection Key 24 value will be available. At this point, the Protection Key 24 value is split into N pieces such that any M of them can be used to reconstruct the value, where N is greater than M, and M is greater than one. The methodology is the Bloom-Shamir Secret Splitting algorithm. According to the algorithm, the secret is divided among a plurality of people. As each owner's secret portion is generated, it is encrypted with that owner's public key and stored in the database 30. Later, when it's time to reconstruct the secret, the needed number of owner's names and passwords are obtained, and:
The Trust
There are some assumptions about the kind of attacks from which we have no protection:
Note, the Operator entry allowed the program to determine that the database 30 had integrity. However, a malicious operator could have generated his own Integrity Key 22, and pass-phrase, and thus could have substituted the files.
The multiple application owner entries allowed the program to decrypt the data. However, this malicious operator could have inserted his own entries as application owners, and created his own master key.
When the Protection Key 24 is finally exposed, the Certification Authority's 70 signing key is decrypted and verified. Remember it must be self-signed. However, this malicious operator could have used his own Certification Authority to generate all the keys.
In fact, there is no way the system can differentiate between the �real� database, and a totally fake database that is fully populated. The ultimate protection relies upon dual authentication from the original client program (such as the user at the web browser) and the internal environment, relying upon trusted copies of trust roots. This situation is identical to that encountered when two principals wish to authenticate each other, both must have independently-authenticated copies of a Root Certificates (or some intermediate trust point) as the root of the trust relationship. However, should any of the normal operators or owners attempt to interact with this fake system, they would immediately detect failures, exhibiting themselves as password failures.
Since the database is protected with both the integrity and privacy checks, no security breach will occur if the database is exposed. However, if the attacker has the passwords of enough owners, all security is moot. It is the responsibility of the customer's practices and procedures to guard against this situation. Prudence therefore dictates that both the passwords and the database should be guarded, making it harder for an attacker to succeed.
Server Application Programs
Once the Key Repository process 20 has been initiated, and programs authorized to access it, the customer will initiate execution of these programs when needed. The programs will communicate with the Key Repository process 20 to obtain the secrets.
This communication is encapsulated inside libraries that are provided with the present invention, and use a protocol that has the functionality such that the name and content of the program file of the sender can be determined in a trusted manner using operating-system primitives. This precludes the conveyance of this protocol over an open insecure transport medium. The libraries communicate with the Key Repository process 20 using such a protocol. As a result, the Key Repository process 20 can authenticate the application program 40.
It is envisioned that application authentication will be performed when the application first performs credential acquisition (logon), or to restore context, but once done, need not be done again within the instance of this server.
To direct this operation, the libraries must be provided with the name of the Key Repository process 20 in a notation appropriate to the host operating system. If the application is performing a logon function, the name of the enterprise on behalf of whom the application is acting, is also available. The entity name used here is the same name used in the Key Repository process 20 to identify the enterprise credentials 32. How this value is known to the application is application-specific. However, UNIX-like environment variables or command-line parameters are suitable ways to pass the name of the Key Repository process 20, a method which would enhance portability.
The Key Repository process 20, upon sensing the incoming request, and using functions available from the operating system (such as the name under which it was addressed) understands that the request is originating from an application program 40 and is about to use the agreed-upon protocol to request and to obtain the user's credentials. If the Key Repository process 20 cannot identify the requesting program as being one of the authenticated applications, the incoming request is rejected with a security violation error, and the attempt is logged as a potential security breach. If the application program is successfully authenticated, the Key. Repository process 20 ascertains whether this application 40 is authorized to work with the requested credentials. If this test fails, the Key Repository process 20 responds to the requesting application program 40 with an error that is conveyed back to the user's application as a password failure, emulating a logon failure. However, if the test succeeds, the Key Repository process 20 builds a file containing the needed credentials (or uses one already built), encrypts the confidential data with an invented password. This password and the location of the file are returned back to the libraries inside or associated with the application program 40 which completes the acquisition of the credentials by decrypting the credential file. The application program 40 is then informed of a successful logon, and work can commence.
The present invention, therefore, is well adapted to carry out the objects and attain both the ends and the advantages mentioned, as well as other benefits inherent therein. While the present invention has been depicted, described, and is defined by reference to particular embodiments of the invention, such references do not imply a limitation to the invention, and no such limitation is to be inferred. The invention is capable of considerable modification, alternation, alteration, and equivalents in form and/or functions, as will occur to those of ordinary skill in the pertinent arts. The depicted and described embodiments of the invention are exemplary only, and are not exhaustive of the scope of the present invention. Consequently, the present invention is intended to be limited only by the spirit and scope of the appended claims, giving full cognizance to equivalents in all respect.
Referenced by
Original Image


text:
Grosse Pointe Farms Michigan Golf Courses
|Country Club of Detroit - Par 3 Course
|Country Club of Detroit - Regulation Course
Featured Golf Course Review:
|Country Club of Detroit - Regulation Course -- CCD
|Review by: Eaton Hamilton
|Fun course with lots of traps that have steep faces. The par 5's are short,with the exception of #10 (590 yards from the tip). No water and minimal elevation change. What you see is what you get. Pace was good. Course was well maintained. Greens were moderately fast and relatively small compared to many of the newer courses. A couple had two tiers.
|From New York
Golf Courses:
Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /home/golfable/public_html/contentB.php on line 61

subset: commoncrawl


text:
Brass Players Coach Students and Musicians
Music education took center stage in October when two members of C Street Brass came to Orcas as part of the Chamber Music Festival's Musician-in-Residence program. Hakeem Bilal, bass trombone, and Kyle Anderson, trumpet, coached K-12 students by day, and adult community musicians in the evenings. The talented duo was a hit with all ages, and everyone welcomed their expertise and fun, energetic style of teaching. As one Community Band member said, "Their love of music and enthusiasm was infectious."
C Street Brass is the Ensemble in Residence at Carnegie Mellon University in Pittsburgh. Funding for these 2014-15 Musicians-in-Residence programs is from the National Endowment for the Arts, Orcas Island Community Foundation, Washington State Arts Commission, Monique Mead, Mimi and Slim Sommerville and the Gould Family Foundation.
Holiday Concerts Sparkle!
Orcas Island Chamber Music Festival's Annual "Leaves of Gold" fundraising concert will be glittering with three amazing artists this December! Baritone Philip Cutlip, violist/violinist Aloysia Friedmann and pianist Ian Parker will light up Rosario Resort's beautiful Music Room Thursday, December 11th at 6:00 pm and Friday, December 12th at 6:00 pm.
Artistic Director Aloysia Friedmann says, "Joining me will be the charismatic and beloved artists, baritone Philip Cutlip and pianist Ian Parker, performing music reflective of the season. Get in the holiday spirit with Philip singing Bach, Schubert and some holiday favorites! I'll play the traditional carol Greensleeves and the glorious Ave Maria. We celebrate Gershwin with Ian Parker's solo piano version ofRhapsody in Blue. There'll be other surprises revealed along the way! I know this will be an evening of pure enchantment."
The historic Rosario Mansion, adorned for the holidays, is the perfect setting for this very special evening. A reception filled with delectable hors d'oeuvres, delicious desserts and wine will followed in the Orcas Room of the Mansion. Tickets are $150, of which $75 is tax deductible. All proceeds benefit Orcas Island Chamber Music Festival programming and music education. The event is hosted by Rosario Resort owners Jan and Jerry Barto. For reservations, call 360-376-6636 or email firstname.lastname@example.com
"Simply Jackie" Concert
Pianist extraordinaire Jon Kimura Parker will light up a dark November night with an incredible solo performance for the Orcas Island Chamber Music Festival. The "Simply Jackie" Salon Concert will take place Wednesday, November 12th at 7:00 pm at Orcas Center. The world of fantasy and "the fantastic" combine in this brilliant program, featuring the following works:
Ludwig van Beethoven: Piano Sonata in C-sharp Minor, Op. 27, No. 2, "Moonlight" Quasi una fantasia
William Hirtz: Bernard Hermann Fantasy (Music from Mysterious Island, Psycho, and North By Northwest)
Franz Schubert: Fantasie in C Major, "Der Wanderer", D. 760, Op. 15
Robert Schumann: Fantasy in C Major, Op. 17
"The word fantasy has inspired composers in many ways," Jackie Parker says. "Schubert took the simplest possible theme and created his most overtly virtuosic work, the Wanderer Fantasy. Beethoven called his Moonlight Sonata an "almost fantasy", alluding to the atmosphere created by the well-known first movement. William Hirtz weaved together multiple Hitchcock soundtracks by Bernard Hermann in his latest fantasy, and Schumann chose the fantasy form for what is often considered his most inspired work."
"Both Schubert and Schumann's fantasies are considered to be among their most technically and artistically challenging works. Beethoven's Moonlight Sonata is among his most famous, and Hirtz's stated intent in the Bernard Hermann Fantasy was to create a work 'as effective as the Wizard of Oz Fantasy, a little easier on the hands, but in a virtuoso style.' "
OICMF Artistic Director Aloysia Friedmann says, " You will be dazzled with Jackie's brilliant technique, but long after the final notes of Jackie's Fantasy program, you will be left with a sense of profound knowledge of having heard a true artist performing some of the most beautiful music ever written for solo piano."
A reception of light hors d'oeuvres and Thurston Wolfe wine will follow the concert. Tickets are $75. To purchase, please email email@example.com or call the office 360-376-6636. www.oicmf.org
European Evening BRAVO!
A beautiful evening in Europe for the August 15th and 16th "European Interlude" concerts began in Spain, in Turina's rarely heard Scène Andalouse, played by Aloysia Friedmann and Jon Kimura Parker. Then it was on to France as Chee-Yun and Ian Parker performed Saint-Saëns' Violin Sonata. Philip Cutlip took the audience into Schubert's home in Vienna for a set of Lieder, then it was a very grand finale indeed in Germany for Schumann's rousing Piano Quintet!
3 Parkers Pandemonium!
It was all in the family sharing one piano bench for the "Orcas~trations: The Three Parkers" concerts August 19 and 20. And before the concert ended, brothers Jackie and Jamie Parker, and cousin Ian Parker, needed another bench!
In the first half of the program, strings, clarinet and voice mixed and matched with one Parker at a time. Violinists Andrés Cárdenes, Chee-Yun and Annalee Patipatanakoon; violists Aloysia Friedmann and Yizhak Schotten; and cellists Roman Borys and Anne Martindale Williams took turns for a wonderfully entertaining first half. Then after intermission our Steinway got a real workout when the Parkers teamed up for six hands on one keyboard! Then it was pure pandemonium when the amazing encore, Khachaturian's Sabre Dance, saw the trio playfully jumping from one end of the piano bench to the other – while not missing a beat.
A Full House Welcome!
Back by popular demand are many of Orcas Island Chamber Music Festival patrons' favorite performers. The "Welcome Back!" concerts August 12th at 7:30 pm and August 13th at 5:30 pm featured renowned violinists Andrés Cárdenes and Monique Mead, baritone Philip Cutlip, violist Yizhak Schotten, clarinetist Owen Kotler and cellist Anne Martindale Williams.
Audiences were charmed by arias from Mozart's The Marriage of Figaro and The Magic Flute and enjoyed pianist Ian Parker's Orcas Island debut in Beethoven's joyous trio for Clarinet, Cello and Piano, Kodaly's Sérénade performed by Cárdenes, Mead and Schotten, and the monumental Brahms F Major Cello sonata played by Bion Tsang and Jon Kimura Parker.
Classic Volunteers!
"I totally look forward to [the Festival] and think it a great privilege to be one of the helpers. My childhood was filled with wonderful music and musicians, so these concerts fill my spirit and bring me "'home" again in so many ways." – OICMF Volunteer
The Orcas Island Chamber Music Festival is fortunate to have a terrific team of dedicated volunteers for the Summer Festival. You'll see them ushering you to your seats, pouring your glass of Festival wine, helping you select CDs, hats and t-shirts. Moving pianos, chairs and music stands during the concerts. And there are volunteers you don't see. Those who create beautiful floral arrangements for the stage, lobby and reception areas – and those who actually grow the flowers. Or who lovingly set the tables for the post-concert dinners, even folding napkins shaped like swans! Or preparing Artist lunches donated by local restaurants. Or who arrive early in the morning to set up facilities for Music Lovers Seminars and rehearsals. Or who spend hours laundering and pressing linens.Our volunteers give of their time and themselves for many different reasons. For the music, for memories, for sense of community, for the love of being an important part of an exciting two-week event. We couldn't do it without them!
If you'd like to join this incredible team, please give us a call!
Chamber Music Festival Tickets on Sale May 7 !
Opening day of ticket sales for the Orcas Island Chamber Music Festival is Wednesday, May 7th. And the kickoff is happening at a new, more convenient time – 5:00 PM!
All are welcome to come to the Madrona Room at Orcas Center beginning at this time to select your favorite seats and concerts for this popular Festival. The 17th Annual Orcas Island Chamber Music Festival takes place August 8 through 23.
For years, "Early Bird" patrons have lined up in the pre-dawn hours in order to make their concert choices before sales open online or by phone. Now in 2014, the "Early Birds" are migrating from AM to PM. Mary Poletti will still bring her goodies to keep folks happy as the friendly Festival staff help with ticket orders and answer questions about this Summer's music and musicians.
Come join the fun and get your tickets early. This year's Festival is going to be spectacular! Opening weekend you'll journey to Buenos Aires for a true tango adventure, as Artistic Director Aloysia Friedmann and Artistic Advisor Jon Kimura Parker welcome tango pianist extraordinaire Pablo Ziegler and his Classical Tango Quartet. It will be a musical family celebration August 19 and 20 when three famous pianists, brothers Jackie Parker, Jamie Parker and cousin Ian Parker perform for the featured "Orcas~trations" Concert. Other concerts feature Canada's celebrated Gryphon Trio, baritone Philip Cutlip, renowned violinists Andrés Cárdenes and Chee-Yun, cellists Bion Tsang and Anne Martindale Williams, and other amazing musicians. Online ticket sales will open May 7th at 9pm at www.oicmf.org. Phone sales will begin May 8th and can be made by calling the Box Office Wednesday through Friday from noon to 4 pm @ 376-2281. To view the complete concert schedule and performing artists, visit the OICMF website or call the Festival office @ 376-6636 for further information.
Music Lovers Seminar: Miró Beethoven An Epic Journey
Monday, June 23, 1:30 – 4:30 pm
This Music Lovers Seminar will set the stage for the Miró Quartet's performance of Beethoven's 16 string quartets, which will take place over 5 concert nights June 23 – 29, 2014. The Orcas Island Chamber Music Festival is honored to bring internationally recognized scholar Stephen Rumph, Associate Professor of Music History at the University of Washington, for this special afternoon on Monday, June 23 from 1:30 – 4:30 pm at the Orcas Senior Center.
This seminar will explore Beethoven's sixteen quartets as a microcosm of the composer's entire oeuvre, tracing the changing stylistic, aesthetic, and ideological landscape of Beethoven's music from his early Viennese years until his death. Professor Rumph's observations will combine biographical and historical information with close musical readings, and will offer music lovers of every level an accessible and stimulating introduction to these masterpieces of the chamber music repertory. Rumph has lectured widely on Beethoven's music, and published a prominent study of the composer's political thought, "Beethoven After Napoleon: Political Romanticism in the Late Works" (University of California Press, 2004).
"A brilliant and unfailingly provocative reading of Beethoven's music. Rumph challenges and refines our views of the subject, reinterpreting overly familiar music in striking new ways. Wonderful critical and interpretive observations abound…"
– Scott Burnham, author of "Beethoven Hero."
Professor Rumph teaches and publishes on a wide range of topics, including opera, film music, French art song, Mozart, and Beethoven. His writings appear in numerous music journals, and he recently published a second book, Mozart and Enlightenment Semiotics (University of California Press, 2011). He served as Reviews Editor for Beethoven Forum, 2005-2008. He joined the UW School of Music faculty in 2002, after studying voice at Oberlin Conservatory and earning a Ph.D. at the University of California, Berkeley. Rumph also sings professionally as a lyric tenor, performing widely in concert, oratorio, and opera.
Wow! Look Who's Coming in August
ARTISTS: Artistic Director Aloysia Friedmann and Artistic Advisor Jon Kimura Parker lead an amazing group of artists performing for the 17th Orcas Island Chamber Music Festival, August 8 – 23, 2014.
Many of your favorites are returning this Summer – Canada's celebrated Gryphon Trio, violinists Chee-Yun, Andrés Cárdenes and Monique Mead, cellist Anne Martindale Williams, clarinetist Owen Kotler, violist Yizhak Schotten, and baritone Philip Cutlip.
We're also excited to announce musicians that will be new to Orcas in 2014 – famous Argentinian pianist Pablo Ziegler and his Classical Tango Quartet, cellist Bion Tsang and pianist Ian Parker.
TICKETS: Pre-Sale Tickets: April 16
(For donors $500+. Call Office for information 360-376-6636)
Ticket Sales Open: May 7 www.oicmf.org
Concerts will take place on the following dates. Each concert is performed twice, the first night at 7:30pm, the second night at 5:30pm.
August 8 – 7:30 pm, August 9 – 5:30 pm
August 10 – 4:00 pm on Lopez Island
Nuevo Tango!
Piazzolla (arr. Ziegler) Works for Two Pianos Michelangelo 70 Buenos Aires Hora Cero Revirado Ziegler, JK Parker
Ziegler Milonga Del Adios for Clarinet and Piano Elegante Canyenguito Ziegler, Kotler
Piazzolla (arr. Ziegler) Oblivion for Violin and Piano
Piazzolla (arr. Ziegler) Elegia Sobre Adios Nonino (arr. Ziegler) for Cello and Piano Libertango Ziegler, Tsang
A Selection of Tango Works Pablo Ziegler Classical Tango Quartet Ziegler, Del Curto, Ok, Giruado
August 12 – 7:30 pm, August 13 – 5:30 pm
Welcome Back!
Mozart A selection of Operatic Arias from The Marriage of Figaro and The Magic Flute Cutlip, Ian Parker
Beethoven Trio in B-flat Major, Op. 11 for Clarinet, Cello and Piano Kotler, Martindale Williams, Ian Parker
Zoltán Kodály Sérénade for Two Violins and Viola Cárdenes, Mead, Schotten
Mozart Selected Concert Arias Cutlip, JK Parker
Brahms Cello Sonata No. 2 in F Major, Op. 99 Tsang, JK Parker
Wednesday, August 13 – 1:00pm CHILDREN'S CONCERT
August 15 – 7:30 pm, August 16 – 5:30 pm
European Interlude
Joaquín Turina Scène Andalouse, Sextet for Viola Solo, Piano and String Quartet Friedmann, JK Parker, Cárdenes, Mead, Schotten, Martindale Williams
Saint-Saëns Sonata No. 1 in D minor for Violin and Piano, Op. 75 Chee-Yun, Ian Parker
Schubert A set of beloved Lieder including Erlkönig Cutlip, JK Parker
Schumann Piano Quintet in E-flat Major, Op. 44 Cárdenes, Mead, Friedmann, Martindale Williams, JK Parker
Aug 19 – 7:30 pm, August 20 – 5:30 pm
Orcas~trations: The Three Parkers
Can six hands fit on one keyboard? Jackie, Jamie and Ian Parker and friends take turns in every possible musical combination in this musical family celebration!
Fritz Kreisler Short works for Violin and Piano
Piazzolla/Gubaidulina Le Grand Tango
Samuel Barber Souvenirs Suite for Piano four-hands
Rare gems of the six-hand piano repertoire
Cárdenes, Chee-Yun, Friedmann, Gryphon Trio, Kotler, Martindale Williams, Schotten, Ian Parker, Jamie Parker, JK Parker
Friday, August 22 – 1:00 pm Open Rehearsal for Seniors
Aug 22 – 7:30 pm, August 23 – 5:30 pm
Brahms in Vienna
Brahms Trio for Clarinet, Cello and Piano in A minor, Op. 114 Kotler, Borys, Jamie Parker
Brahms Lieder Cutlip, Ian Parker
Brahms Hungarian Dances for Piano four-hands Ian Parker, JK Parker
Brahms Sextet in G Major, Op. 36 Cárdenes, Patipatanakoon, Schotten, Friedmann, Martindale Williams, Borys
It's two weeks filled with fabulous music and musicians, enlightening lectures, community concerts, post-concert receptions and fun. Please make your lodging reservations early and join our 17th Season celebration!
*All elements subject to change


text:
Here we are on Stephen Avenue with @1015koolfm and @therubs for the #50daysyyc cafe concert series! Come meet us and hear what we have planned for #yyc! #getbranded #brandedyyc By BRANDEDYYC
This Calgary moment captured with Instagram. Share your favourite Calgary moments on Capture Calgary by downloading the free Instagram app, using it to take a picture and including "#capturecalgary" or "#sceneyyc" in your image's caption. It's that easy.
Check out the original here.
Aug 25, 2014
Like this Photo
Report this Photo
Is this photo inappropriate? If so, please let us know.Report ImageCancel


text:
Set on the tranquil shores of Yas Island in the Emirate of Abu Dhabi, part of the United Arab Emirates, Yas Beach is a fully licensed private Beach Club dedicated to serving the guests of the several hotels located on Yas Island. We are also open to the general public, subject to an admission fee, we also offer memberships on a monthly and annual basis for more information about our admission fees click here, or to find out about our membership costs and application process click here.
We are open from 10am-7pm on weekdays and 10am-10pm on weekends, with a full range of alcoholic and non-alcoholic beverages served from our beach bar, we well as a range of sea food, grills, ice cream and fruit freshly prepared by our state-of-the-art kitchen and served to you in our decked and shaded restaurant.
This Abu Dhabi Race Weekend Yas Beach and Crystal Group present
A pop up beach party, the action starts on Friday with different DJs on rotation throughout the days
Full Day Pass – 250AED
Half Day Pass(After 4pm) – 150AED
For more info or tickets please call 0502878730


text:
- Articles tagged 'nokia x+'
Five Things You Need to Know About the Nokia X Smartphones
Nokia today unveiled a new family of smartphones, the X which run on Android apps alongside Microsoft's services and signature Nokia experiences. While Android running on Nokia devices is like a dream comes true for some consumers, things aren't exactly what they seem. We list out five things you need to know about the Nokia X smartphones.
- Futuremark announces new benchmarking software for Windows 10
- Corning's Gorilla Glass 4 is twice as tough as competitive glasses
- Sony announces launch of the A7II, the first full-frame camera with 5-axis image stabilization
- AMD's Freesync technology is almost here and Samsung's leading the charge
- Alcatel Onetouch to debut smartphones at Sitex 2014
- Apple changes App Store buttons from "Free" to "Get"
- Brio, the smart power outlet that you'll definitely need
- Yahoo to be Firefox's default search engine
Subscribe to HWZ Here!
Subscribe now to receive latest tech news, articles and promotions straight to your inbox!
By signing up, you indicate that you have read and agreed to the Terms of Service and Privacy Policy.


text:
Virginia 2012 election Washington Post poll. Sept. 12-16
Q: Immigration issues. Please tell me how important it will be in your vote for President. (Among registered voters, half sample)
Show results by:
Show results by:
The Washington Post poll
Question 16 of 66
In this poll:
President Obama holds a clear lead over Mitt Romney in Virginia, buoyed by enthusiastic support rivaling what he marshaled in 2008 to snap the Democrats' 40-year losing streak in the state.
This Washington Post poll was conducted by telephone September 12 to 16, 2012, among a random sample of 1,104 adults in the Commonwealth of Virginia. Interviews were conducted on conventional and cellular telephones, and carried out in English and Spanish by Abt-SRBI of New York. The results from the full sample have a margin of sampling error of plus or minus 3.5 percentage points; it is four points for the samples of 934 registered voters and 847 likely voters.
Most Read: Politics
1Unorthodox police procedures emerge in grand jury documents
2Carly Fiorina actively explores 2016 presidential run but faces GOP critics
3Ferguson violence broke the mold in three ways - one of which is just unfolding now
4In chairman fight, Jeff Sessions is battling his perception on immigration debate
5Illegal immigrants could receive Social Security, Medicare under Obama action
Read In


text:
The ongoing protests in Thailand are only the latest in a long line of uprisings that have invariably kept the various factions of the right in power.
{ 5 comments }
"During times of universal deceit, telling the truth becomes a revolutionary act," George Orwell
The ongoing protests in Thailand are only the latest in a long line of uprisings that have invariably kept the various factions of the right in power.
{ 5 comments }
To many Brazilians, especially the black and poor, the country's protests are a chance to fight against state brutality and for a non-pacified peace.
{ 4 comments }
The draconian anti-protest law imposed by the military regime will not deter Egyptians from returning to the streets to reclaim the January 25 Revolution.
{ 6 comments }
Until the neoliberal university collapses under its own dead weight, we need to look to free universities to remind ourselves that another world is possible.
{ 11 comments }
The direct democracy of the squares has given way to representative party politics — a dangerous development, the Latin American experience teaches us.
{ 9 comments }
The old modes of struggle no longer correspond to the needs of the moment, but a new political culture of autonomy and horizontalism is already emerging.
{ 2 comments }
What does it take for a movement to actually win? Organizers in the campaign against water privatization in Greece share their story and their strategy.
{ 8 comments }
Raúl Zibechi explores the autonomous and horizontal forms of organization, direct action and consensus decision-making behind the Brazilian uprising.
{ 9 comments }
Twenty years after apartheid, the old freedom fighters of the ANC have come to reproduce the same structures of oppression against which they once arose.
{ 9 comments }
The global day of action staged by Anonymous is a testament to the growing strength of peer-to-peer direct action. And it is only just the beginning.
{ 7 comments }


text:
Home » NewHampshire.com » Travel & Tourism » Monadnock
Holly Fair on Nov. 23 kicks off Raymond's holiday events
Tickets for the Raymond Historical Society Christmas raffle are $1 each or $5 for six and will be available at the fair. Prizes include a cord of wood, an afghan and a gift certificate to the local Hannaford. Raffle winners will be drawn on Sunday, Dec. 15.
Holiday parade, tree lighting Dec. 7
On Saturday, Dec. 7, Raymond Recreation will host the annual holiday parade, which kicks off at 4 p.m. and will be followed by the Christmas tree lighting on the town common.
|Tweets by @newhampshirecom
Most Read
NH's back-road rest areas fading away
Most Shared
John Harrigan: Whiskey jacks and camp at Unknown Pond
Author Doris Kearns Goodwin talks Taft, Teddy and journalism
Dick Pinney's Guide Lines: The wild life and times of a state conservation officer
Justin Townes Earle's "Absent Fathers" available for pre-order
Cranmore to Open a Week Earlier Than Planned: This Weekend
Cranmore Adds Brew Fest and Warren Miller's "No Turning Back" Film to Annual Homecoming Event


text:
Wayne Shorter to Celebrate Career and Birthday with Hollywood Bowl Concert, 8/28
On Wednesday, August 28, 2013 legendary jazz saxophonist and composer Wayne Shorter observes his 80th birthday at the Hollywood Bowl. Guest artists feature a jazz "who's who" of friends and musical colleagues honoring the span of Shorter's musical career.
The program will feature the Wayne Shorter Quartet with Danilo Pérez, John Patitucci, and Brian Blade, with special guests Herbie Hancock and the Imani Winds; ACS with Geri Allen, Terri Lyne Carrington, and Esperanza Spalding; and Joe Lovano and Dave Douglas Quintet: "Sound Prints."
Wayne Shorter, born August 25, 1933, has a continually expanding body of work which is inextricably linked to the history of modern music. His music transcends genre while keeping the improvisational genius and surprise of jazz burning at the center. Regarded as one of the most significant and prolific performers and composers in jazz and modern music, Wayne Shorter has an outstanding record of professional achievement in his historic career as a musician. He has received substantial recognition from his peers, including nine Grammy awards to date.
For full artist biographies, visit Hollywoodbowl.com.
Featuring...WAYNE SHORTER QUARTET with DANILO PÉREZ, JOHN PATITUCCI, BRIAN BLADE and special guests Herbie Hancock and the IMANI WINDS; ACS: GERI ALLEN, TERRI LYNE CARRINGTON, Esperanza Spalding; JOE LOVANO and DAVE DOUGLAS QUINTET: "SOUND PRINTS".
The concert is set for Wednesday, August 28, at 8 PM at THE HOLLYWOOD BOWL, located at 2301 N Highland Ave, Los Angeles, Calif. Subscriptions and single tickets are available now for the Hollywood Bowl 2013 summer season at HollywoodBowl.com or Ticketmaster.com, or via phone at 323.850.2000 or 800.745.3000 and in person at the Hollywood Bowl Box Office. For more information, call 323.850.2000.
|Related Links
|Milwaukee Symphony Orchestra to Present 'Assortment of Holiday Concerts' This December
November 06, 2014
|Leonard Slatkin Extends Contract with ONL Through 2016-17 Season
May 23, 2014
About Author
- ABC Cancels John Stamos-Led Drama, MEMBERS ONLY
- Rockmond Dunbar Returns as Dennis Abbott for the Final Season of THE MENTALIST on CBS
- VIDEO: Watch Jonathan Groff and More in LOOKING Season 2 Trailers
- VIDEO: Michael Che Gets Serious on SNL's Weekend Update
- VIDEO: SNL Parodies Schoolhouse Rock and Lawmaking
- Netflix To Premiere Tina Fey & Robert Carlock Comedy Series UNBREAKABLE KELLY SCHMIDT, March 2015
- New Show, ACCESS HEALTH, Premieres Wednesday, November 26 on Lifetime
- Native American Consultant Talks Preserving the Integrity of PETER PAN LIVE!
- VIDEO: Watch Music Video for ONE DIRECTIONS's 'Night Changes'
- Children's TV Program CHUGGINGTON to Kick Off First North American Live Tour This Winter


text:
Pioneer Water Tanks
based in San Marcos, AUSTRALIA
BlueScope WaterIn May 2005, Pioneer Water Tanks partnered with BlueScope Water, a subsidiary of the Australian Steel manufacturing business, BlueScope Steel, one of Australia`s largest manufacturing companies. The Pioneer GALAXY tank range complemented the existing range of products available in the Australian market, such as the WATERPOINT residential sized rainwater ...
SFP Tanks
based in Mtunzini, SOUTH AFRICA
SFP Tanks is a proud agent for AQUADAM Manufacturing in Kwazulu Natal. We supply a wide range of Engineered designed water storage solutions and water tanks, dams and reservoirs to satisfy your needs. Primary business: Supply and Installation of Water Retaining Structures. Services: Reinforced Concrete Reservoirs; Modular Steel Panel Reservoirs; Gunite Dams; Pre-Stressed ...
DN Tanks
based in Wakefield, MASSACHUSETTS (USA)
DN Tanks specializes in the design and construction of prestressed concrete storage tanks worldwide. Our mission is to provide our clients around the world with the highest quality liquid storage tanks at the best long term value with unsurpassed customer service and satisfaction.
Permastore Tanks & Silos (Fusion Tanks & Silos)
based in Eye, UNITED KINGDOM
Permastore Limited is a UK registered company established since 1959 providing over 50 years of experience in engineering and manufacturing bolted sectional tanks & silos. Internationally recognised as one of the world's leading tank and silo manufacturers, Permastore exports to over 110 countries and in excess of 300,000 structures have been installed worldwide. ...
Australian Panel Tanks
based in Stapylton, AUSTRALIA
Australian Panel Tanks has been designing, manufacturing and installing water tanks for commercial and industrial applications, In January 2008 Tyco Flow Control Pacific Pty Limited acquired the Australian Panel Tanks brand and has incorporated it into there range of bolted steel water tanks under the Tyco Pumping Systems Division. The combined knowledge, experience and ...
Brown-Minneapolis Tank
based in Albuquerque, NEW MEXICO (USA)
Brown-Minneapolis Tank Co. (BMT) and more recently its affiliates BMT-NW and Graver Tank Co. have been recognized leaders in supplying large steel plate fabrication of tanks and structures, engineering design, pressure vessels and construction services. We set the industry standard with best in class, award-winning and 'customer comes first' approach to manufacturing and ...
Niles Steel Tank Company
based in Niles, MICHIGAN (USA)
Niles Steel Tank is a US manufacturer of ASME code pressure vessels and storage tanks for both carbon and stainless steels. Our headquarters is located in Niles Michigan. Niles Steel Tank began operation in 1898 and has been manufacturing high quality pressure vessels for many industries including automotive, compressor, paint and paper, solar, water storage, HVAC, ...
Tank Connection Affiliate Group
based in Parsons, KANSAS (USA)
At Tank Connection Affiliate Group, we have more than 2100 years of combined experience in the design, manufacturing and field installation of dry bulk and liquid storage systems. We are committed to providing the highest quality storage containment products and services worldwide. Our passion for safety, employee development, innovation, management excellence and ...
Plas-Tanks Industries, Inc.
based in Hamilton, OHIO (USA)
Plas-Tanks Industries is a custom manufacturer of corrosion resistant fiberglass reinforced plastic products. Since 1976, we have supplied a variety of industries with ISO 9001 quality equipment to locations around the world. Among the many industries we have served are the water and wastewater treatment industry, the pulp and paper industry, and the chemical industry. ...
ModuTank Inc.
based in Long Island City, NEW YORK (USA)
ModuTank Inc. has been producing above-ground, modular bolted steel tanks, liquid storage tanks, settling tanks, containment for earthen materials and slurries as well as a wide range of secondary containment systems for stationary applications, tanker trucks and wheeled vehicles. These versatile tanks are based on low-cost modular components designed for hand carrying ...


text:
USD $26.07 Daily
USD $15.22 Daily
USD $30.72 Daily
USD $37.36 Daily
USD $45.46 Daily
NZD $27.68 Daily
AUD $26.39 Daily
AUD $45.00 Daily
NZD $24.35 Daily
NZD $27.48 Daily
AUD $34.02 Daily
EUR €1.33 Daily
NZD $43.16 Daily
JD 13.18 Daily
AUD $909.23 Daily
UK £18.97 Daily
UK £12.97 Daily
R 249.71 Daily
AUD $24.44 Daily
Mex $29.86 Daily
Mex $594.77 Daily
USD $16.78 Daily
AUD $41.90 Daily
BRL $66.53 Daily
CAD $30.04 Daily
* Based on recent searches,
|More deals
Read more about these and other reasons why we believe we are your best option for car rental.
Tired of lugging your bags into hotels?
Too tight to tip the doorman to carry them?
Answer: Rent a motorhome here
Find the best airport car rental deals from pretty much every airport in the world that you can rent a car from. With real time bookings you can even book while you're at the airport and avoid higher counter charges.Available in the Android MarketAvailable in the iPhone App Store


text:
This week's Frugal Fun for Kids is provided by This Mama Loves Her Bargains. I love her fabulous idea! Check out how she made a photo album out of paper bags! I love making crafts with and without my kids. Pre-kids, I had so much time to scrapbook and make photo projects, and to be […]
Mother's Day Craft Idea: How to make a Pretzel Wreath
Mother's Day is just around the corner! I believe the best gifts are handmade! Especially when they are made by kids! That is why I like to work with my kids at every holiday to create something completely unique! For this Mother's Day craft, I decided to take things that many of us already have […]
Fun & Frugal Craft For Kids – Earth Day Craft
Each week Mom on Dealz brings us Fun and Frugal activities for kids. This week is an Earth Day Craft! Thank you Mom on Dealz!
Frugal & Fun For Kids — Creating a Shadow Box
Winnie The Pooh : Easter Egg Designs
In honor of Winnie the Pooh returning to theatres this summer (July 15th), Disney has provided Living on Love and Cents with exclusive FREE and fun activities.Easter wouldn't be complete without Painting and Decorating Eggs, below you will find some fun ways to design your eggs in the spirit of Winnie the Pooh and Friends.


text:
Launcher Update
Get the Desktop App for Battle.net Now
- All your games in 1 place
- Log in once
- Automatic game updates
90 Troll Hunter
Hello! I am new to the realm, starting brand new for alliance only since I have so much horde characters, and it feels great! I am just wondering what I am to expect from the people here, and the community. Anything that could be useful information about the realm, please let me know! I am excited about alliance only, first for me.
Threats of violence. We take these seriously and will alert the proper authorities.
Posts containing personal information about other players. This includes physical addresses, e-mail addresses, phone numbers, and inappropriate photos and/or videos.
Harassing or discriminatory language. This will not be tolerated.


text:
Locating the Matthew Iles you are looking to find is easy with USA-People-Search.com. We offer an extensive database of people search info, such as age, recent addresses, and phone numbers. The most recent address for Matthew Iles is located in Missoula, MT.
We narrow down your search for the correct Matthew Iles by utilizing any data that we have on hand. Find the right Matthew using such details as previous residences and known aliases. View more personal information, including background checks, criminal profiles, and email addresses on USA-People-Search.com. If this Matthew is not the person you are searching for, refer to the list of people with the Iles in Missoula, MT below. This list could include name, age, location, and relatives.
Add more info into the search box above to filter your results. A first name, middle name, last name, city, state and/or age can be the missing piece to finding Matthew Iles. Use the map to get a sense of their whereabouts. When you find the Matthew Iles you desire, you can then access all the public records data we have on Matthew Iles using our trusted database, which makes collecting details about anyone quick and easy.
Home |
About Us |
All Products |
People Directory |
Articles |
Help |
Privacy |
Terms & Conditions |
Contact Us |
Link To Us |
Bookmark Us


text:
The Novena open-hardware laptop, the brainchild of Andrew 'Bunnie' Huang, nears completion - although its final design will differ from the prototype shown.
You're more than welcome.Originally Posted by GuilleAcoustic
@Gareth: Again, your news are right on spot with my hobbies / center of interest. Thanks for the great job ;)
Whoops - mustn't have pressed Ctrl+C hard enough when copying the link. Fixed, ta!Originally Posted by deathtaker27
December 2012, Bad link Gareth :)
Meet the new Caseking Selective Fire systems by der8auer
20th November 2014
ASRock Z97 Pro 3 Review
19th November 2014
Corsair Hydro Series HG10 A1 Review
18th November 2014


text:
I do not believe what some reformed theologians believe and some hyper-Calvinists believe, and that is that a man in that condition cannot hear God until he's first regenerated.
You know, every road has two ditches. On one side I think is "hyper Calvinism" and on the other side is Arminianism.
By Dr. Rick Patrick
My children would have preferred a father who gave them time instead of toys. I hope I made the shift soon enough, because time is all I have left to give.
We learn that God accepts a repentant heart. The people of ancient Nineveh were spared the wrath of God because they heeded the Word of God from the prophet Jonah.
What are the odds that a man who lives in Tulsa runs into a young man in Mexico who needs help preparing to serve in Panama?


text:
You've read all of your free items this month.
To register, get added benefits and unlimited access to articles, Become a Member. Already a Member? Sign in.
Aethon finds success with good science and good data
Want more Access, Content & Connections? Upgrade to Membership.
We are glad you are enjoying Advertising Age. To get uninterrupted access and additional benefits, become a member today.
Already a member? Log in.


text:
Lee Mack's Eggs
Duration: 01:37
Host Rob Brydon joins regular team captains David Mitchell and Lee Mack for the comedy panel show all about truths and lies. With guest panellists Michael Ball, Charlie Brooker, Trinny Woodall and Reece Shearsmith.
- Presenter
- Rob Brydon
- Participant
- David Mitchell
- Participant
- Lee Mack
- Participant
- Michael Ball
- Participant
- Charlie Brooker
- Participant
- Trinny Woodall
- Participant
- Reece Shearsmith
- Director
- David Coyle
- Producer
- Derek McLean
This clip is from
Would I Lie to You? Series 3, Episode 8
8/9 With guest panellists Michael Ball, Charlie Brooker, Trinny Woodall and Reece Shearsmith.
First broadcast: 28 Sep 2009
Featured in...
Comedy Extra
Comedy videos to watch and share on the web, mobile and red button.
More clips from Would I Lie to You?
- Is comedian Paul Foot repulsed by beards? Duration: 03:17 Series 8, Episode 7
- Does Pointless host Richard Osman squawk like a parrot when he locks his front door? Duration: 02:45 Series 8, Episode 6
- Does designer Kelly Hoppen like to wash herself using an orange? Duration: 02:37 Series 8, Episode 5
- Is there really something about David Mitchell that elephants like? Duration: 02:42 Series 8, Episode 4
- Did David Bowie fan Mel Giedroyc once lick his cake just to feel close to him? Duration: 03:17 Series 8, Episode 3