text:
- Product Information
Product Description
Whether you're heading to a comic convention or a Renaissance Faire this bright and bold Harlequin Clown Adult Costume is the perfect fit! Our dazzling Harlequin Clown Adult Costume includes a black, red and white motley style polyester tutu dress with attached suspenders, ruffle trims, faux leather bodice with pom pom accents, ruffle neckpiece and pom pom hat. Does not include stockings, gloves or shoes. Available in adult sizes; small, medium and large. Add a fabulous final touch to your lovely look with our fantastic face paints!
- Questions & Answers
- Reviews
Spend a Day in Paris with a Paris Party!
Add a Paris theme to any type of soiree with the help of Paris decorations and French treats. Use these party planning tips and ideas to help you prepare for your party!
Totally 80's Party Ideas
Add an 80's theme to an upcoming party of event! Use these party tips to help you set up for an 80's theme party, complete with decorations, food ideas and more.
Add a Pink and Gold Color Scheme to Your Party!
Throwing a party? Try using a mix of pink and gold colors to create the color scheme for your party décor. This color combination can be used for birthday parties, bridal parties, baby showers, and much more!

subset: commoncrawl


text:
Telli Song and Mixtape Downloads
All songs and mixtapes are offered for download with the permission of the artist or a representative. If you have any questions or concerns please see our DMCA section.
Artist: Telli
Featuring: Asher Roth
Song: High and Paid
A lot of people get high, and there are more than a couple folks who like to get paid, but High and Paid? That's a select few. For his The DJBooth solo debut, Ninjasonik frontman Telli goes in... More
Posted 2 years ago
Sample Text - Sample Link


text: We love travelling and have a strong empathy with travellers of all types - singles, couples, groups of friends or family, business or pleasure, city or nature lovers ....... We love meeting people, sharing stories, and helping others maximise their travel experiences. Darius, our 10-year-old son, is equally sociable and gracious with adults and kids alike. We look forward to hosting you !


text:
Download the single on iTunes: Go to iTunes
Download press photo's Go to Dropbox
Legendary band Paul Oxley's Unit are due to release a their first studio album since 'The Magic' in 1996! It will be called 'Black Gold' and the first single 'Eyes Open' is now available. The Black Gold tour starts in October 2014.
About POU
As a touring band, POU have never been off the scene. They have performed gigs, almost every year, since their enormous success in the early 80's, when apart from selling over 100,000 albums, they also found time to break many attendance records with their gigs. The famous tour of 1982 sold out 36 gigs in 35 days with a record audience at every gig. The last few years have seen a rising popularity for the band and they have performed to packed houses all over Finland, even without a new album to promote. 2014 is a new era for the band as they work in the studio for the first time together in 18 years! The band are excited about the new release but are hugely looking forward to hitting the road once again.
The tour line up
The band's line up still has three original members plus drummer Nicke Björkqvist, who has been with the band since 1996. USA born, Rob Dominis will also join the tour.
Paul Oxley - Vocals (UK)
Uffe Enberg - Guitars (Finland))
Kjell Ekholm - Bass (Finland)
Nicke Björkqvist - Drums (Finland)
Rob Dominis - Keyboards (USA)
The New Single – Eyes Open
The first single from the album, 'Eyes Open' is a powerful Pop/Rock classic. Discordant and symphonic in parts, with echoes from the 80"s but spiced with modern sound. The tell tale 'Unit style' still shines through in the production whilst the haunting video filmed in Helsinki and Ekenäs, features many friends and fans.
The New Album – Black Gold
In the words of Paul, the new album; Black Gold, "has the same mixture of subtle, political comments and classic pop songs as Living in the Western World. For some reason, I felt myself in the same mind-set as when I wrote the songs for LWW", for example the title track discusses one of the real reasons behind most conflicts these days, in it's reference to fossil fuels. Sacrifice contains the line; "There's nothing more I fear than a man with an idea" and, on the other side of the coin, songs like Our little Secret and I miss those Days reveal Paul's sentimental side, in a similar vein to The Right kind of Love and Terry's Inside.
Why has it taken 18 years for Paul Oxley's Unit to release another album?
"It just seemed like the right time" says Paul "I don't like the idea of making albums for the sake of money, or to fulfil a contract. For me, making an album is almost a spiritual experience and the songs come from the soul. Black Gold has been a long time coming but hopefully it will have a depth and substance that people will recognise as meaningful and will want to play over and over again. The band are very enthusiastic about the songs and can't wait to go out and perform them live. "That's the environment we love, connecting with the people and judging by the feedback we have had on social media, there are still a few fans out there" says Paul.
For more information please go to our Facebook page:
Contact and interviews:
Timo Niemi, Tornado Promotions +358 400 487 715
Record company: www.starshape.fi


text:
It was conveniently located & clean & the microwave & refrigerator in the room
The toilet was very slow when flushed
Hot breakfast
Bathroom did not have exhaust fan. Smell permeates room after someone uses bathroom.
The staff was very friendly and helpful. The motel site in the mountain area was beautiful. Prices at the bar and restaurant were reasonable.
Room had musty smell when I first entered. I kept the ceiling fan and A/C running which helped to eliminate the musty smell.
Lobby area with fireplace beautiful. Indoor pool and hot tub nice. Walking trails very pleasant.
Did not eat all day anticipating dinner at the resort. When we checked in, we were told the restaurant was closed due to not enough business. Nowhere was that made known to us. Tried to play air hockey but the only puck was missing in a resort that size
The right location for our trip.
Location of the room knowing that most of the better locations were emptey.
Good location
Toilet in the room needed the float level adjusted, it was running all night
The fireplace in the lobby was very welcoming along with the freshly made cookies. The rooms were nice, beds were comfortable and staff was efficient.
Very clean, the staff, and the location. Good coffee.
Very clean. The hall is big, quiet, neat and comfort. Break first is very good according my son's view who is critical.
A little problem of my door, it needs more try to open.
Here's why:
We're not the seller
At KAYAK we don't set prices, so it's not possible for us to guarantee what other companies are selling.
We aggregate tons of data for you
Our service lets you quickly and easily compare results from hundreds of travel sites at once. In this sense, KAYAK is a search engine and we don't guarantee prices we find.
Why aren't prices accurate 100% of the time?
Prices on airline seats, hotel rooms and car rentals can change frequently. Several people may also be trying to buy the same travel option simultaneously. As a result, you may find on occasion that certain prices are no longer available.
More questions or if you have a bad price to report to us
Please send us an
and someone from our team will get back to you promptly.


text:
DEPT56 Fred Holiwell's House Dickens Village LNIB
- Sold for: Start FREE Trial! or Sign In to see what it's worth.
- Item Category:
- Source: eBay
- Sold Date: Sep 21,2007
- Channel: Online Auction
"Fred Holiwell's House"
- "Fred Holiwell's House" Dept. 56 Dickens Village Item #58492. Introduced 2001 and retired 2004. Mint condition piece in original box & sleeve. Has interior scene viewable through front bay window. Garland decorates second floor railing. Size: 6" x 5.75" x 8".On display on a smoke free home
Items in the Worthopedia are obtained exclusively from licensors and partners solely for our members' research needs.


text:
English to Canadian French Translation
Closed - This job posting has been filled.
Job Description
I have an English text of about 1100 words; I need to translate from English to Canadian French.
I need Human Translation and Quality Translation; machine translation will be CHECKED and rejected.
Deadline 36 hours.
Budget 8 $
Thank you


text:
A paraglider on it's way home at a late summer evening.
Good capture….very nice work.
Thank you, Phil :)
this is an awesome capture! the colors of the sunset are beautiful and the glider is wonderfully silhouttered! well done :)
Supurb contrast excellent capture
Great shot! very well done!
Excellent capture! This would be great in the Hang gliders and Paragliders Challenge currently open for entries in A Vision of Flight!
Marie ~ Host


text:
We exist to make hungry people happy
We get people the food they want, when they want - wherever they are. It's simple...
You place your order
Simply order whatever you or your coworkers are hungry for at Seamless.com or using the Seamless smartphone app.
We send it to the restaurant
We immediately beam your order to the restaurant and they send you a confirmation email with delivery or pickup time estimate.
Your food arrives...Yum!
When your food's ready, the restaurant delivers it or you pick it up. All you have to do is sign for it and enjoy it!
990 Amsterdam Avenue (Amsterdam Ave & W 109th Ave), New York, NY 10025 | (212) 280-7329
Sort reviews by:
Loading, please wait...
Log in to your account to add your rating and review. If this is your first order, you'll need to finish placing your order before you can write any reviews.
|1. Bacon, Egg & Cheese
|2. Hot Turkey & Bacon Sandwich
|3. 109 Spicy Special
|4. The Dirty Bird on a Roll
|5. Hot Wings with French Fries
|Bacon, Egg & Cheese (2)
|The London Bridge on a Hero (1)
|Sausage, Egg & Cheese (1)
|Pastrami Turkey Grilled Sandwich (1)
|Cheese Fries (1)


text:
Blog News
Blog News
Blog News continually updated from thousands of sources around the net.
5 Guest Blogging Tips That Build Your Brand Successfully
1 hr ago | Small Business Trends | Comment?
Mike's Blog Round Up
5 hrs ago | Crooks and Liars | Comment?
Woman remains positive despite devastating diagnosis
6 hrs ago | KSL-TV | Comment?
Writing Lessons: Philip Gourevitch Is a Bad Blogger
10 hrs ago | Gawker | Comment?
App That Aims To Make Books 'Squeaky Clean' Draws Ire From Edited Writers
19 hrs ago | WGBH | Comment?
Who needs glasses 3/22/15
topix 264
53 Stars Who Died Shockingly Young
Fed Judge Strikes Down California's 10-Day Gun Waiting ...
guns 15,057
UVA Rape Hoax: The Lawsuits Against Rolling Stone Will Be AWESOME
23 hrs ago | The Daily Caller | Comment?
Revealed: Putin's army of pro-Kremlin bloggers
Yesterday | The Independent | Comment?
TKC Blog Community Told You So!!! Kansas City Police Take Busted and...
Yesterday | Tony's Kansas City | Comment?
Blog: Customer service experience in Bratislava
Yesterday | Slovak Spectator | Comment?
Pony Mad Muma s blog: buying ponies is like internet dating
Yesterday | Horse and Hound | Comment?
Malik Yoba: I Wasn't Fired From Empire For Drug Use! Rogue Bloggers Lie
Yesterday | The Hollywood Gossip | Comment?
5 reasons a business blog is better than a newsletter
Thursday | Examiner.com | Comment?
Stephen Fishbach's Survivor Blog: A Bromance Is Prematurely Snuffed Out
Thursday | People | Comment?
RCMP make terrorism arrest in P.E.I.
Thursday | Journal-Pioneer | Comment?
Live business blog: Thursday, March 26, 2015
Thursday | IcNetwork | Comment?
The different sides of Tumblr and what makes a blog successful
Wednesday | Journalism.co.uk | Comment?
Slain US blogger's wife urges 'thorough' Bangladesh probe
Wednesday | Channelnewsasia.com | Comment?
7 Life Lessons We Learned From Grace Gealey's ESSENCE Blog
Wednesday Mar 25 | Essence Magazine | Comment?
Finally, we know how many bloggers live in their parentsa basement
Wednesday Mar 25 | The Washington Post | Comment?
Trending Now
Updated: Sat Mar 28, 2015 10:12 am
Copyright © 2015 Topix LLC


text:
Well, that makes more sense.
Trust nobody!
Still here not as frequent as I was got other bad habits now lol
I'm a member of PETA!!!!
" The mind creates the abyss, the heart crosses it."
The measure of your life will not be in what you accumulate, but in what you give away. ~Wayne Dyer
Friends are over rated. I used to have friends, and all they wanted was to borrow money, use a vehicle, or need help moving.Now I now avoid friendship.
Still shakin' it Boss, still shakin' it.
Never really understood the friend thing. Have noticed that a lot of folks from years ago aren't active these days and i have to say i miss some of their banter. Like someone else said, "HF is like my Facebook". Oh oh, i just used quotation marks. Hope that was correct (-;. Anyway, for me its all good. I like seeing pics of where other folks hang out and i try to pay back the favor when i can.
" The mind creates the abyss, the heart crosses it."
The measure of your life will not be in what you accumulate, but in what you give away. ~Wayne Dyer
I've got a handful of people from HF on either my Google+ or Facebook...and there are some that I keep in touch with on the phone or texts and such.
Here's a challenge: For the 500th person to send me a friend request here on HammockForums, I'll give you a free virtual high five.
Palmetto State Hangers
is proudly sponsored by and is proud to support:
Dream Hammock, Underground Quilts, TATO Gear, Hound Dog Hammock Gear, and Appalachian Hammock.
Next Hang: SPRING SWING
i hope they got lost in the piney woods
i been sleeping in a hammock for over a year everynight and its all thanks to your enthusiasm, thank you for reaching out to everyone even if there not your "friends" ! im glad your still using the forums !


text:
Forgot Password?
Not Registered?
Events: JEC Europe Composites Show & Conferences 2015
Events: JMAG at Altair Info-Tage Elektromagnetismus
News: CAEfatigue Limited Brings Unique Vibration-Specific Fatigue Software to the Altair Partner Alliance
News: Altair and EM Software & Systems – S.A. (EMSS) Close Deal
View All News
View All Events
CarSim is a software tool for simulating and analyzing the dynamic behavior of two-axle...
RadTherm heat transfer software is a professional thermal simulation tool for comprehensive...
scSTREAM is a general-purpose thermo-fluid analysis software utilizing pressured based Finite...
View All
Apply Now!


text:
We're sorry, we need more information to run your search. Please enter a last name (adding more details will improve your results).
If you're trying to reconnect with Lillian Leak, then nothing could be easier, especially if you know where to look. You can depend on PeopleFinders.com to provide access to trustworthy info about Lillian Leak. In fact, we found a Lillian Leak who was born in [YOB] and is 68 years old. If the Lillian you're looking for lives in Winston Salem, NC and is related to [RELATIVES], then sign up now to find out even more.
You can be certain of locating the correct Lillian Leak swiftly and easily by going through the bits of data we have provided. This data contains all the info you need to help you identify the right [First] Lillian Leak Leak and has all of the info you're looking for such as previous residences, known aliases, and more. If you can't locate Lillian listed on this page, simply continuing scrolling through all the pages of info we have of those with the last name Leak.
To quickly access public records and contact info for Lillian Leak, you can perform an advanced search. Just add any further info you have, such as middle name, city, state and/or age, and we'll return a smaller set of more relevant results, making the process much faster for you. Subscribe today to get the latest information about Lillian Leak.


text:
In tandem with the opening of Richard Mille's newest boutique (in Singapore), the RM 011 Ceramic NTPT Asia Limited Edition brings a (curiously American!?) red white and blue color motif to the party. The latest RM011 has a white ceramic bezel and caseback in combination with NTPT carbon fiber tech caseband, along with the "standard" RM011 flyback chronograph caliber with innovations such as the variable geometry rotor and more.
Distribution of the watch — only 5o pieces will be made — will be limited to Mille's Asian boutiques (he has ten in the region), which keeps with his favored practice of creating specific designs for specific geographies. The price on the RM 011 Ceramic NTPT Asia Limited Edition is about 193,000 Singapore dollars, excluding tax/GST.
On a related topic — if you haven't been to the new Richard Mille website yet, now would be a good time to check it out, it's worth a visit: http://www.richardmille.com/
Did You Know?
NTPT® carbon is an exclusive material with a unique appearance. Its remarkable surface displays extremely regular undulations, as NTPT® carbon is composed of multiple layers of parallel filaments obtained by dividing carbon fibers. These layers, with a maximum thickness of 30 microns, are impregnated with resin then woven on a special machine that modifies the direction of the weft by 45° between layers. Heated to 120°C at a pressure of 6 bars, the NTPT® is then ready to be processed on a CNC machine in Richard Mille's ProArt case factory. When compared to composite materials, whose exceptional physical properties are already well known, NTPT® carbon improves the rate of occurrence of breaking stresses by 25% and of micro-cracks by 200%. source


text:
Letter: Report on homelessness prompts questions
I was once again made painfully aware by the Bemidji Pioneer article, appearing on Nov. 17, on the plight of the poor and the homeless in our area.
Get the full story
Subscribe or Log In
Are you a newspaper subscriber but you don't have a Digital Access account yet? Activate your account.
You will need your subscription account number and phone number. Not sure if you have an account? Email us or call (218) 333-9200 and we can help you.


text:
Agrobiodiversity refers to the dynamic and complex relations among human societies, cultivated
plants and the environments where they interact, and it is directly
related to food security, nutrition, health, social equity and justice,
environmental sustainability and climate change adaptation.
Agustine Mbugua is reaping the benefits of conservation agriculture
in his single acre piece of land in the Ngata Division of Nakuru
County, 170km west of Nairobi. "Not only have I stopped using fertiliser
on my farm because the manure from the crop cover provides enough
nutrients to the crops, but the labour costs have gone down.
Report on Financing options for REDD+ recommends that "sustained investments" at the centre of REDD+ architecture and to
redefine performance. Future progress in REDD+ will require supporting
developing countries to carry out legal and policy reforms that lead to
long term and sustainable land use and improvements in governance,
improved management and conservation of forest lands.
Smallholder farmers across East Africa have started to embrace
climate-resilient farming approaches and technologies, according to new
research recently published by the CGIAR Research Program on Climate
Change, Agriculture and Food Security (CCAFS).
Ahead of COP 18 talks in Doha, Qatar, negotiators met in Bangkok and outlined enabling conditions for the implementation of REDD+ mechanism. Download here
A key
determinant of REDD+ success will be the continued development and
implementation of safeguards. An important element of REDD+ safeguards is
systems for providing information on how safeguards are addressed and
WWF have released a report that guides towards appropriate monitoring, reporting and verification (MRV) of carbon emissions
associated with REDD+ in a
nested system.
This presentation by WorldAgrofrestry Director General, Prof Tony Simons, explains what is a landscape approach and why it is needed for future forest and tree resources management.
With the United Nations Climate Change Conference less than four months
away, African countries need to present convincing arguments and
successful adaptation projects to attract competitive funding for
adjusting to changes in global weather patterns, climate finance experts
say. Read more


text:
Also Hearts known as Black Lady, Chase the Lady, Crubs, Black Maria. Enjoy perfect graphics and gameplay, try to beat off other players!
In 1.x Hearts version, your 3 opponents are clever anthropoids cloistered in your Android device :)
Hearts? Yes! Play Hearts, have fun!
- Really challenging computers
- Online multiplayer
- Statistics
- Jack of diamonds settings
- Passing rules settings
- Change names and avatars
- Change a color style of the game
- Choose between several decks
- Landscape and portrait support
- Fits phones, tablets and HD phones
It's time to break some hearts!
And beware of computers – they don't cheat, but they are evil and unforgiving!
Hearts - Free
Play the famous game of Hearts against opponents simulated by advanced artificial intelligence.
Easy to learn, very fluid and rapid gameplay, includes animations for realistic atmosphere, with attractive design.
- Opponents are endowed with advanced AI, and they won't be easy to beat !
- Option to play with the Jack of Diamonds variation.
- Personalize the application: change player names, number of points per game, several available versions.
- Statistics for games played.
- Game rules included in the application.
- Back-up of hand in play in case of application shut-down.
Have a great game !
Hearts Mobile
Play a captivating game of Hearts. To win you must avoid getting the scoring cards. The game is over when one of the four players gains more or exactly 100 points. You win if you have the smallest score. Though chance is involved you can still make the best of your moves and win. Download and play now!
✓ advanced AI players
✓ balanced rules
✓ intuitive interface
✓ You win if you avoid collecting the scoring cards in the tricks you play.
✓ The scoring cards are the cards of heart, each scoring 1 point, and the Queen of spades, scoring 13 points.
✓ The player which places the biggest card of the type that started the trick collects the trick.
✓ The value of the cards grows in this order 2, 3, 4, 5, 6, 7, 8, 9, 10, Jack, Queen, King and Ace.
✓ The first trick in a round starts by hitting the 2 of clubs.
✓ Placing a card of hearts in the trick for the first time is called breaking the hearts.
✓ You can hit a card of hearts for the starting card in the trick if you only have hearts or the hearts were broken.
✓ If you don't have a card of the type which started the trick you can place any card.
✓ Sometimes you can collect all the scoring cards achieving a score of 26, in which case you shoot the moon. You will receive 0 points and the others will each receive 26 at the end of the round.
✓ If by shooting the moon some player's points go over or reach 100 than the player which shot the moon receives -26 points and the others 0 points.
✓ The first round you have to pass 3 cards to the left, the next one to the right, the third one - across, and in the fourth one you don't have to pass at all. The cycle repeats itself for the following rounds.
✓ To see the game statistics you can press the -statistics button- in the main menu.
✓ To start a new game press -New Game- in the main menu.
✓ When some players go over or reach 100 the game is over.
✓ To pause the game just enter the main menu.
★ Support and Feedback:
If you have any technical problems please email us directly at firstname.lastname@example.com. Please, don't leave support problems in our comments – we don't check those regularly and it will take longer to fix any issues that you might encounter. Thank you!
Become a fan on Facebook:
Follow us on Twitter:
Hearts Free
Hearts Free brings this classic and popular 4-player trick-taking card game to the Android market. Created to the same high standard as the rest of our games, Hearts Free provides classy graphics, super smooth gameplay, highly scalable difficulty & much more. Hearts has never been so good!
- Full Hearts play, with optional Jack of Diamonds rule
- Card passing options, including alternating (Left, Right, Across, No Pass)
- 18 CPU Hearts players of varying skill (beginner to expert)
- Choose which characters to play against!
- 5 Backgrounds to choose from (or use your own photo!)
- User and CPU player stats!
- Undo & Hints
- Hearts Rules & Help
- Designed for both Tablet and Phone
Supported by unobtrusive Ads.
*Note: Requested permissions are a requirement of the in-game ads only. The Paid version has no ads, and therefore no permissions beyond writing to SD card.*
•normal and omnibus rules
•easy intuitive touch interface
•smooth animations
•invite google+ friends to play against
Hearts Gold
• Rules: normal, spot hearts, black marie, black marie (us) & custom.
• High resolution graphics
• Native tablet support
• Choose who to play with and against.
• Rename players.
• Achievements & leaderboards
• Customize the look and feel
• Basic stats.
• The AI doesn't cheat!
Customize the game with house rules like:
• Teams
• Starting player
• First round
• Breaking hearts
• Passing
• Shoot the moon
• Shoot the sun
• Heart card points values.
• Other card points values.
• Target score can be a flexible range of points or number of hands played.
You can visit my homepage at http://www.manabattery.com and follow me on facebook https://www.facebook.com/TheManaBattery
Aces Hearts Classic
Fun characters, smooth animations, and great game play make this a card game that you'll enjoy playing over and over on your Android device.
• 10 fun characters to play against.
• In-game turn advisor.
• 5 difficulty levels.
• Many options to customize.
• Turn animations off for quick play.
• Achievements powered by Google Play game services.
♦♦♦ Permissions requested and how they are used ♦♦♦
• android.permission.INTERNET: This permission is used to: 1) link to our website, 2) link to social networking like Twitter and Facebook, 3) update leaderboards, 4) collect gameplay data that we use to improve our games, and 5) allow ad networks that advertise within the app.
• android.permission.ACCESS_NETWORK_STATE: This permission is used primarily to check for a network connection before attempting to connect to our website.
• android.permission.WRITE_EXTERNAL_STORAGE: This permission allows the app to access game data saved on an external storage device.
• android.permission.READ_PHONE_STATE: This permission allows the app to establish a unique ID for our leaderboards that can be used across all of our applications.
• android.permission.ACCESS_WIFI_STATE: This permission allows the app to establish a unique ID for our leaderboards for tablets that do not have telephone information.
• android.permission.VIBRATE: This permission is used to access vibration functionality on the device..
YouTube(Flash version)
How to play multiplayer games over Bluetooth
How to play multiplayer games over TCP/IP
This application requires Bluetooth and full internet access permission for multiplayer games.
This application is ad-supported and requires full internet access permission.
Hearts Plus
The most popular Hearts Game on Facebook is now available for Android for FREE!
Connect through 3G, Edge or Wi-Fi and play Hearts Plus online with other players around the World.
Hearts is a trick-taking card game.
Score the fewest points by avoiding penalty cards which are Hearts and the Queen of Spades. On the other hand, if you collect all the penalty cards in one round, your opponents will be penalized instead of you!
Hearts game now becomes more fun with "Plus" edition.
Key Features
Play with other players from different countries
Add other players as friends
Chat with other players at the game tables
Join to your friends' tables with one click and start to play with them
Join VIP Room and create your own game tables by deciding bet amounts and ending points
Experienced a problem? Got a suggestion? You can reach us at: email@example.com
In order to learn about the latest news and updates: https://apps.facebook.com/heartsplus/
• Hearts is a very popular card game.
• The flexible AI adjusts to any player.
• Easy-to-use, responsive controls.
• Three levels of difficulty
• History
The goal of Hearts is to have the lowest score at the end of the game. You must play a card in the same suit (Clubs). If you do not have one, you can play any card, except that you cannot play a Heart or the Queen of Spades on the first turn, also called "trick". The person who plays the highest card of the same suit as the leading card "takes the trick" and leads the next trick. The player who takes the trick earns 1 point for each Heart in that trick and 13 points for the Queen of Spades. But if someone wins all the Hearts and the Queen of Spades, also called Shooting the Moon, then that person scores 0 points and each other player scores 26 points! The game ends after any player earns 100 points or more!
★★★★★ - "Hearts has never been this addictive" - TheAndroidReviews
★★★★ - "Real Hearts fans will love this game" - DroidRatings
Hearts is a popular 4-player trick-taking card game. The goal of the game is to avoid taking hearts and the queen of spades.
Featuring beautiful graphics and smooth game-play, this game of Hearts is all set to win your Heart!
❖❖❖❖ Features❖❖❖❖
✔✔ Designed for both Tablet and Phone
✔✔ 5 Different Card Styles
✔✔ 5 Different Boards
✔✔ Hint System
Hearts is trick-taking playing card game for 4 players, no teams and no trump suit. The game is also known as The Dirty, Black Lady, Chase the Lady, Crubs, and Black Maria, though any of these may refer to the similar but differently-scored game Black Lady. The game is regarded as a member of the Whist family of trick-taking games (which also includes Bridge and Spades), but the game is unique among Whist variants in that it is an evasion-type game. The object of the game is to avoid taking points. When the first player reaches 100 points, the player with the lowest number of points is the winner.
In hearts each heart card is worth 1 point and the queen of spades is worth 13 points, which is as much as all of the other cards combined.
At the beginning of round, the players choose three cards to pass to a random player. The player with the 2 of clubs must lead the first trick with the 2 of clubs. For each trick a player must follow suit unless he does not have a card of that suit. Because there is no trump, a player can not win a trick if he passes a card of any suit other than the suit lead. Hearts can not be lead until hearts are broken - after the first heart card has been played. If a player takes every point in a round, he "Shoots the Moon" and he receives 0 points for the round while all other players receive 26 points.
Don't forget to check our Games section for more fun games...
Hearts Free
Play the classic card game Hearts where the goal is to avoid taking hearts and the queen of spades. With quick play against 3 players. hearts can provide hours of entertainment.
•normal and omnibus rules
•easy intuitive touch interface
•smooth animations
Hearts Rules:
These are the rules I use for Hearts. There are many variations possible,
The objective of Hearts is to get as few hearts as possible. Each heart gives one penalty point. There is also one special card, the Queen of spades, which gives 13 penalty points.
When the game starts you select 3 cards to pass to one of your opponents. Typically you want to pass your three worst cards to get rid of them. Which opponent you pass to varies, you start by passing to the opponent on your left, then in the next game you pass to the opponent on your right, third game you pass across the table and in the fourth game there is no card passing.
Each turn starts with one player playing a single card, also called leading. The suit of that card determines the suit of the trick. The other players then play one card each. If they have a card in the same suit as the first card then they must play that. If they don't then they can play one of their other cards. Once four cards have been played, the player who played the highest ranking card in the original suit takes the trick, i.e. he takes the four cards on the table and he then starts the next turn. Any penalty cards in the trick (hearts or queen of spades) are added to the players penalty score. So you want to avoid taking any tricks that have hearts or the queen of spades.
The player who has the two of clubs at the start of the game leads in the first hand, and he MUST lead with the two of clubs.
You cannot lead a trick with hearts, until hearts has been broken (played on another suit). So if it is your turn to lead and no heart has been played yet then you may not select a heart as the card to play first. In some variations of the game you can't play the queen of spades until hearts has been broken as well, but in this version you can always play the queen of spades and she doesn't break hearts.
In the very first round you may never play a heart or the queen of spades, not even if you don't have any card in the suit of the lead card.
Once all cards have been played the penalty points are counted and the player with the fewest points wins that hand. When one or more players reach 100 points or more then the entire game is finished, and the player with the least points win. If points are over 100 and there are two or more equal with the least points then play continues until there's only one winner.
Shooting the Moon! Generally it's bad to get penalty cards, but there is one extra twist! If you get ALL the penalty cards (13 hearts + Queen of spades) then you get 0 points and the other 3 players get 26 points each! This is called Shooting the Moon. Trying this can be a really risky move though, since if another player gets just one of the hearts you'll end up with a lot of points...
Hardwood Hearts (Free)
Specially designed for tablets and phones Hardwood Hearts breathes new life into your favorite card game with excellent graphics. Enjoy calming Hearts playing environments with ocean waves breaking in the distance.
Play with players from around the world or with family and friends.
Check out where you stand with the online leader board. Enjoy achievement challenges that take the experience from just a single game of spades to even more fun.
Hardwood Hearts is customizable with new backgrounds, cards, player avatars and tables that can be added to the game via paid downloadable content.
Hearts game variations included in Hardwood Hearts:
✔ Partnership (traditional)
✔ Individual (singles)
✔ Spot Hearts
✔ Timed games
★★★★★ "Works great on Droid DNA! Love this game! Best hearts game for Android for sure."-Collin C
★★★★★ "Awesome Very fun. Works great. Highly recommend"
Works great on devices with Nvidia Tegra Processors and phones like the Samsung Galaxy S, Samsung Galaxy S II and Evo 3d phones.
Best played on tablets and recent android phones.
★ Want new features? Have some suggestions? Found an issue? Email your feedback to email@example.com
Same as our "Hearts Free", but without advertising!
AI Factory Hearts brings this classic and popular 4-player trick-taking card game to the Android market. Created to the same high standard as the rest of our games, AI Factory Hearts provides classy graphics, super smooth gameplay, highly scalable difficulty & much more. Hearts has never been so good!
- Full Hearts play, with optional Jack of Diamonds rule
- Card passing options, including alternating (Left, Right, Across, No Pass)
- 18 CPU Hearts players of varying skill (beginner to expert)
- Choose which characters to play against!
- Choose between 3 decks of cards and 5 backgrounds (or use your own photo!)
- User and CPU player stats!
- Undo & Hints
- Hearts Rules & Help
- Designed for both Tablet and Phone
**Note that when upgrading from the Free version, the User/CPU player stats (only) are retained. To do this the game needs to read from your SD card when it starts for the first time, so please make sure the SD card is available and not connected to your PC**
More from developer
Photo Slides (Photo Frame)
PRO Version is here: https://play.google.com/store/apps/details?id=com.igcmobile.android.photoframepro
NEW: Improved version with a lot of features requested by our users and even more.
Photo Slides uses all the most important capabilities of Android OS device to turn your Tablet or Smartphone into a high quality photo frame.
No doubt that powerful performance and visual effects, screen quality and touch screen controls of the all-purpose Android device are definitely better than similar features of the specialized cheap analogs at the stores.
Photo Slides extends active life of any Android device allowing them to serve as a great photo frame and remind the perfect moments of your life.
* Optimized for the large number of images. Just copy your entire collection to the card!
* Easy to choose folders and individual image files
* DLNA supported (beta)
* [PRO] Thumbnails view (if thumbnails were generated by system before)
* [PRO] Optional DCIM folder synchronization on every start
* Supports G-sensor to track device orientation
* Optionally groups images to match device orientaion
* Slide show mode or manual navigation
* Various resize/fit modes to avoid borders or crop
* [PRO] Panoramic view mode by automatically images scrolling
* [PRO] Easy to skip or delete unwanted images during preview
* Useful brightness control
* Several sorting modes and shuffle mode
* 8 slide effects
* Option to save battery when no external power
* Supports built-in storages as well as external cards
* Optional on-screen clock
* [PRO] Scheduled automatic start and exit
items marked [PRO] available in paid version only.
Your suggestions and reports are very appreciated. Drop us e-mail if you have any problems or suggestion, unfortunately we are unable to post a reply to Markets comments.
Pyramid Golf Solitaire
Popular card game specially optimized for Android. Play easily and smoothly, enjoy smooth gameplay!
Move all the cards to the Waste. Uncovered cards available for play. Waste starts with any card, build up or down regardless of suit; A and K are consecutive. No redeals
Spiderette Solitaire
Within the Tableau you can build face-up descending sequences regardless of suit, but only in-suit sequences can be moved. Put any card to an empty column.
Click Stock to deal one card to each Tableau. All empty spaces must be filled before a deal.
Play with 1,2,3 or 4 suits
Spider Solitaire (Web rules)
Within the Tableau you can build descending sequences regardless of suit, but only in-suit sequences can be moved. Put any card to an empty column, Reserve can hold any number of cards.
Click Stock to deal one card to each Tableau. All empty spaces must be filled before a deal.
Yukon Solitaire
Face-up cards within the Tableau should be build in descending sequence of alternating colors. Move groups of cards if they are face up regardless of sequence. Put a King to an empty column, if such appears
Selective Castle Solitaire
moved to the first pile, wrapping K -> A, until each pile contains 13 cards. Tableau cards should be build in descending sequence regardless of suit. Put any card to an empty column, top pile card is available for play
Two-Ways Solitaire
The same rules to move groups of cards, and to build Tableau. Put any card to an empty column
Click the Stock to turn over card to Waste. No redeals
Busy Aces Solitaire
Complete the Foundations, build each one in suit from Ace to King.
Cards within the Tableau should be build in descending sequence in suit. Only top card available for play.
Put any card to an empty column. Click the Stock to turn over card to a Waste, no redeals
Golf (Turbo) Solitaire
The goal is to move all the cards to the Waste pile. Waste begins with first card from Stock and build up or down regardless of suit.
Read Help for detailed rules and Turbo / Golf options
Enjoy! Don't forget to rate
Cheops Pyramid Solitaire
RULES: Pair up all the cards to discard them to DECK. Only uncovered cards available for play. Discard pairs of cards of the same rank or consecutive ranks: Aces & Kings are not consecutive. To make a pair, drag one card over another.
Enjoy, Good luck! :)
Fifteen Puzzle Solitaire
RULES: Build 13 piles of 4 cards of the same rank in each pile. You can drop a card to an empty column, or on a card with the same rank. Max 4 cards are allowed in a pile.
Get more Softick Games on the Market!
Russian Cell Solitaire
Play easily, think on solution, not on control!
RULES: Face-up cards within the tableau should be build in descending sequence in suit.
Move groups of cards regardless of sequence. Put a King to an empty column, if appears.
2 free cells - storage for 1 card
Queenie Solitaire
RULES: Complete all the Foundations in suit, from A, 2 to K.
Cards in the Tableau should be build in descending sequence of alternating colors. Move card groups regardless of any sequence.
Put a King to an empty column. Click Stock to deal 1 card to each Tableau
East Heaven Solitaire
Complete all Foundations in suit, from A to K.
Face-up cards in the Tableau should be build in sequence down, alternating color. Move face-up card groups in sequence down in alternate color.
Put a King to an empty column. Click Stock to deal 1 card to each Tableau
Stone Wall Solitaire
Face-up cards in the Tableau should be build in sequence down, alternating color. Move face-up card groups in sequence down in alternate color. Put any card to an empty column. Doubleclick the Reserve to move the bottom card to the top of the stack
Doublets Solitaire
RULES: The goal of the game is to discard all the cards in pairs of the same rank. The top card of each pile is available for play. To discard pair just drop one card over another
Enjoy! Don't forget to rate!


text:
Current Stories
Download - NVIDIA PhysX System driver 8.09.04 WHQL
This driver Supports all AGEIA PhysX Processors and GeForce PhysX. This driver will allow you to select and dedicate a GPU to PhysX as well.
- Supports for NVIDIA PhysX acceleration on all GeForce 8-series, 9-series and 200-series GPUs with a minimum of 256MB dedicated graphics memory.
- Experience GPU PhysX acceleration in several full games and demos today by downloading the GeForce Power Pack.
- Supports AGEIA PhysX processors and software runtimes (no change to PPU driver support).
- Includes the latest PhysX runtimes used in the latest game titles.
- Supports the following NVIDIA PhysX runtime engines: 2.8.1, 2.8.0, 2.7.4, 2.7.3, 2.7.2, 2.7.1, 2.7.0, 2.6.x, 2.5.x, 2.4.x and 2.3.x
- Supports NVIDIA PhysX acceleration on GeForce via CUDA 2.0 for SDK versions 2.7.3, 2.7.2, 2.8.0 and 2.8.1 (requires graphics driver v177.81 or later).
- The PhysX control panel can be found in the Windows Start Menu under NVIDIA Corporation.
Download - click here.
GeForce GTX 260 Core 216 | BFG OCX MaxCORE review [Guru3D]
BFG GeForce GTX 260 OCX MaxCORE test -- NVIDIA was seeking for some more performance in the GTX 260 series, they need to give it a little more bite. And though I'm sure that yet another SKU will drive board-partners crazy, I say bring it on.
NVIDIA today is introducing the GeForce GTX 260 Core 216, this new chip has one additional shader cluster which brings the accumulated number of shader processors towards 216. And it does make a slight difference, yet we'll test the BFG OCX MaxCORE version of it, and boy it does have a lot more bite.
You can read the review right here.
Star Wars: The Force Unleashed video-review
Seagate FreeAgent External Hard Drives
Seagate announced the Fall 2008 lineup of the company
Intel launched its first 6-core processor
Intel launched the Xeon 7400 today. The processor once nicknamed "Dunnington" is the first x86 architecture design to hold six cores and is targeted at very high-end computing where sheer parallelism is more important than clock rate; it's particularly useful for virtual machines and databases, Intel suggests. The chipmaker estimates a speed boost of as much as 50 percent and helps this in part by a similar increase in Level 2 cache to 16MB as well as dedicated virtualization features on the cores themselves.
The processor line tops out at a lower clock speed than quad- or dual-core Xeons and sees the top model reach 2.66GHz with the same 130W of peak power as higher-clocked quad core systems. A 2.4GHz model carries most of the performance but at 90W, while a 2.13GHz entry runs at 65W and is suited to rack servers or other thin servers and workstations. Four quad-core models are also available; the top 2.4GHz version carries the same 16MB of cache as six-core systems and uses 90W of power. The remaining three clock in at 2.13GHz but use cache and power use to determine their speed, with a regular 90W version loading up 12MB of cache, a budget version stripping down to 8MB of cache, and a low-voltage model carrying 12MB but using just 50W of energy.
Intel expects several large-scale PC companies to build systems on the chips, which range in cost from $856 to $2,729 in batches of 1,000. The new Xeons are the last before the transition to the new Core i7 architecture but should result in some of the techniques involved in their design rolled into other processors.
HP updates TouchSmart to 26 inches, Blu-ray
HP updated its TouchSmart all-in-one PCs to push them into high-end home theater territory not covered by earlier models or rivals such as the iMac. The IQ800 series carries a 25.5-inch, 1920x1200 display that converts the touchscreen PC into a near home theater; accordingly, the system comes with a Blu-ray combo drive in one model while all of them have 1080p-capable video and ATSC/NTSC TV tuners. To match the HTPC focus, either system also has new ambient lighting on their chins that either illuminates the wireless keyboard on a desktop or just sets the mood.
The PC builder's custom touchscreen interface is the same as before and streamlines lightweight photo management and editing, music playback, and widgets for weather or other info.
Two models start off the IQ800 line. The IQ804 is built for average use with a 2.16GHz Core 2 Duo, 4GB of RAM, a 500GB hard drive, a DVD burner and a GeForce 9300M GS for video. An IQ816 model adds the Blu-ray combo drive along with a Penryn-era 2.1GHz Core 2 Duo, a larger 750GB hard disk and GeForce 9600M GS video. Wi-Fi over 802.11n provides local networking for every model while either also has a Pocket Media Drive bay to add extra internal storage.
HP starts the IQ800 series at $1,899 and estimates a launch for September 21st. The premium IQ816 boosts the price to $2,099 for an October 21st release.
Guru3D Folding at Home team breaks Top 100 !
It takes a lot of people to do a lot of work, and we surely did that recently as Team Guru3D has entered top 100 in the Folding@home rankings !
It was close to a year ago when team Guru3D joined the folding@Home project for the good cause. At first we had a lot of people donating thei IDLE CPU cycles to the project and recently all the hottie new GPUs from ATI and NVIDIA can be used to compute as well. back then we advanced roughly 40.000 points per day. Wonderful yet currently we average at 170.000-180.000 points per day, amazing. Due to your help we now have entered the Top 100 which is a fantastic achievement.
Guys thank you all so much for helping out in this project !
Now if you have an ATI Radeon series 3000 or newer or GeForce series 8 or newer graphics card and like to help fighting diseases, please join our team, we have Team ID number 69411.
You can download the latest GPU or CPU clients here.
Should you need help / want info check out our Folding support forums here where anyone will help you with any questions you might have. Come on people, team 69411 ! Thanks to all who are participating in this project, and a special thank you to our top 20 donators:
|Top 20 Producers
24hr Avg
Tomorrow a review on ... [Guru3D]
Stalker: Clear Sky -- Graphics Card | VGA performance roundup
Sun rays burst through cracks in wooden roofs. Lightning lights up the night sky as well as dark interiors. It looks terrific and atmospheric, which is what S.T.A.L.K.E.R. is all about really. But how does it perform ?
Guru3D.com takes 13 graphics cards and has a peek at performance.
Read Guru3D article, click here. And for those interested, we have a huge forum thread open on this game located right here.
Grand Theft Auto 4 PC recommended specs
Just in case you where wondering. The Games for Windows website has released the recommended system specs for the upcoming PC port of Rockstar's Grand Theft Auto IV.
The PC version of GTA IV will include an expanded multiplayer component, improved graphics, and a gameplay clip editing suite when it hits the PC on November 18.
Operating System: Windows XP SP2
Processor: Dual core processor (Intel Pentium D or better)
Hard Drive: 18GB free hard disk space
Video Card: 512MB Direct3D 10 compatible video card or Direct3D 9 card compatible with Shader
Drive: DVD-ROM dual-layer drive
DRM makes Spore most pirated game ever
Spore was without doubt the most anticipated game of the year. The game itself has blown away the people who have played it, but the DRM encouraged thousands to get their copy illegally. Already Spore has been downloaded more than 500,000 times on BitTorrent, and this number is increasing rapidly accrding to TorrentFreak.
Most critics agree that Spore is a great game. However, the users aren
Passionato: DRM-free
[QUOTE]Following in the footsteps of Deutsche Gramophon, a service called Passionato is launching today, which will feature very high quality DRM-free downloads of classical... er... classics. It could prove popular - as previously reported, one in three classical music lovers owns an MP3 player, and download music, as well as ripping their classical CDs to MP3. One in five legally download tracks.
Let's talk about audio quality first. Passionato will offer tracks in both 320kbps MP3 and in lossless FLAC format. Both feature incredibly high audio quality - something demanded by many classical music fans. Many modern pop songs feature large amounts of compression that aren't so easily battered by MP3 processing, and sound fine at lower qualities. Classical tracks, on the other hand, are a little more fragile, and sound awful when compressed, losing all the nuances of the sound. It's great that Passionato understand this.
Secondly, the lack of DRM is important. It means that fans will be able to use their music however they want - on almost any brand of digital music player - and will be able to burn tracks to CD, should they want to. The death of DRM has been one of the biggest victories for consumers in digital music in recent years.
Lastly, Passionato also has a bunch of Web 2.0 style community features, much like Dilettante. Users can post their favourite albums and tracks to the biggest social networks, and integration with social bookmarking service del.icio.us is also built in. There's also a forum, and a recommendations engine.
Passionato looks good (though is it slightly off-centre of the page? Or is that just me?) and doesn't seem too expensive either, offering a couple of albums on the front page for
Creative to launch new X-fi product next week
Creative is preparing itself for a new X-Fi product launch next week, on September 17th.
Little has surfaced in recent weeks of devices that would match the description. The X-Fi name is already on the X-Fi Go! sound card and is already in use for handhelds through the ZEN X-Fi. A recent patent filing has also recently alluded to the development of a tablet like device that may represent a new ZEN Vision with a camera, though Creative isn't required to launch new hardware based on patents and may give any finished product a different name. Notably, Creative has generally left the Vision untouched since the Vision:M and Vision:W were introduced in 2006 while most of its X-Fi products have been released in 2007 and 2008.
Trailer: The Sims 3 behind the Scenes
EA unveiled a "behind the scenes" trailer of The Sims 3. This behind the scenes trailer might just be of interest to you then! Some of the masterminds behind the game are featured in the trailer, proudly explaining and demonstrating some of the new customisation options and best new features.
Second Installment Seinfeld Microsoft ad
Well something is working with these ads, the fact that we post it as a news-item is proof of that for sure. But man they are weird.
Microsoft has released the second ad in its Seinfeld Windows campaign. It's... making fun of your average scalloped potato-eating, leather giraffe from Cabo-buying, grumpy Grandma-having Suburban family. The incredibly rich duo try to connect on a
Trailer: F.E.A.R. 2: Project Origin
Download: nForce 15.23 XP and Vista WHQL released by NVIDIA
Download the new nForce 15.23 WHQL driver for XP or Vista both 32-bit and 64-bit versions are available. this set is WHQL certified (Microsoft approved) and we've been hearing a lot of good stuff about them !
- Ethernet Driver (v67.89) WHQL
- Network Management Tools (v67.91) "Sedona"
- SATAIDE Driver (v10.3.0.42) WHQL
- SATARAID Driver (v10.3.0.42) WHQL
- RAIDTOOL Application (v10.3.0.42)
- SMU Driver (v1.61) WHQL
- SMBus Driver (v4.69) WHQL
- Away Mode Driver (v6.0.6000.107) WHQL
- Installer (v6.14)
nForce Driver 15.23 Vista 32-bit WHQL
nForce Driver 15.23 Vista 64-bit WHQL
nForce Driver 15.23 XP 64-bit WHQL
nForce Driver 15.23 XP 32-bit WHQL
We also have a discussion thread open on these drivers right here.
OCZ Technology Gladiator and Gladiator Max CPU Coolers
Sunnyvale, CA


text:
An apparatus and a method are provided for performing network routing. The present invention comprises authentication logic, decision logic and routing logic. The authentication logic is configured to receive packets sent from a source agent to a tunnel endpoint and to determine whether or not the security association corresponds to the source agent that configured the tunnel. The decision logic makes a routing decision that is constrained based on the security association of an authenticated. The routing logic then selects a routing destination for the authenticated packet that is based at least partially on the routing decision made by the decision.
1. An apparatus for performing network routing, the apparatus comprising:
authentication logic configured to receive packets sent from a source agent to an endpoint of a tunnel and to determine whether a security association of a packet received corresponds to said source agent, the tunnel being configured by said source agent in accordance with a network protocol;
decision logic configured to make a routing decision for each authenticated packet at least in part without regard to contents of a payload of the packet, the routing decision being based on the security association of the authenticated packet; and
routing logic configured to select a routing destination for each authenticated packet and to route the authenticated packet to the selected routing destination, the routing destination selection being based at least partially on said routing decision.
2. The apparatus of
3. The apparatus of
decapsulation logic configured to decapsulate received packets, wherein when the decapsulation logic decapsulates a packet, the security association of the packet is preserved and contents of a payload of an authenticated packet are routed to the selected routing destination.
4. The apparatus of
5. The apparatus of
6. The apparatus of
7. The apparatus of
8. The apparatus of
9. The apparatus of
10. The apparatus of
11. The apparatus of
12. The apparatus of
13. The apparatus of
14. The apparatus of
15. A method for performing network routing, the method comprising:
authenticating received packets sent from a source agent to an endpoint of a tunnel by determining whether a security association of a received packet corresponds to the source agent that sent the packet, the tunnel being configured by said source agent in accordance with a network protocol;
making a routing decision for an authenticated packet at least in part without regard to contents of a payload of the packet, the routing decision being constrained based on the security association of the authenticated packet;
selecting a routing destination for a packet based at least partially on the routing decision; and
routing the authenticated packet to the selected routing destination.
16. The method of
decapsulating the packets, wherein when the packet is decapsulated, contents of a payload of the authenticated packet are decapsulated and the security association of the packet is preserved.
17. The method of
18. The method of
19. The method of
20. The method of
21. The method of
22. The method of
23. The method of
24. A computer program for performing network routing in accordance with a private network security technique, the computer program being embodied on a computer readable medium, the computer program comprising:
a first code segment, the first code segment authenticating received packets sent from a source agent to a tunnel endpoint to determine whether a security association of a received packet corresponds to the source agent that sent the packet, the tunnel being configured by said source in accordance with a network protocol;
a second code segment, the second code segment making a routing decision for an authenticated packet at least in part without regard to contents of a payload of the packet, the routing decision being constrained based on the security association of the authenticated; and
a third code segment, the third code segment selecting a routing destination for the authenticated packet based at least partially on the routing decision made by the second code segment.
25. The computer program of
a fourth code segment that is executed before the second code segment, the fourth code segment performing a decryption algorithm that attempts to decrypt the authenticated packet prior to the second code segment making a routing decision, wherein when the decryption algorithm is successful at decrypting the authenticated packet, contents of a payload of the authenticated packet are decrypted and the security association of the decrypted packet is preserved for use by the second code segment in making the routing decision.
26. A method for routing a packet, comprising:
receiving a packet at a tunnel endpoint;
authenticating the packet;
preserving a security association of the packet as an authentication ID;
making a routing determination for routing contents of the packet by looking up the authentication ID in a table to determine a destination IP address to which the packet is to be routed.
27. The method of
28. The method of
29. The method of
30. The method of
The present invention relates to communications and, more particularly, to a method and apparatus for providing flexibility and efficiency in managing network security.
In order to provide connections between networks that are secure, leased lines are often used because they generally are not publicly accessible. However, leased lines tend to be expensive, and so there is an incentive to use public networks, such as the Internet, to create secure tunnels between remote private networks. However, public networks are inherently not secure. Therefore, various techniques and protocols must be used to ensure that communications sent over a public network are secure and that private networks connected to the public networks are secure from attacks.
Security, in this context, consists primarily of the following three concerns: If data is to be securely transported over a public network, such as the Internet, it must be protected against intentional or accidental modification. In addition, if privacy is a concern, the data must be encrypted to prevent eavesdropping by unauthorized eyes. Finally, the establishment of a secure connection must provide for some kind of guarantee regarding the identity of each participant in the exchange of data. These three concerns are referred to herein as �data integrity�, �confidentiality�, and �source authentication� (also referred to herein as simply �authentication�), respectively. Although there are network security considerations that are not discussed herein (e.g., non-repudiation), these three, and authentication in particular, are sufficient for describing the present invention.
A �tunnel� is a term sometimes used to denote a secure channel that is configured between two endpoints to enable information to be securely exchanged between the endpoints. An example of this usage is the tunnel mode of the Internet Security Protocol (IPSec) and the associated IPSec Encapsulating Security Payload (ESP) Protocol, which may be used to create a Virtual Private Network (VPN). Another related, but more general, use of the word �tunnel� is when an �inner� protocol packet is transported as the payload of another �outer� protocol packet. This encapsulation process is typically accomplished by attaching the outer protocol �header� to the inner packet, thus creating a new, larger packet. At the other end of the tunnel, a decapsulation process restores the original, inner payload packet. In principal, there is no limit to the number of times this tunneling process can be nested, since the packets of one tunnel can be encapsulated within another tunnel. As long as each nested tunnel header is decapsulated at its corresponding tunnel endpoint, the original packet can be successfully retrieved.
Each tunnel header provides information that is typically used to identify the type of tunnel with which it is associated, to authenticate the packet, and to perform other services. It should be noted that the network endpoints of the outer tunnel packets are not necessarily the same as the network endpoints of the inner payload packets, because both tunnel packets and payload packets may carry independent network addresses in their respective headers. Therefore, when a payload packet has been decapsulated at a tunnel endpoint, it might afterwards be forwarded to, for example, an ultimate destination by the tunnel endpoint device (e.g., a security gateway, or other tunnel endpoint device.)
The establishment of a tunnel generally involves performing processes that prevent unauthorized access to a network located at an endpoint of the tunnel. A tunnel can be as simple as a channel between two endpoints in which identity authentication is performed by the mutual exchange of shared secrets or passwords between these endpoints. In this simplified case, if the passwords are correct, the participants are assumed to be legitimate and are assumed to have agreed to exchange data.
Tunnel configurations can also be highly complex so that the level of security associated with transmitting information over the channel and gaining access to the networks through their respective endpoints is very good. Currently, various protocols exist that are intended to provide secure communication over public networks, such as, for example, the Internet Protocol Security (IPSec) protocol. IPSec is generally considered to be a standard protocol for communicating securely over the public Internet. IPSec provides layers of security via security policies and cryptographic algorithms.
Tunnel services are often provided by devices that also provide other services. �Routing� is a term usually employed to refer to the process of selecting the route for a network packet to take when traversing between two network endpoints. A router is a piece of equipment that, among other things, is involved in making these routing decisions. A router may also have features for establishing and managing authenticated tunnels, and for determining which routes within the trusted network are accessible to packets entering and leaving each tunnel. Existing VPN equipment was designed with the assumption that authenticated payload data may be trusted to provide its own routing information. This is because secure tunneling has been viewed primarily as an economical method for interconnecting networks that, although remote from each other, are part of the same trust domain.
These various protocols, including the IPSec protocol, typically communicate data in the form of packets that include header information used to identify and authenticate the originator of the packet. These packets also include a �payload�, which is the data to be transported, and which may include various unspecified types and formats of data. If a particular payload packet is an IP packet, it will include IP header information. However, while encapsulated within a tunnel packet, the IP header does not normally participate in network processes, other than in the context of �a passenger�. The additional IP header information is added to the payload packet as a result of IPSec ESP tunnel mode encapsulation and provides tunnel management information. This additional IP header information may be viewed as the �outside� of the tunnel, whereas the payload is considered to be �inside� the tunnel. Once a tunnel has been established and configured, end-to-end transfers of data may take place through the tunnel between the endpoints. Conceptually, a tunnel could be unidirectional, although they typically allow bi-directional transfer of packets.
Encryption and decryption techniques are often employed as part of the processing of data as it enters and exits a tunnel. This provides protection against the risk of eavesdropping by untrusted agents during data transit, which can occur when tunnels are created over public networks if such additional protection steps are not taken. However, if the transport network is private and trusted, or if there is no need to keep the data private, then the primary purpose for using a tunnel may only be authentication. Because the benefits of the present invention are associated primarily with the authentication process, the present invention is applicable to any tunnel method that involves authentication, whether or not encryption/decryption or other processes are also involved, as discussed below in the Detailed Description of the Invention.
When a tunnel is created, an important initial requirement is to create a Security Association (SA) that represents a �contract� between the participants. These SAs are used thereafter during the life of the tunnel to authenticate packets as having come from the original participants. In IPSec, each SA is unidirectional, so two SAs are required (inbound and outbound) to create a bi-directional tunnel. A tunnel endpoint is able to use the information contained in the SA to verify each inbound packet arriving through the established tunnel as having come from the other contracting SA party. An SA may be created with a finite lifetime, and if an SA expires, a new one must be established if communication is to continue through the tunnel.
The process of creating an SA necessarily involves the establishment of a private shared key, known only by the two tunnel endpoints. One example of a known method for establishing a shared key is commonly referred to in the art as the Diffie-Hellman key exchange. Because key exchange processes can be computationally expensive, there is an incentive to use a single SA for the authentication of many individual payload packets. After the secure exchange of a shared key, all payload packets transported through a tunnel can be efficiently authenticated by various methods based on the shared key by, for example, using Message Authentication Codes (MACs).
Throughout the remainder of this document, �authentication�, unless otherwise stated, is intended to denote the process of establishing confidence that a packet came from the same party that established the SA by which (using the shared key, and other information in the SA) the packet is to be cryptographically validated. It should be noted that, if appropriate care is taken to observe adequate security processes, then authentication may be viewed as a method of verifying the party from whom a packet came. The packet may be assumed to have come from a party to the password, private key, or other secret information that was required to create the SA. In this sense, an SA may be viewed as data that identifies the originator of the packet.
After the authentication phase, a tunnel is available for the exchange of data packets between the endpoints. A preparation process (encapsulation) is performed on packets as they enter a tunnel, and a verification process (decapsulation) occurs as the packets exit the tunnel. The preparation process adds authentication information to each payload packet, and the verification process removes the authentication information. The verification process confirms or rejects the authenticity of payload packets. This typically involves mathematical processes (e.g., hashing) designed to provide very high confidence as to the probable origin of the packet. In the best case, such processes are widely believed to provide a virtual guarantee of authenticity. If encryption or scrambling is also used to enhance privacy, an additional goal of decapsulation is to convert the packet back to the original unencrypted or unscrambled format (i.e., the form that it had before entering the tunnel). Once all necessary decapsulation processes have been completed, the authenticated packet is often classified thereafter as �trusted�, and, consequently, is merged in with other trusted network traffic.
The assumption that all incoming tunnel packets are equally trusted creates dependencies that complicate the network administration process. If additional security requirements exist, such as the need to restrict tunnel traffic to a subset of resources in the remote network, these requirements must be enforced by additional methods beyond the tunnel itself. The security of these additional methods rests on the reliability and accuracy of the contents of the payload packets, because this is normally the only information available after decapsulation. Decapsulation removes the information that was added during encapsulation. Using the IPSec ESP tunnel protocol as an example, when a payload packet arrives at a tunnel endpoint, the outer IP header, the ESP header, and the ESP trailer are removed. After successful packet authentication, this encapsulation information is deemed reliable, thereby establishing confidence as to the identity of the sender, as discussed previously. However, after discarding the encapsulation fields, the information in the payload packet itself is all that is available for subsequent security processes, and so the payload data must be verified for accuracy if the security rules (access and routing) of the remote network are to depend on it. This is because, although the tunnel authentication process validates the identity of the sender, it gives no direct assurance as to the reliability or accuracy of the payload data contained in the payload packets.
This means that a potential for �spoofing� (i.e., providing false packet information to subvert restrictions) exists with respect to the information (such as layer 3 addresses, port numbers and protocol numbers) embedded within the tunnel payload. A tunnel may provide authentication and data integrity, but it does not provide protection against false or unreliable information contained within the payload itself. Therefore, unless special processes are put in place to validate the information contained within the payload packets, there is nothing to prevent authenticated tunnel participants from using packet spoofing methods to gain access to resources within the remote network to which they have not been granted valid authorization.
To eliminate potential spoofing problems in this example situation, it would be necessary to analyze packets after they have exited a tunnel, and to determine which resources the author of the packet is allowed to access within the remote network. For example, a user may have permission to connect to a remote network over a VPN tunnel, but may only be allowed to access a limited set of selected services within the remote network. However, the VPN process itself is an �all-or-nothing� process, in the sense that packets are either totally accepted as authentic (and therefore deemed to be trusted), or are rejected in their entirety. Therefore, the additional information required to enforce additional access control restrictions would have to be derived by analyzing the contents of the trusted payload packets themselves.
Some existing VPN devices provide varying degrees of support for post-VPN analysis of packets (for example, in the form of access control lists). These types of post-VPN features provide a limited means for attempting to distinguish between valid and spoofed packets. Packet analysis rules that are sufficiently rigorous may be able to reject illegal or suspicious packets. Under some circumstances it may be possible to securely enforce all required additional access restrictions within the remote network. However, some negative consequences of having to rely on the analysis of payload data are:
The last restriction can be rather severe, because it forces a tradeoff between the costs of maintaining access rules, and the value of the various protocols allowed to pass through the tunnel. This tradeoff applies to any and all security processes that depend on information contained in the payload packets, because any such process requires rules that are based on the organization and interpretation of the data contained in the packets.
Routing or access control rules are typically based on various fields of a layer 3 packet header, and sometimes on payload data itself. One example of a routing rule would be a static routing table entry directing all packets outside a specified destination address range to a specific gateway address. An example of an access control list would be a rule that mandates that all traffic on a particular protocol port be rejected unless addressed to a limited range of web server addresses.
The process of selecting the destination of network frames and/or packets has historically been described using terminology that differs depending on the layer of the Open Systems Interconnect (OSI) model to which the frames and/or packets belong. Layer 2 decisions, although sometimes referred to as �layer 2 routing�, are more commonly referred to as �switching� decisions, whereas the Layer 3 decision process is most commonly referred to as �routing�. Ethernet frames, switch ports, and port-based VLANs all exist at Layer 2 of the OSI model, whereas IP packets correspond to layer 3 of the OSI model. One commonality between switching and routing is that they both correspond to a process of deciding the address of the next hop for a packet or frame, although each restricts itself to using address information at their respective OSI layers.
A limitation of existing network devices and techniques is that, although a tunnel itself may serve as a carrier for layer 3 packets (and may therefore be viewed as existing at layer 2), existing network devices have not made it possible to securely associate tunnel packets with layer 2 destinations, except through the use of a multi-step process that involves using the layer 3 information contained in the payload packet. For example, the process of routing all packets from tunnel A to a VLAN B could be accomplished by restricting the layer 3 addresses of all packets entering and leaving tunnel A, and then associating the same restricted layer 3 addresses to VLAN B (for routing purposes).
If it were possible for a routing decision to be based on the identity of the authenticated originator of the tunnel from which a payload packet emerged, the need to analyze and restrict the information in tunnel packets would be eliminated. an intervening translation mechanism that creates associations (and therefore dependencies) between the two layers. Accordingly, a need exists for a method and apparatus for providing private network security that overcomes the aforementioned problems associated with existing configuration options.
In accordance with the present invention, routing/switching rules are capable of being based on information in one or more layers (e.g., layers 2 and/or 3), without requiring that the frame or packet destination be specified in the same layer. Thus, the present invention provides valuable options not available with the aforementioned existing devices and techniques.
The apparatus of the present invention comprises authentication logic, decision logic and routing logic. The authentication logic is configured to receive packets sent from a source agent to a tunnel endpoint and to determine whether or not a Security Association (SA) of the packet corresponds to the source agent. The decision logic makes a routing decision for each authenticated packet that is constrained based on the SA of the authenticated packet. If authentication is successful, the routing logic selects a routing destination that is based at least partially, if not solely, on the routing decision made by the routing decision logic.
The method for performing network routing in accordance with the present invention first authenticates received packets sent from a source agent to an endpoint of a tunnel by determining whether a security association of a received packet corresponds to the source agent that sent the packet, the tunnel being configured by said source agent in accordance with a network protocol. A routing decision is then made for an authenticated packet, which is constrained based on the security association of the authenticated packet. A routing destination for a packet is then selected based at least partially on the routing decision. The authenticated packet is then routed to the selected routing destination.
These and other features and advantages of the present invention will become apparent from the following description, drawings and claims.
The present invention provides a method and apparatus that preferably are implemented at an endpoint of a tunnel that utilizes the security association (hereinafter referred to as either �security association� or �SA�) of a packet received to determine one or more destinations within a private network to which the other party to the security association contract (hereinafter referred to as the �security association partner� or �SA partner�) will be allowed to route packets. Therefore, in accordance with the present invention, the destinations to which packets are routed once the endpoint authentication process has been performed are independent of the contents of the decrypted packets.
For purposes of clarity in distinguishing between an outer tunnel packet and an inner payload packet while describing the present invention, the following description will proceed as if it were assumed that the payload is always to be encrypted, although this is not a requirement of the invention, but is an option of various tunnel protocols. The phrase �decrypted packet�, as that phrase is used herein, is intended to denote a payload packet that has exited the tunnel and is ready to be treated as a routable network packet in its own right.
It should be noted that the term �routing�, as that term is used herein, is intended to denote both transmission of information within a single layer and between multiple layers, rather than the meaning that the term �routing� normally implies, which is within a single layer. In typical OSI model networks, the selection of a destination queue for a network packet is based on the addressing information at a single layer. For example, a layer 2 device �switches� packets based on layer 2 information (e.g., a NIC address, or a VLAN tag), whereas a layer 3 device �routes� packets based on layer 3 information (e.g., IP addresses). VLANs and NIC addresses are examples of layer 2 addresses. The present invention provides a direct routing technique to either a layer 2 address or a layer 3 device without requiring translation of, or association between, layer addresses.
In accordance with the present invention, tunnel endpoints are legitimate routing destinations, but are not required to be associated with conventional layer 3 addresses, such as IP addresses. Tunnel endpoints may be referenced as either layer 2 concepts of the present invention. In accordance with an example embodiment of the present invention, a tunnel has four virtual layer 2 ports. The inbound SA has a local and a remote port, and the outbound SA also has a local and a remote port. These virtual tunnel ports could participate in remote VLANs by means of VLAN tagging protocols, such as the Institute of Electrical and Electronic Engineers (IEEE) standard 802.1Q protocol, GARP VLAN Registration Protocol (GVRP), and others. One example of a novel benefit provided by this example embodiment is that it provides the ability to directly route all packets at the egress of tunnel A directly to the ingress of tunnel B, thereby connecting two tunnels in one direction. This example embodiment would also allow two tunnels to be connected bi-directionally, thus providing the ability to create a single combined tunnel between the two distant endpoints. Another advantage of the present invention is that it supports the direct unification of two remote VLANs via a VPN tunnel that connects the VLANs without having to coordinate or restrict layer 3 addresses between the untrusted inside of either VLAN and the outside trusted networks that manage the gateways and other sensitive services of the VPN. Another example of a benefit of the present invention is that it provides the ability to specify that all packets from a particular VLAN (e.g., VLAN C) be routed to the ingress of a particular tunnel (e.g., tunnel D).
An example in which the SA would provide only a partial routing constraint would be: specifying that all packets at the egress of tunnel E with source IP addresses within network 10.0.0. X are to be routed to VLAN F, and that all packets with source IP addresses within network 10.0.9. X are specified to be routed to VLAN G. The routing constraint provided by the SA would be partial in this example because an additional constraint is provided by the IP addresses of the routed packets. Together, the SA and the IP addresses would provide a complete routing decision. This example is intended to convey the fact that the present invention is not limited to providing routing decisions based only on tunnel security associations, but that the present invention also supports many other conventional or known routing rules and can be applied in conjunction with them in any combination.
The present invention also allows rules to be written that specify, for example, that all packets from a particular VLAN (e.g., VLAN H) must be routed to the ingress of a particular tunnel (e.g., tunnel J), or that specify the use of other conventional routing constraints based on such things as layer 3 source or destination addresses, protocol port numbers, or based on layer 2 constraints, such as network interface card (NIC) numbers.
The first endpoint 1 is in communication with first, second and third sources 4, 5 and 6, respectively, via a private network, which is represented by connections 7, 8 and 9. The sources 4, 5 and 6 will be assumed to be isolated networks for this example, although they could be, for example, host computers, VLANs, etc. The second endpoint 2 is in communication with fourth, fifth and sixth destinations 11, 12 and 13, respectively, via a private network, which is represented by connections 14, 15 and 16. The destinations 11, 12 and 13 will be assumed to be isolated networks for this example, although they could also be, for example, host computers, VLANs, etc.
For the purposes of describing the present invention, it will be assumed that the IPSec protocol is being utilized to configure and maintain the tunnels 3. Accordingly, each IPSec packet will include a destination IP address, an ESP header, and a payload. The payload includes, among other information, an internal destination address and data, both of which may be encrypted. As stated above, if the payload packet is successfully authenticated at the destination endpoint, the decrypted internal destination address is normally used by the endpoint device to determine the destination to which the decrypted packet is to be routed within the private network.
In order to demonstrate the manner in which the present invention prevents a contract from being violated, the following assumptions will be made. It will be assumed that isolated network 4 is authorized by contract to send packets over their tunnel only to isolated network 11. It will be assumed that isolated network 5 is authorized by contract to send packets over their tunnel only to isolated network 12. It will be assumed that isolated network 6 is authorized by contract to send packets over their tunnel only to isolated network 13. It will also be assumed that isolated network 4 violates the contract by sending payload packets that are addressed to isolated network 13. Therefore, the internal destination address contained in the payloads of the packets being sent by isolated network 4 is different from the addresses legally permitted (by the contract) to be sent by isolated network 4.
Without the present invention, packets received at a tunnel endpoint could be improperly routed based on the contents of the decrypted payload packet (i.e., based on the internal destination address contained in the decrypted payload) or rejected by the use of firewall techniques (e.g., access control lists (ACLs)) and therefore discarded rather than routed. The present invention eliminates the potential that this type of security breach will occur by constraining routing based on the security association. In addition, the present invention enables a routing policy to be implemented that supports layer 3 independence between routing endpoints. For example, the present invention permits all three destination networks 11, 12 and 13 in
As stated above, with existing devices and techniques, the security association associated with a packet is not available after the packet has been authenticated. Therefore, with existing devices and techniques, the only way to ensure that the decrypted payload data may be safely used for enforcing routing policy is to employ some type of second validation process (such as an access control list) that analyzes the contents of the decrypted payload and compares them to an appropriate list of access policies for each respective SA partner (i.e., each tunnel). Furthermore, if the access filtering devices assume a particular protocol (e.g., if the language in which the policy rules are written assumes that payload packets are always IP protocol), then the tunnel may not be used to transport any other protocol. The present invention overcomes these disadvantages, as discussed below in more detail with reference to
The method 40 of the present invention, in accordance with one embodiment, will now be discussed with reference to the flow chart shown in
If the tunnel is configured to use encryption, then an attempt is made to decrypt the packet, as indicated by blocks 47 and 48. If the packet cannot be successfully decrypted, then it is discarded, as indicated by block 49. If the packet is successfully decrypted, or if the tunnel is not configured to use encryption, then the routing decision for routing the contents of the packet is constrained based on the authentication ID, as indicated by block 50. The manner in which this latter step is accomplished will be discussed below with reference to the embodiments of
In general, the present invention provides the ability to constrain routing decisions based on the authentication ID without regard to packet contents. The manner in which routing can be constrained in accordance with the present invention varies and depends on the environment in which the present invention is employed. For example, the constraint could be a partial restraint on a range of allowed routing destinations, or a full constraint on a complete routing decision.
An example of a full constraint on a complete routing decision is illustrated by the flow chart of
A routing constraint based on a table lookup (as described above) could also be applied in reverse to permit packets to exit through the ingress of an outbound tunnel. In this case, they could also optionally be routed without requiring an examination of the contents of the packet, if the constraint in the table were specified to remove the IP header from the (presumably non-EP) packet before routing it through the tunnel. It should be noted that the automatic addition and removal of EP header information would only be required for non-IP packets that must be routed to an IP gateway. There is no need for an added IP header for routing decisions that select layer 2 destinations, because this type of decision is already independent of the layer 3 protocol of the payload.
An example of a partial constraint on a complete routing decision is illustrated by the flow chart of
An example of a routing decision that is partially constrained by the security association of the tunnel is illustrated by the flow chart of
It should be noted that in all of the example embodiments discussed above with reference to
It should also be noted that by constraining routing based on the security association, it can be ensured that packets are routed to the proper device (e.g., a VLAN) regardless of the packet contents. This is advantageous in situations where the endpoint equipment is responsible for routing packets to multiple VLANs that may be managed or owned by different entities. In this situation, the possibility of the endpoint equipment improperly routing a packet to the incorrect VLAN is eliminated and the responsibility of ensuring that packets received by a VLAN are internally routed to the proper destination within the VLAN is a responsibility of the VLAN rather than the tunnel endpoint equipment. The tunnel endpoint equipment is thereby made immune to the choice of protocols and the configuration of equipment within or below the VLANs.
These new features greatly simplify the security management process by providing a direct method for preventing untrusted packets from participating in the security control network. Once configurations have been tested and confirmed to support all required restrictions, the need for some types of intrusion detection is also reduced. An additional advantage is that the security gateway providing the tunnel endpoints gains effective bandwidth by not having to apply access control list rules to each tunnel packet.
It should be noted that although the present invention has been described with reference to particular embodiments, the present invention is not limited to the example embodiment discussed herein. For example, although the method and apparatus of the present invention preferably are implemented in the form of software being executed by a security gateway router or layer 3 switch system at the endpoint, these functions may be performed solely in hardware or in a combination of hardware and/or firmware and/or software. Also, although the present invention has been discussed with reference to layers 2 and 3 of the OSI networking model, the present invention can be advantageously used in other networking environments. Those skilled in the art will understand, in view of the discussion provided herein, the manner in which modifications can be made to the embodiments discussed herein that are also within the scope of the present invention.
Patent Citations
Referenced by
Legal Events
Original Image