text:
Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.
1. A device, comprising:
a classification module in the device that determines security association information associated with each data packet in a plurality of data packets associated with a data flow between a source and destination, wherein the classification module is configured to determine the security association information for the plurality of data packets simultaneously;
a plurality of security processing engines in the device, coupled to the classification module, each of the plurality of security processing engines configured to receive at least a portion of the security association information associated with a data packet in the plurality of data packets along with the corresponding data packet, wherein at least two of the plurality of security processing engines receive security association information for different packets,
wherein the classification module is configured to provide at least a portion of the security association information associated with the data packets to the plurality of security processing engines; and
wherein the plurality of security processing engines are configured to process the plurality of the data packets in the data flow in parallel.
2. The device of
3. The device of
4. The device of
5. The device of
6. The device of
7. The device of
8. The device of
9. The device of
10. The device of
11. The device of
12. The device of
13. The device of
14. The device of
15. The device of
16. The device of
17. The device of
18. The device of
19. A method for classifying data packets during security processing in a device, comprising:
receiving, in the device, at least a portion of a header for each data packet in a plurality of data packets associated with a data flow between a source and destination;
simultaneously determining security association information associated with each data packet in the plurality of data packets in the data flow;
receiving at least a portion of the security association information associated with a data packet in the plurality of data packets along with the corresponding data packet at each security processing engine in a plurality of security processing engines in the device, wherein at least two of the plurality of security processing engines receive security association information for different packets in the data flow; and
processing the plurality of data packets in the data flow in parallel.
20. The method of
accessing a database in the device to determine security association information.
21. The method of
using one or more selectors to identify a security association entry in the database.
22. The method of
23. The method of
24. The method of
25. The method of
if no security association information exists in the database associated with the packet, generating the security association information; and
storing the security association information in an entry in the database.
This application claims priority from U.S. Provisional Application No. 60/142,870, entitled NETWORKING SECURITY CHIP ARCHITECTURE AND IMPLEMENTATIONS FOR CRYPTOGRAPHY ACCELERATION, filed Jul. 8, 1999; and claims priority from U.S. Provisional Application No. 60/159,011; entitled UBIQUITOUS BROADBAND SECURITY CHIP, filed Oct. 12, 1999, the disclosures of which are herein incorporated by reference herein for all purposes.
This application is related to concurrently filed U.S. application Ser. No. 09/610,798 entitled D
The present invention relates generally to the field of cryptography, and more particularly to an architecture and method for cryptography acceleration.
Many methods to perform cryptography are well known in the art and are discussed, for example, in Applied Cryptography, Bruce Schneier, John Wiley & Sons, Inc. (1996, 2nd Edition), herein incorporated by reference. In order to improve the speed of cryptography processing, specialized cryptography accelerator chips have been developed. For example, the Hi/fn™ 7751 and the VLSI™ VMS115 chips provide hardware cryptography acceleration that out-performs similar software implementations. Cryptography accelerator chips may be included in routers or gateways, for example, in order to provide automatic IP packet encryption/decryption. By embedding cryptography functionality in network hardware, both system performance and data security are enhanced.
However, these chips require sizeable external attached memory in order to operate. The VLSI VMS115 chip, in fact, requires attached synchronous SRAM, which is the most expensive type of memory. The substantial additional memory requirements make these solutions unacceptable in terms of cost versus performance for many applications.
Also, the actual sustained performance of these chips is much less than peak throughput that the internal cryptography engines (or "crypto engines") can sustain. One reason for this is that the chips have a long "context" change time. In other words, if the cryptography keys and associated data need to be changed on a packet-by-packet basis, the prior art chips must swap out the current context and load a new context, which reduces the throughput. The new context must generally be externally loaded from software, and for many applications, such as routers and gateways that aggregate bandwidth from multiple connections, changing contexts is a very frequent task.
Moreover, the architecture of prior art chips does not allow for the processing of cryptographic data at rates sustainable by the network infrastructure in connection with which these chips are generally implemented. This can result in noticeable delays when cryptographic functions are invoked, for example, in e-commerce transactions.
Recently, an industry security standard has been proposed that combines both "DES/3DES" encryption with "MD5/SHA1" authentication, and is known as "IPSec." By incorporating both encryption and authentication functionality in a single accelerator chip, over-all system performance can be enhanced. But due to the limitations noted above, the prior art solutions do not provide adequate performance at a reasonable cost.
Thus it would be desirable to have a cryptography accelerator chip architecture that is capable of implementing the IPSec specification (or any other cryptography standard), at much faster rates than are achievable with current chip designs.
In general, the present invention provides an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.
In one aspect, the present invention provides a cryptography acceleration chip having a classification engine configured to receive a complete IP packet and determine what keys are needed to encrypt or decrypt the packet.
In another aspect, the invention provides a method for accelerating cryptography processing of data packets. The method involves receiving a plurality of complete data packets on a cryptography acceleration chip and processing the data packets with a classification engine to determine what keys are needed to encrypt or decrypt the packets.
These and other features and advantages of the present invention will be presented in more detail in the following specification of the invention and the accompanying figures which illustrate by way of example the principles of the invention.
The present invention will be readily understood by the following detailed description in conjunction with the accompanying drawings, wherein like reference numerals designate like structural elements, and in which:
Reference will now be made in detail to some specific embodiments of the invention including the best modes contemplated by the inventors for carrying out the invention. Examples of these specific embodiments are illustrated in the accompanying drawings. While the invention is described in conjunction with these specific embodiments, it will be understood that it is not intended to limit the invention to the described embodiments. On the contrary, it is intended to cover alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. The present invention may be practiced without some or all of these specific details. In other instances, well known process operations have not been described in detail in order not to unnecessarily obscure the present invention.
In general, the present invention provides an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In preferred embodiments, the chip architecture enables "cell-based" processing of random-length IP packets, as described in copending U.S. patent application Ser. No. 09/510,486, entitled S
Moreover, in various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines, for example four, and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.
In this specification and the appended claims, the singular forms "a," "an," and "the" include plural reference unless the context clearly dictates otherwise. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood to one of ordinary skill in the art to which this invention belongs.
The present invention may be implemented in a variety of ways.
As shown in
The cryptography acceleration chip 102 on the card 103 also has associated with it a local processing unit 108 and local memory 110. As will be described in more detail below, the local memory 110 may be RAM or CAM and may be either on or off the chip 102. The system also generally includes a LAN interface (not shown) which attaches the processing system 100 to a local area network and receives packets for processing and writes out processed packets to the network.
According to this configuration, packets are received from the LAN or WAN and go directly through the cryptography acceleration chip and are processed as they are received from or are about to be sent out on the WAN, providing automatic security processing for IP packets.
In some preferred embodiments the chip features a streamlined IP packet-in/packet-out interface that matches line card requirements in ideal fashion. As described further below, chips in accordance with the present invention may provide distributed processing intelligence that scales as more line cards are added, automatically matching up security processing power with overall system bandwidth. In addition, integrating the chip onto line cards preserves precious switching fabric bandwidth by pushing security processing to the edge of the system. In this way, since the chip is highly autonomous, shared system CPU resources are conserved for switching, routing and other core functions.
One beneficial system-level solution for high-end Web switches and routers is to integrate a chip in accordance with the present invention functionality with a gigabit Ethernet MAC and PHY. The next generation of firewalls being designed today require sustained security bandwidths in the gigabit range. Chips in accordance with the present invention can deliver sustained full duplex multi-gigabit IPSec processing performance.
As shown in
The cryptography acceleration chip 152 in the service module 153 also has associated with it a local processing unit 158 and local memory 160. As will be described in more detail below, the local memory 160 may be RAM or CAM and may be either on or off the chip 152. The system also generally includes a LAN interface which attaches the processing system 150 to a local area network and receives packets for processing and writes out processed packets to the network, and a WAN interface that connects the processing system 150 to a WAN, such as the Internet, and manages in-bound and out-bound packets. The LAN and WAN interfaces are generally provided via one or more line cards 168, 170. The number of line cards will vary depending on the size of the system. For very large systems, there may be thirty to forty or more line cards.
According to this configuration, packets received from the LAN or WAN are directed by the high speed switching matrix 154 to memory 166, from which they are sent to the chip 152 on the service module 153 for security processing. The processed packets are then sent back over the matrix 154, through the memory 166, and out to the LAN or WAN, as appropriate.
Basic Features, Architecture and Distributed Processing
Referring to
From the input FIFO 202, packet header information is sent to a packet classifier unit 204 where a classification engine rapidly determines security association information required for processing the packet, such as encryption keys, data, etc. As described in further detail below with reference to
The distributor unit 206 determines if a packet is ready for IPSec processing, and if so, distributes the security association information (SA) received from the packet classifier unit 204 and the packet data among a plurality of cryptography processing engines 124, in this case four, on the chip 200, for security processing. This operation is described in more detail below.
The cryptography engines may include, for example, "3DES-CBC/DES X" encryption/decryption "MD5/SHA1" authentication/digital signature processing and compression/decompression processing. It should be noted, however, that the present architecture is independent of the types of cryptography processing performed, and additional cryptography engines may be incorporated to support other current or future cryptography algorithms. Thus, a further discussion of the cryptography engines is beyond to scope of this disclosure.
Once the distributor unit 206 has determined that a packet is ready for IPSec processing, it will update shared IPSec per-flow data for that packet, then pass the packet along to one of the four cryptography and authentication engines 214. The distributor 206 selects the next free engine in round-robin fashion within a given flow. Engine output is also read in the same round-robin order. Since packets are retired in a round-robin fashion that matches their order of issue packet ordering is always maintained within a flow ("per flow ordering"). For the per-flow ordering case, state is maintained to mark the oldest engine (first one issued) for each flow on the output side, and the newest (most recently issued) engine on the input side; this state is used to select an engine for packet issue and packet retiring. The chip has an engine scheduling module which allows new packets to be issued even as previous packets from the same flow are still being processed by one or more engines. In this scenario, the SA Buffers will indicate a hit (SA auxiliary structure already on-chip), shared state will be updated in the on-chip copy of the SA auxiliary structure, and the next free engine found in round-robin order will start packet processing.
Thus, the distributor 206 performs sequential portions of IPSec processing that rely upon packet-to-packet ordering, and hands off a parallelizable portion of IPSec to the protocol and cryptography processing engines. By providing multiple cryptography engines and processing data packets in parallel chips in accordance with the present invention are able to provide greatly improved security processing performance. The distributor also handles state cleanup functions needed to properly retire a packet (including ensure that packet ordering is maintained) once IPSec processing has completed.
Per-flow ordering offers a good trade-off between maximizing end-to-end system performance (specifically desktop PC TCP/IP stacks), high overall efficiency, and design simplicity. In particular, scenarios that involve a mix of different types of traffic such as voice-over-IP (VoIP), bulk ftp/e-mail, and interactive telnet or web browsing will run close to 100% efficiency. Splitting, if necessary, a single IPSec tunnel into multiple tunnels that carry unrelated data can further enhance processing efficiency.
Per-flow IPSec data includes IPSec sequence numbers, anti-replay detection masks, statistics, as well as key lifetime statistics (time-based and byte-based counters). Note that some of this state cannot be updated until downstream cryptography and authentication engines have processed an entire packet. An example of this is the anti-replay mask, which can only be updated once a packet has been established as a valid, authenticated packet. In one embodiment, the distributor 206 handles these situations by holding up to eight copies of per-flow IPSec information on-chip, one copy per packet that is in process in downstream authentication and crypto engines (each engine holds up to two packets due to internal pipelining). These copies are updated once corresponding packets complete processing.
This scheme will always maintain ordering among IPSec packets that belong to a given flow, and will correctly process packets under all possible completion ordering scenarios.
In addition, in some embodiments, a global flag allows absolute round robin sequencing, which maintains packet ordering even among different flows ("strong ordering"). Strong ordering may be maintained in a number of ways, for example, by assigning a new packet to the next free cryptography processing unit in strict round-robin sequence. Packets are retired in the same sequence as units complete processing, thus ensuring order maintenance. If the next engine in round-robin sequence is busy, the process of issuing new packets to engines is stalled until the engines become free. Similarly, if the next engine on output is not ready, the packet output process stalls. These restrictions ensure that an engine is never "skipped", thus guaranteeing ordering at the expense of some reduced processing efficiency.
Alternatively, strong ordering may be maintained by combining the distributor unit with an order maintenance packet retirement unit. For every new packet, the distributor completes the sequential portions of IPSec processing, and assigns the packet to the next free engine. Once the engine completes processing the packet, the processed packet is placed in a retirement buffer. The retirement unit then extracts processed packets out of the retirement buffer in the same order that the chip originally received the packets, and outputs the processed packets. Note that packets may process through the multiple cryptography engines in out of order fashion; however, packets are always output from the chip in the same order that the chip received them. This is an "out-of-order execution, in-order retirement" scheme. The scheme maintains peak processing efficiency under a wide variety of workloads, including a mix of similar size or vastly different size packets.
Most functions of the distributor are performed via dedicated hardware assist logic as opposed to microcode, since the distributor 206 is directly in the critical path of per-packet processing. The distributor's protocol processor is programmed via on-chip microcode stored in a microcode storage unit 208. The protocol processor is microcode-based with specific instructions to accelerate IPSec header processing.
The chip also includes various buffers 210 for storing packet data, security association information, status information, etc., as described further with reference to
The output cells are then stored in an output FIFO 216, in order to write the packets back out to the system. The processed cells are reassembled into packets and sent off the chip by the output FIFO 216.
The packet distributor unit 306 then distributes the security association information (SA) received from the packet classifier unit 304 and the packet data via the internal bus 305 among a plurality of cryptography processing engines 316, in this case four, on the chip 200, for security processing. For example, the crypto engines may include "3DES-CBC/DES X" encryption/decryption "MD5/SHA1" authentication/digital signature processing and compression/decompression processing. As noted above, the present architecture is independent of the types of cryptography processing performed, and a further discussion of the cryptography engines is beyond to scope of this disclosure.
The packet distributor unit 306 includes a processor which controls the sequencing and processing of the packets according to microcode stored on the chip. The chip also includes various buffers associated with each cryptography engine 316. A packet buffer 312 is used for storing packet data between distribution and crypto processing. Also, in this embodiment, each crypto engine 316 has a pair of security association information (SA) buffers 314 a, 314 b associated with it. Two buffers per crypto engine are used so that one 314 b, may hold the SA for a current packet (packet currently being processed) while the other 314 a is being preloaded with the security association information for the next packet. A status buffer 310 may be used to store processing status information, such as errors, etc.
Processed packet cells are reassembled into packets and sent off the chip by an output FIFO 318. The packet distributor 306 controls the output FIFO 318 to ensure that packet ordering is maintained.
Packet Classifier
The IPSec cryptography protocol specifies two levels of lookup: Policy (Security Policy Database (SPD) lookup) and Security Association (Security Association Database (SAD) lookup). The policy look-up is concerned with determining what needs to be done with various types of traffic, for example, determining what security algorithms need to be applied to a packet, without determining the details, e.g., the keys, etc. The Security Association lookup provides the details, e.g., the keys, etc., needed to process the packet according to the policy identified by the policy lookup. The present invention provides chip architectures and methods capable of accomplishing this IPSec function at sustained multiple full duplex gigabit rates.
As noted above, there are two major options for implementing a packet classification unit in accordance with the present invention: CAM based and RAM (DRAM/SSRAM) based. The classification engine provides support for general IPSec policy rule sets, including wild cards, overlapping rules, conflicting rules and conducts deterministic searches in a fixed number of clock cycles. In preferred embodiments, it may be implemented either as a fast DRAM/SSRAM lookup classification engine, or on-chip CAM memory for common situations, with extensibility via off-chip CAM, DRAM or SSRAM. Engines in accordance with some embodiments of the present invention engine are capable of operating at wirespeed rates under any network load. In one embodiment, the classifier processes packets down to 64 bytes at OC12 full duplex rates (1.2 Gb/s throughput); this works out to a raw throughput of 2.5M packets per second.
The classifier includes four different modes that allow all IPSec selector matching operations to be supported, as well as general purpose packet matching for packet filtering purposes, for fragment re-assembly purposes, and for site blocking purposes. The classifier is not intended to serve as a general-purpose backbone router prefix-matching engine. As noted above, the classifier supports general IPSec policies, including rules with wildcards, ranges, and overlapping selectors. Matching does not require a linear search of overlapping rules, but instead occurs in a deterministic number of clock cycles.
Security and filtering policies are typically specified using flexible rule sets that allow generic matching to be performed on a set of broad packet selector fields. Individual rules support wildcard specification and ranges for matching parameters. In addition, multiple rules are allowed to overlap, and order-based matching is used to select the first applicable rule in situations where multiple rules apply.
Rule overlap and ordered matching add a level of complexity to hardware-based high-speed rule matching implementations. In particular, the requirement to select among multiple rules that match based on the order in which these rules are listed precludes direct implementation via high-speed lookup techniques that immediately find a matching rule independent of other possible matches.
Chips in accordance with the present invention provide a solution to the problem of matching in a multiple overlapping order-sensitive rule set environment involving a combination of rule pre-processing followed by direct high-speed hardware matching, and supports the full generality of security policy specification languages.
A pre-processing de-correlation step handles overlapping and possibly conflicting rule sets. This de-correlation algorithm produces a slightly larger equivalent rule set that involves zero intersection The new rule set is then implemented via high-speed hardware lookups. High performance algorithms that support incremental de-correlation are available in the art. Where CAM is used, a binarization step is used to convert range-based policies into mask-based lookups suitable for CAM arrays.
The function of the packet classifier is to perform IPSec-specified lookup as well as IP packet fragmentation lookup. These lookups are used by the distributor engine, as well as by the packet input engine (FIFO). In one embodiment, classification occurs based on a flexible set of selectors as follows:
The result of packet classification is a classification tag. This structure holds IPSec security association data and per-flow statistics.
As noted above, a classifier in accordance with the present invention can be implemented using several different memory arrays for rule storage; each method involves various cost/performance trade-offs. The main implementations are external CAM-based policy storage; on-chip CAM-based policy storage; and external RAM (DRAM, SGRAM, SSRAM) based storage. Note that RAM-based lookups can only match complete (i.e. exact) sets of selectors, and hence tend to require more memory and run slower than CAM-based approaches. On-chip CAM offers an attractive blend of good capacity, high performance and low cost.
A preferred approach for cost-insensitive versions of a cryptography acceleration chip in accordance with the present invention is to implement an on-chip CAM and to provide a method to add more CAM storage externally. Rule sets tend to be relatively small (dozens of entries for a medium corporate site, a hundred entries for a large site, perhaps a thousand at most for a mega-site) since they need to be managed manually. The de-correlated rule sets will be somewhat larger, however even relatively small CAMs will suffice to hold the entire set.
A preferred method for cost-sensitive versions of a cryptography acceleration chip in accordance with the present invention is to implement DRAM-based classification, with a dedicated narrow DRAM port to hold classification data (i.e. a 32-bit SGRAM device). A higher performance alternative is to use external SSRAM, in which case a shared memory system can readily sustain the required low latency.
Both variants of packet classifier are described herein. The RAM-based variant, illustrated in
An important property of DRAM-based matching is that only exact matches are kept in the DRAM-based tables, i.e., it is not possible to directly match with wildcards and bit masks the way a CAM can. Host CPU assistance is required to dynamically map IPSec policies into exact matches. This process occurs once every time a new connection is created. The first packet from such a connection will require the creation of an exact match based on the applicable IPSec policy entry. The host CPU load created by this process is small, and can be further reduced by providing microcode assistance.
The input match fields are hashed to form a table index, which is then used to look up a Hash Map table. The output of this table contains indexes into a Classification Entry table that holds a copy of match fields plus additional match tag information.
The Hash Map and Classification Entry tables are typically stored in off-chip DRAM. Since every access to these tables involves a time-consuming DRAM fetch, a fetch algorithm which minimizes the number of rehash accesses is desirable. In most typical scenarios, a matching tag is found with just two DRAM accesses with a chip in accordance with the present invention.
To this effect, the hash table returns indexes to three entries that could match in one DRAM access. The first entry is fetched from the Classification Table; if this matches the classification process completes. If not, the second then the third entry are fetched and tested for a match against the original match field. If both fail to match, a rehash distance from the original hash map entry is applied to generate a new hash map entry, and the process repeated a second time. If this fails too, a host CPU interrupt indicating a match failure is generated. When this occurs, the host CPU will determine if there is indeed no match for the packet, or if there is a valid match that has not yet been loaded into the classifier DRAM tables. This occurs the first time a packet from a new connection is encountered by the classification engine.
Because the hash table is split into a two-level structure, it is possible to maintain a sparse table for the top-level Hash Map entries. Doing so greatly reduces the chances of a hash collision, ensuring that in most cases the entire process will complete within two DRAM accesses.
The following code shows the Hash Map table entries as well as the Classification Entries:
In one embodiment of the present invention, a Hash Map structure entry is 128-bits long, and a Classification Entry is 192-bits long. This relatively compact representation enables huge numbers of simultaneous security associations to be supported in high-end systems, despite the fact that DRAM-based matching requires that only exact matches be stored in memory. As an example, the DRAM usage for 256K simultaneous sessions for IPSec quintuple matches is as follows:
Classification Entry memory: 24 Bytes*256K→6.1 Mbytes of DRAM usage Hash Map memory: Sparse (0.5 entries per hash bucket avg), 2*16 Bytes*256K→8M Bytes
Total DRAM usage for 256K simultaneous sessions is under 16 Mbytes; 256K sessions would be sufficient to cover a major high-tech metropolitan area, and is appropriate for super high-end concentrator systems.
Since DRAM-based classification requires one table per type of match, the total memory usage is about double the above number, with a second table holding IPSec triple matches. This brings the total up to 32 Mbytes, still very low considering the high-end target concentrator system cost. A third table is needed for fragmentation lookups, but this table is of minimal size.
Another attractive solution is to use SSRAM to build a shared local memory system. Since SSRAM is well suited to the type of random accesses performed by RAM-based classification, performance remains high even if the same memory bank is used for holding both packet and classification data.
Further performance advances may be achieved using a CAM based classification engine in accordance with the present invention. The CAM based classifier is conceptually much simpler than the DRAM based version. In one embodiment, it is composed of a 104-bit match field that returns a 32-bit match tag, for a total data width of 136-bits. In contrast to DRAM-based classification, a common CAM array can readily be shared among different types of lookups. Thus a single CAM can implement all forms of lookup required by a cryptography acceleration chip in accordance with the present invention, including fragment lookups, IPSec quintuple matches, and IPSec triple matches. This is accomplished by storing along with each entry, the type of match that it corresponds to via match type field.
Because the set of IPSec rules are pre-processed via a de-correlation step and a binarization step prior to mapping to CAM entries, it is not necessary for the CAM to support any form of ordered search. Rather, it is possible to implement a fully parallel search and return any match found.
Referring to
CAM matching is done using a bit mask to reflect binarized range specifiers from the policy rule set. In addition, bit masks are used to choose between IPSec quintuple, triple, fragment or non-IPSec basic matches.
Should on-chip CAM capacity prove to be a limitation, an extension mechanism is provided to access a much larger off-chip CAM that supports bit masks. An example of such a device is Lara Technologies' LTI1710 8Kx136/4Kx272 ternary CAM chip.
Typical security policy rule sets range from a few entries to a hundred entries (medium corporate site) to a maximum of a thousand or so entries (giant corporate site with complex policies). These rule sets are manually managed and configured, which automatically limits their size. The built-in CAM size should be sufficient to cover typical sites with moderately complex rule sets; off-chip CAM can be added to cover mega-sites.
CAM-based classification is extremely fast, and will easily provide the required level of performance. As such, the classifier unit does not need any pipelining, and can handle multiple classification requests sequentially.
The following examples describe and illustrate aspects and features of specific implementations in accordance with the present invention. It should be understood the following is representative only, and that the invention is not limited by the detail set forth in these examples.
The purpose of the SA buffer prefetch unit is to hold up to eight Security Association Auxiliary structures, two per active processing engine. This corresponds to up to two packet processing requests per engine, required to support the double-buffered nature of each engine. The double buffered engine design enables header prefetch, thus hiding DRAM latency from the processing units. The structures are accessed by SA index, as generated by the packet classifier.
Partial contents for the SA Auxiliary structure are as shown in the following C code fragment:
The SA Buffer unit prefetches the security auxiliary entry corresponding to a given SA index. Given an SA index, the SA buffer checks to see if the SA Aux entry is already present; if so, an immediate SA Hit indication is returned to the distributor micro-engine. If not, the entry is pre-fetched, and a hit status is then returned. If all SA entries are dirty (i.e. have been previously written but not yet flushed back to external memory) and none of the entries is marked as retired, the SA Buffer unit stalls. This condition corresponds to all processing engines being busy anyway, such that the distributor is not the bottleneck in this case.
In one implementation of the present invention, the distributor unit has a micro-engine large register file (128 entries by 32-bits), good microcode RAM size (128 entries by 96-bits), and a simple three stage pipeline design that is visible to the instruction set via register read delay slots and conditional branch delay slots. Microcode RAM is downloaded from the system port at power-up time, and is authenticated in order to achieve FIPS140-1 compliance. In order to ensure immediate micro-code response to hardware events, the micro-engine is started by an event-driven mechanism. A hardware prioritization unit automatically vectors the micro-engine to the service routing for the next top-priority outstanding event; packet retiring has priority over issue.
Since the distributor unit is fully pipelined, the key challenge is to ensure that any given stage keeps up with the overall throughput goal of one packet every 50 clock cycles. This challenge is especially important to the micro-engine, and limits the number of micro-instructions that can be expended to process a given packet. The following pseudo-code provides an overview of micro-code functionality both for packet issue and for packet retiring, and estimate the number of clock cycles spent in distributor micro-code.
Since most distributor functions are directly handled via HW assist mechanisms, the distributor microcode is bounded and can complete quickly. It is estimated that packet issue will require about 25 clocks, while packet retiring will require about 15 clocks, which fits within the overall budget of 50 clocks.
In one specific implementation of the present invention, a classification engine (referred to as the Advanced Classification Engine (ACE)) provides an innovative solution to the difficult problem of implementing the entire set of complex IPSec specified Security Association Database and Security Policy Database rules in hardware. The IETF IPSec protocol provides packet classification via wildcard rules, overlapping rules and conflict resolution via total rule ordering. The challenge solved by ACE is to implement this functionality in wirespeed hardware.
The Advanced Classification Engine of a chip in accordance with the present invention handles per-packet lookup based on header contents. This information then determines the type of IPSec processing that will be implemented for each packet. In effect, ACE functions as a complete hardware IPSec Security Association Database lookup engine. ACE supports full IPSec Security Association lookup flexibility, including overlapping rules, wildcards and complete ordering. Simultaneously, ACE provides extremely high hardware throughput. In addition, ACE provides value-added functions in the areas of statistics gathering and maintenance on a flexible per link or per Security Association basis, and SA lifetime monitoring. A separate unit within ACE, the Automatic Header Generator, deals with wirespeed creation of IPSec compliant headers.
ACE derives its extremely high end to end performance (5 Mpkt/s at 125 MHz) from its streamlined, multi-level optimized design. The most performance critical operations are handled via on-chip hardware and embedded SRAM memory. The next level is handled in hardware, but uses off-chip DRAM memory. The slowest, very infrequent frequent level of operations is left to host processor software. Key features of ACE include:
The input to ACE consists of packet classification fields: src/dst address, src/dst ports, and protocol. The output of ACE is an IPSec Security Association matching entry, if one exists, for this classification information within the IPSec Security Association Database. The matching entry then provides statistics data and control information used by automatic IPSec header generation.
A global state flag controls the processing of packets for which no matching entry exists—silent discard, interrupt and queue up packet for software processing, or pass through.
The matching table (SAT, Security Association Table) holds up to 16K entries in DRAM memory. These entries are set up via control software to reflect IPSec Security Association Database (SAdB) and Security Policy Database (SPdB) rules. The wildcard and overlapping but fully ordered entries of the SAdB and SPdB are used by control software to generate one non-overlapping match table entry for every combination that is active. This scheme requires software intervention only once per new match entry.
In addition to the above components, two data structures in DRAM memory are used by ACE for efficient operation. These are:
The following pseudo-code module describes major ACE input processing (received
The following pseudo-code module describes major ACE output processing
ACE implements multiple techniques to accelerate processing. The design is fully pipelined, such that multiple headers are in different stages of ACE processing at any given time. In addition, ACE implements non-blocking out-of-order processing of up to four packets.
Out of order non-blocking header processing offers several efficiency and performance enhancing advantages. Performance-enhancing DRAM access techniques such as read combining and page hit combining are used to full benefit by issuing multiple requests at once to refill SATC-CL and SATC-AUX caches. Furthermore, this scheme avoids a problem similar to Head Of Line Blocking in older routers, and minimizes overall packet latency.
Because of the pipelined design, throughput is gated by the slowest set of stages.
This works out to 19 clocks per datagram total with zero pipelining, within a design goal of 25 clocks per packet (corresponding to a sustained throughput of 5 Mpkt/s at 125 MHz). A simple dual-stage pipeline structure is sufficient, and will provide margin (average throughput of 10 clocks per header). The chip implements this level of pipelining.
ACE die area is estimated as follows based on major components and a rough allocation for control logic and additional data buffering:
The following references, which provide background and contextual information relating to the present invention, are incorporated by reference herein in their entirety and for all purposes:
Although the foregoing invention has been described in some detail for purposes of clarity of understanding, those skilled in the art will appreciate that various adaptations and modifications of the just-described preferred embodiments can be configured without departing from the scope and spirit of the invention. For example, other cryptography engines may be used, different system interface configurations may be used, or modifications may be made to the packet processing procedure. Moreover, the described processing distribution and classification engine features of the present invention may be implemented together or independently. Therefore, the described embodiments should be taken as illustrative and not restrictive, and the invention should not be limited to the details given herein but should be defined by the following claims and their full scope of equivalents.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image


text:
Don is a Hong Kong painting lover who paint seriously in the past 3 years, but do not expect who will appreciate his artwork at the end of the day. Don went through artistic training in a formal institute and joined a few local exhibitions with water-colour and oil painting. He realises that painting journey is tough and sometimes hopeless. At least, he believes it can help to know oneself in depth and bring passion of one's life.
I am very happy to have the opportunity to join this community network of painters / artists. I look forward to learning from all artists over the world, and even keep good contact with some artist friends. Sometimes, I feel that artist is quite lonely, but if we can network more people with same interest, we can live in a more joyful life.
© 2015 F+W All rights reserved.Use of this site signifies your agreement to the Terms and Privacy Policy, updated March 2007

subset: commoncrawl


text:
From the 'Hell of the North' to the fabled cobblestones of France, we have added Tour of Flanders and Paris Roubaix to our 2012 offering of Race Bike Trips. Get up close to the action and watch your favorite strongmen battle it out in these one day classics.
Spring Classic Bike Trips Come to Trek Travel!
Jan / 19 / 2012


text:
Hold down Control (PC) or Command (Mac) key + mouseclick to select more than one option
|Avg. Dinner Entrée
|Greater than $25
|$18.01 - $25
|$12.01 - $18
|$7.01 - $12
|Less than $7
Posted by Ally's Dad on 11/30/2013
Went to Pacificana last night with friends from Boston. Perfection. Presided over by Jimmy Ching and his very well trained staff. Dim Sum - the best in NYC (along w Dim Sum Go Go). Har Gow, Shui Mai, Soup Dumplings to make you cry, ribs. Entrees: Clams in Black Bean Sauce, Lettuce Package of Squab, Beef Chow Fun, Singapore Chow Mai Fun, Fried Rice with Chinese Broccoli, Bacon and Sausage. $45 a head with tip and tax. Can't beat it - and they validate parking! It is really the best food, service and value you can experience. AMITIES Gourmandes, ally's dad
Posted by ally's dad on 12/02/2011
Try to get in your head a huge space that can serve 400 - 500 where people are bussed in on the weekend for dim sum. Now try to understand that despite the size and the crowds - less so during the week - the food is simply the best Chinese food served in NYC. Spare ribs - perfect. Soup dumplings and other dim sum to die for. Squab in lettuce packages; pan fried flounder with scallions and ginger; clams and black bean sauce; chow fun that makes you weep - the list goes on and on. Jimmy Ching and his staff - especially our server Janet understand service that could translate to Per Se. Get in the car, take a subway and make the trek to Sunset park in Brooklyn. You will cheer! Ally's Dad
Posted by annonymous on 04/04/2011
This place is soooo over crowded over the weekend but later in the evening is reasonable (hint). Finding parking during the day was horrible, but not too bad in the evening (hint). The restaurant is clean and have good service and the food is tasty. Unlike other restaurant where the patron have not yet finish eating and the bill is already to be collected. The evening we were there the restaurant waited for us to finished the meal before giving us the bill.
Posted by Dim Sum Guru on 03/07/2010
Pacficana may possibly be the best Dim Sum in New York City. I have been to places all over New York, including Chinatown and Flushing. But, this is hands down the best Dim Sum I have ever had. I have been here several times and I have never been disappointed. I recommend to all!


text:
Click here 2 get a FREE, No Obligation no frills QUOTE :
Thank you for contacting us. We will get back to you as soon as possible! To book an new Appointment with us - 24hrs/day - please go to our new appointment website, with our Premier Appointment Partner: Appointy.com: http://ioannishypn24uk.appointy.com
Oops. An error occurred.
Click here to try again.
Click here to try again.


text:
Application for Graduation
Application for Awarding of Master's Degree, Doctoral Degree, or Graduate Certificate
Graduate Office (GO) Forms
Please submit all forms to the Office of Graduate Studies, Extended Studies Building, 184.
GO-14, Dual Degree Form
GO-15, Validation of Out-of-Date Graduate Credit
GO-16D, Appointment of Doctoral Dissertation Committee (Doctor's Level)
GO-16M, Appointment of Final Oral Examination Committee (Masters Level)
GO-17D, Doctoral Recommendation for the Degree
GO-17M, Masters Recommendation for the Degree
GO-19D, Request for Change of Major (Doctoral Level)
GO-19M, Request for Change of Major (Masters Level)
GO-21D, Proposed Transfer Credit (Doctoral Level)
GO-21M, Proposed Transfer Credit (Masters Level)
The GO-21M is now used only for Transfer credits (credits taken at another college/university).
Requests for Pre-admission credits taken at PSU are now made using the Graduate DARS Exception Request form (online). Information on DARS is available here.
GO-23, Doctoral Request for Advancement to Candidacy
Thesis and Dissertation Forms
The Survey of Earned Doctorates (SED) is online. Please register and complete the SED at: https://sed.norc.org/doctorate. Additional information on the online SED is available here (scroll to bottom of page).
Miscellaneous Forms
Criteria and Guidelines for Assigning an Incomplete Grade ("I")
Admission Information and Applications
Application to a graduate program at PSU is a two-step process. You must submit two separate applications: one to the Office of Admissions, and the other directly to the department. See instructions and a link to the online Office of Admissions application, as well as instructions for departmental applications.
If you are unable to apply online, paper applications are also available:
University Application for Graduate Admission
University Application for International Graduate Admission
These applications (above) are seven page PDF files that have general instructions on the first and second pages, a generic departmental application on the third page (check with the department to which you are applying to see if they require a specific departmental application), and the Office of Admissions graduate admission application on the fifth and sixth pages.
Graduate students, with the support of the department, can defer their term of admission up to four terms for programs that admit once per year (e.g. Fall 2014 to Fall 2015) or up to three terms for programs that admit every term (e.g. Fall 2014 to Summer 2015).


text:
Recruiting new teammates for your direct sales business can be a frustrating yet rewarding part of your business. In order to grow your business to levels with hundreds of representatives, you must be recruiting people all the time. Here is some information on how to recruit new members of your team on WAHM websites.
* Tip * Always check with your company first before doing any type of online advertising as many of the direct sales companies have rules and guidelines regarding advertising online. You do not want to be in violation of their rules.
If you are looking to recruit online, one great way to start is to join a few of the online wahm (work at home mom) networking communities and web sites. You will find hundreds of them online but you really should only join a handful of them so that you keep it manageable.
These types of web sites usually have an online forum board (message board) where you can place business opportunity advertisements in the appropriately marked folders on the forum for free. You will need to register for that site's forum/message board and fill out your profile.
Always introduce yourself to the community members and make yourself a valuable member of the community by participating in their conversations and forum postings. You never want to just join these communities to spam your ads and leave. They will label you as a spammer and never do business with you. You want to be valued member of these communities, so you can post tips and join in on conversations.
The wahm web sites also sell advertising space on their sites in the form of buttons, banners, text link ads, directory listing ads and classified ads. These advertisements can vary greatly in cost so do your homework to find a good site that has great traffic stats before placing an advertisement with them.
When taking out ads on these sites go for a short-term ad and if it doesn't bring you the results that you seek then move on to the next site and place an ad there. If it does bring you great results you can elect to renew your ad.
Many of the larger direct sales forum boards also have huge websites that offer directories for placing your name and contact information for a nominal fee. If you can get an exclusive listing for your company for a good price, that is a great perk.
Recruiting for your direct sales business can take many different avenues online. Be creative, helpful and answer questions for those that are new and you will soon be recognized as a leader and that makes recruiting easier on wahm websites.


text:
Tennis Tipping Managers 2012 - season 2012 is complete - thanks everyone for managing
View Single Post
Registered User
Join Date: Apr 2011
Posts: 3,985
Re: Tennis Tipping Managers 2012 - Need manager for November
Originally Posted by
Hang on, I definately shouldn't be playing Rennes, as I never committed to singles there. I explained above that the doubles commitment was a mistake, as I clicked on the incorrect link. It's actually a mistake by the manager of that thread that he put me in singles, and should never have entered the doubles team either, as my partner didn't confirm on there.
Obviously I accept that I double committed in doubles, and have explained above that it was an honest error. Is this the decision of the board then? Did me and my partner get kicked out of Tashkent?
To commit a doubles team you only need one player to commit.
It is my fault that I included you in the singles draws draw and I agree with that. But in doubles your team was valid entry. Your commitment to any tournament this week was to Rennes first so I agree that should have been where you played.
I do, however fully believe it was an honest mistake. I was very surprised when I didn't get your picks which is why I checked other tournaments as you are a very reliable TT player. This is also why I went to the board to get a ruling on how it should be handled. I know the rules say you are suppose to be awarded zero points for the week if it is noticed after the deadline. My concern is that your partner gets penalized for your mistake when he was not involved.
View Public Profile
Find More Posts by ESimp
View Blog


text:
The Community News • P.O. Box 1031 • 203 Pecan Dr. • Aledo, TX 76008 • 817-441-7661 • FAX: 817-441-5419
- News About...
- Schools and Sports
- Lifestyle
- Commentary
- How to
- Read Online
- Sports
- Blogs
Opal was born in Terrell, Texas on January 15, 1918 to Charles and Ruby May Smith. She received a degree from the Southwest Adventist College in Keene. In 1940 she was married to Ernie Hagood and moved to Los Angeles, California to be near her husband while he was in the United States Navy. On October 19,1942, she had her only daughter, Barbara June, who was the love of her life. The family moved back to Terrell and lived there until they moved to Dallas where she lived until 2009 when she moved to Azle. While in Dallas, she worked for the U.S.O. for many years and the Republic National Bank until her retirement. However, she did not retire; she began raising Shetland Sheep Dogs "Shelties" which she loved. She had 44 at one time and took care of them all by herself. The Shelties were her family after Barbara moved out and she treated them like her children. They all had names and she knew all of them.
Opal always had a smile on her face, was always cheerful and had something funny to say. She never met a stranger and always had good things to say about people. She was a ray of sunlight to everyone. Opal was a longtime member of the Dallas Seventh Day Adventist Church. She will be missed by all that knew her. Opal was preceded in death by her parents; sisters, Vada Kenneth, Ruth Foster; and her daughter, Barbara June Allred.
Survivors: Son-in-law, Scott Allred and wife, Billie Jo; cousins, Ann Evans and husband, Tommy, Janie Taylor; brother-in-law, Ray Kenneth; and many many friends.


text:
March 14, 2012
New York State Department of Environmental Conservation Forest Ranger John Streiff briefs media members at the Piercefield Highway Department on the third day of the search for 18-year old Collin Gillis.
Stories this photo appears in:
Search for Colin Gillis offers few new leads
'We really do not have anything new'
Officials from the New York State Police and Department of Environmental Conservation did not have a lot of new information three days into the search for a missing Tupper Lake teen.
Use the comment form below to begin a discussion about this content.


text:
110 W. New York Ave.
DeLand, FL 32720
National Weather Service issues tornado watch
By Pat Andrews
posted Mar 17, 2014 - 1:25:09pm
At 12:45 p.m. today, Monday, March 17, the National Weather Service issued a tornado watch for all of Central Florida, including Volusia County, and most of the Florida Peninsula, until 11 p.m.
A tornado watch means unsettled weather conditions make the formation of tornadoes very possible.
While bad weather is already moving into the area, severe storms are likely tonight, as low-pressure air moving across Florida from the Gulf pushes a cold front through.
A band of storms moving south and east into East Central Florida this afternoon is causing the current rain and thunder. Strong wind in the low and mid levels of the atmosphere will mix with warmer air ahead of it to produce the threat of strong-to-severe storms, including damaging winds and the possibility of small hail and frequent cloud-to-ground lightning, along with the threat of isolated tornadoes.
More storms are likely tonight.
Here are all the counties included in the tornado watch:
Brevard, Charlotte, DeSoto, Hardee, Hernando, Highlands, Hillsborough, Indian River, Lake, Lee, Manatee, Martin, Okeechobee, Orange, Osceola, Pasco, Pinellas, Polk, Sarasota, Seminole, St. Lucie, Sumter and Volusia.
Reader Comments
The comments posted below are posted by readers, not by The Beacon staff. These comments express the views and opinions of the authors, and not the administrators, moderators or webmaster. The comments forum is governed by these rules. Please use the report abuse link if you find offensive comments.
Did you find this story interesting or informative? Subscribe to The West Volusia Beacon to read more stories by Pat Andrews, along with others from our award-winning writers. Subscribe now!
Photos - Real Estate - Newcomer's Guide - Beacon Magazines - Advertise - Local Web Sites - About Us - Beacon Archives


text:
Em finds herself alone in the house and is thrilled that she can masturbate now. She pulls her boobs out of her dress for a rub, then takes the whole dress off. Now with easy access, Em is able to lie on her belly and rub her wet pussy until with a flushed red face she comes to her climax.
Real people. HQ Leidsestraat 32D, 1017PB Amsterdam. +31 (0)20 622 7418.
♥ General enquiries: email@example.com;
♥ Owner: email@example.com.


text:
Introduces the Kindle Store and explains how to take your existing applications and tailor them to the Kindle environment.
A project-style course that teaches how to build a Flash-based game with Flash Builder 4.6, Flash Player 11, and the Starling framework.
"I've been a programmer for over 30 years. Wish I would have had lynda.com way back when—but that's alright, I found you now!" —Gary R.
more from our members »


text:
I've written many times about how individual recipes can't be copyrighted here in the US. But did you realize that you can defend a copyright if parts of your recipe contain "substantial literary expression?"
What exactly is that, and why should you bother?
"Substantial literary expression" establishes the information in a recipe as yours. That could be just as important as copyright, when it comes to theft.
Let me explain. US copyright law defines substantial literary expression as:
"a description, explanation, or illustration, for example—that accompanies a recipe or formula or to a combination of recipes, as in a cookbook."
The point is to write information easily identified as belonging to you, based on what you say in the headnote (introduction) or method (instructions). Here's another definition from the findings of a recipe-based lawsuit between Meredith Corp. and Publications International, Ltd.:
"There are cookbooks in which the authors lace their directions for producing dishes with musings about the spiritual nature of cooking or reminiscences they associate with the wafting odors of certain dishes in various stages of preparation. Cooking experts may include in a recipe suggestions for presentation, advice on wines to go with the meal, or hints on place settings and appropriate music. In other cases, recipes may be accompanied by tales of their historical or ethnic origin."
This is not a complete list of what constitutes "substantial literary expression." The point is to make the recipe your own. You could also include stories about your family and friends, specific serving suggestions, an explanation of a technique, or a million other things that customize a recipe as yours.So even if the thief stripped out your headnote, if you added "substantial literary expression" to the method, your recipe could be copyrightable.
As to the question of whether you should bother adding these layers, the answer is yes. Not only does adding this kind of information make the recipe identifiable, it adds reader interest.
If you're a blogger, though, do you think people will still steal your recipes if you add these details? Elise Bauer experienced just this situation when someone scraped her content into an e-book. Does the idea that your recipes might be copyrightable give you hope that people will stop taking them?
(Photo courtesy of FreeDigitalPhotos.net)
You might also like:
52 Responses to "How to Write Recipes That Are Harder to Steal"
I believe the copyright laws here in Australia have similar sentiments, Dianne. Recipes written in a more personal way may take a little more time, but are much more engaging, making it more likely that your reader will want to look at more of your work.
I first started writing my recipes in a purposefully distinctive fashion (with little jokes and what nots thrown in), just to see if anyone was actually paying attention and reading the recipe. Later, when I discovered it was a good way to prevent recipe theft, I amped it up and the recipe became an extension of the story, more or less inseparable from the rest of the post.
And no one has ever (to my knowledge) stolen a recipe from me. Not, of course, that they'd want to. I am no Elise Bauer.
Sadly I think people will always steal blog content.. But some of the personalised content you are talking about makes it easier to track this stolen content too… A google search on text from your recipe should bring up your original work AND any closely matching stolen content!
Hmm… interesting to think about! For some reason I was always under the impression that recipes had to be as succinct as possible while still maintaining clarity, and that any language not deemed essential to successfully executing the recipe should be cut. Maybe that isn't so?
I have added flourishes at time, and phrases I know I use. I think I have old people stir clock wise, and given a reason for it. I am unaware it makes a difference. It definitely makes your recipes harder to steal.
Agreed with Amanda, above, that the laws are similar here in Australia.
I am struggling with this at the moment as I have been notified of significant plagiarism of some of my recipes. My posts are generally structured as follows: title, an anecdote about the dish, some preparation notes and musings on eating, followed by the recipe.
I use a plugin that allows readers to easily print and file my recipes. To keep things simple for them, I use straightforward directions and leave the storytelling for the post above. I feel that if I were to embellish the actual recipe (in the plugin), the directions would get lost and people would have to sift through conversation to extract what they should be doing on the stove.
So, if the storytelling element were plagiarized, it would be easier to pursue based on the "substantial literary expression" argument. But since the recipes are pretty straightforward, as a courtesy to anyone who wants to try them, I don't feel protected at all.
Even if I did embellish the recipe directions, I don't think it would stop anyone from changing "mix the ingredients…" to "whir the ingredients…" and calling it their own, with little way to pursue them even if they are obviously copying.
Hi Dianne,
Lovely to see you in Chicago. This post brings to mind a question. A blogger once posted a crostata recipe from one of my books (with permission and credit). Some months later, the same blogger posted a different crostata recipe, but used exactly the same language in the instructions for making and rolling out the dough for the crust, this time without credit. How would you recommend handling this type of situation?
Dianne, thanks for an excellent explanation. I've never been a fan of blogs that just slap recipes on their sites, especially when it's so obviously someone else's. Now that I'm a blogger myself, I'm more aware of this. Since I usually cook out of my fridge and pantry, explaining the inspiration (we're hungry) or thought (the kale at the store was beautiful) behind the recipe becomes part of the recipe's story. Recipes with interesting, personal head notes are so much more appealing than just a list of one recipe after another. Protection is a by-product.
This is very good to know. Many of my recipes are from my past and are associated with specific memories. Including that in the body of the recipe would be a great idea.
I love this post because I always enjoy when the text of a recipe conveys the author's individual personality. (Nigella Lawson and Jamie Oliver come to mind.) I try to follow suit, but have sometimes worried that I should make my instructions more generic. So it's nice to have permission to make them a bit more personal. Thanks, Dianne!
This is a great way to include one's personality in the recipe. It's like adding the spice and rhythm. Thanks, Dianne.
It is sad that we even have to have this conversation. Why do people have such a hard time giving credit where credit is due? After all, in the world of food and cooking we have all had teachers and inspiration. And that so many people today feel that it is fine to steal someone else's work just makes me shake my head. Really? Can't you just come up with your own recipe? And if not, provide credit as to who inspired you. It shows strength, not weakness.
Sally, you are so right. Sigh. To me, giving credit gives credibility to that "stolen" recipe and the person who snitched it. I wish people understood that simple truth. With so much going on with the internet+ these days, perhaps it's time to start "calling out" folks who post recipes that are not theirs. Though a negative thing to do, it might wake up some of them.
the only time I consider a recipe stolen is before publication, say during testing. yes, I have had testers steal recipes and use them for baking contests and in books without telling me (I had one tester tell me the recipe wasnt worth making and it showed up in her next book!)…and not even sending me a few bucks of the prize money! once a recipe is published, it is fair game. there is no way to control its life. it is meant to inspire and nourish and be changed with respect to time, place and person. after all, this is food. it is meant to be created and consumed, disappear and made again with a great generous spirit. the greatest recipes will always be stolen. Thank goodness julia and marcella and pierre franey and jacques pepin and bert greene and diana kennedy and barbara kafta and joyce goldstein and jeremiah tower and maida heatter were/are generous with their recipes!
I take it a complement that a recipe I have created appeals to other cooks. it keeps it alive. recipes are meant to be shared and evolve. in teh bigger picture, it is part of passing along culture. now it is called stealing. sort of dulls the fun of collecting recipes and experimenting with them. within the professional food community, everyone knows the diplomatic rules to credit a recipe. the bloggers are not professional cookbook authors so they do not know. as it is going, every recipe will eventually be copyrighted and no one will be able to write a recipe again…the internet giveth and the internet taketh away…
I must agree with Ebeth. Everywhere you go these days there is a "Share" button. In 2014 we have a culture of sharing and that's what the audience expects. Further it is my experience that the people that are successful these days are "generous" as Ebeth puts it with their knowledge and give it readily, openly and usually for free.
Dianne you ask the question is it worth it to write recipes in such as way as they "might" be protect-able. To protect intellectual property you must be prepared to defend it. As someone that has a patent that is being infringed upon by at least one company I learned painfully well that it is no deterrent unless I'm prepared to spend hundreds of thousands, possibly millions in legal fees to defend the patent. And that is for something that makes millions in revenue. In the case of a recipe the legal fees to defend a recipe that MIGHT be copyrightable would amount to far more than the recipe(s) or even a whole book is worth. Realistically who has the money to do that. So I would submit it is no deterrent.
Of course there is a simpler approach by submitting a DMCA take down if the content is on the net somewhere. But that has issues especially when it comes to such a gray area as recipes. When you submit a DMCA take down the content has to be copyrightable and that would only include a photo and a headnote. To your point Dianne you are suggesting that maybe you could make the instructions substantial literary content. If the party that had content taken off fought back and it was ruled that it wasn't copyrightable, then they would have a case for damages against the party initiating the take down. So this could backfire on the person doing the takedown. This is prevent harassing take downs that have no merit. Considering all this, is it really worth it?
In my view with every recipe known to man on net somewhere and most of the good ones including those from the big cookbooks on All Recipes, it is not worth the time. I'd submit that the time be better spent on photography, video, interacting directly in a generous way with your audience etc. That is what will differentiate you from the zillions of websites and recipe databases out there, not worrying about fighting a losing battle of trying to protect recipes. Because that can backfire on you too if your audience gets wind of the fact you don't like to share!
Brilliant response – your last paragraph resonated with me in particular. You are absolutely right that one must differentiate themselves by connecting, building community, and being oneself, instead of fretting over who "stole" a recipe that is probably already out there.
How does someone like Ree Drummond aka The Pioneer Woman build an empire on lifted church cookbook recipes that, for the most part, she's failed to attribute? More importantly, why does the food blogging community countenance this, frequently turning a blind eye and oftentimes defending her? Her fans tweet non-stop about her lasagna, her chicken spaghetti or some other 1960 retro recipe that originally appeared in Bartlesville, OK cookbooks. One website, The Marlboro Woman, routinely publishes photos of the original recipes from the actual church cookbook for comparison purposes. Seems this is nothing short of plagiarism.
Good point Dianne. Another point is that Ree's success is about far more than her recipes. The fact that she does video, social media, guest appearances etc. are the primary reasons for her success. It's because of this that she sold more cookbooks last year than anyone, not just because of her recipes. There seems to be this thinking out there that if we can just stop copying of recipes than we can go back to 1988 when it could be just about the recipe. The reality is that in 2014 to be successful you have to do much more than publishing good recipes. It makes me wonder if this whole recipe copying thing is simply sour grapes because some individuals have figured out how to be successful in today's environment. Because if it was simply about the copying of recipes I would be hearing people bad mouthing the major companies that have huge databases of recipes, not just individuals. When I hear that I will know that's what it is really about.
Does this actually make recipes harder to steal, or just easier to claim as copyright infringement after the fact? Many infringers have no issue taking photos (where much clearer law exists), so I'm still trying to understand why a more verbose recipe format would give an infringer pause. Would writing recipes in this way aid in DMCA takedown compliance, or would the issue of substantial literary expression only become relevant at the point of a suit?
And since the law as you have quoted above defines literary expression as that "that accompanies a recipe or formula"… can such expression be placed before a recipe (as in a head note or a blog post), or does it have to be contained within the method section itself in order for the recipe text to count as copyrightable? What happens if one writes quite a lengthy head note in front of a recipe, and an infringer then only snagged the ingredients/method section, leaving the rest alone? Would that sort of copying then be considered merely an "excerpt" and thus fall under fair use instead? Just trying to wrap my head around how this all works.
I generally add some comments and asides to my recipes, usually in the headnote and method and sometimes even in the list of ingredients. I don't know if this has protected me from theft; if not, the perpetrator has been stealthy and so far gone undetected by me.
Thanks for the information….makes me rethink how I write and any recipes I post on the blog! A million thanks!
[…] oddly right! This week I was given a little advice from a fellow Canberra blogger who shared an article about copyright and recipes. Basically, if you want to demonstrate the work is yours make the recipe your own with your own […]
if u are that paranoid about ur recipes only publish in ur cookbook so they must buy it????
I've had several recipes slightly re-worded, with an ingredient added and seen them published in a major food magazine with ZERO credit. They used the same cooking appliance (pressure cooker), ingredients (white beans with herbs), special method to quickly re-hydrate beans (quick-soak method), and serving suggestion (warm bean salad). It was so obvious that one of my readers let me know about it. Sneaky thieves, and professional writers on a deadline with no shame, are everywhere.
HOWEVER, it is pretty easy to get stuff taken down from the web and if a nice e-mail to the person won't work you can contact their ISP and have them deal with their client to take down the page. Here's how:
You can file a DMCA request which is sent to the website's ISP not the huffy blogger (but it's nice if you cc' them on the email so they can wisen up that you're taking action):
Another way to do this is to ask Google to stop showing the infringing content in their search results, too:
I find a personal e-mail usually works. But in the case of Facebook or Yahoo groups who purposely copy a whole recipe and remove any trace of the source to put in their archives… a DMCA request can do wonders.
I wish I had Rick's zen-like mindset but since my presence is primarily online (coming on paper in September) having someone's copy of my recipes trump my originals in search results can cost me in visitors AND ad revenue!
This is really interesting. I've seen many recipes that Elise posts AFTER I've seen them in someone else's cookbook (which is the reason why I stopped reading her blog years ago). The last time this happened I commented on her blog that the recipe, which was a chicken salad with roasted red peppers, red onions, sliced almonds… had already been published in a Giada cookbook. My comment was deleted. I just went to her website and she is still presenting all of the recipes as her own, even though many have already been published elsewhere. Just because the order of the ingredients is changed or there is an addition or subtraction of an item does not make it an original recipe. She should also give credit where credit is due by including "Adapted from…".
There is a "blog" that has been stealing my entire blog posts, moments after I post them. And how do I know? Because, after republishing the entire post, word for word, with all the photos, text and recipe, they link back to me—and I get a "linkback" notification!
I have tried contacting this person (who seems more like a robot) on Twitter and on his/her blog contact form, without response. But google sees it as duplicate content, and can punish my site accordingly. Still, even with the law on my side, there's essentially nothing I can do that I'm willing to take the time and effort to do. So I tell myself what I used to tell clients when I practiced law: there's a world of difference between the legal rights you have and the ones you're willing to pay to protect.
There is an argument to be made that no one comes up with truly original recipes any more (although with gluten free recipe development, there really is something novel about it, as it's mostly virgin territory). But it's truly shameful to simply lift entire blog posts.
We need a sheriff in town!
Hi Dianne… I've just hunted down this post of yours again this morning after having seen a couple of my recipes that have been re-blogged by a younger blogger. In her words she says 'I stole this recipe from Liz' and then posted a barely visible hyperlink to my name (Liz). There was no mention of the name of my web site and I felt that she really ought to give me more credit.
I find your article here most helpful… and also thought I'd share the link to a page on the Australian Copyright Council website:
'Key points
• The written form of a recipe is likely to be protected by copyright once it is recorded in some way, for example, written down or recorded onto a tape.
• Copyright does not protect information about the ingredients or methods of making a type of food or drink. You will not need permission to follow a recipe.
• You will not infringe copyright if you watch someone prepare a dish and then you write down the ingredients and method in your own words.
Copyright protection
How does copyright affect recipes?
Copyright protects a range of materials, including works comprising words—such as written recipes, setting out a description of the type and amount of ingredients and the method for making the type of food. Other things protected by copyright include "artistic works" (such as drawings and photographs), music and films.'
And 'For work to be protected by copyright, it must be "original". In this context, an "original" work need not be novel or unique, it simply must result from the exercise of skill or labour on the part of its author. A work that is merely copied from an earlier work is not protected. Copyright works are only protected by copyright once they are put into material form (for example, by being written down, saved as a digital file, or recorded in audio or audiovisual form).
Therefore, if you write your own description of how to make a soufflé, this "literary work" is protected by copyright, even though you did not invent the combination and proportion of ingredients and the method is not new'.
I hope this is useful to your readers.
I have asked the blogger to respect my literary work and provide a reasonable acknowledgement of my original literary work. I am crossing my fingers that my polite email will work.
Thanks again!
Wow! Great article, I am literally in the middle of one of my very own top-secret Cupcake recipes and was very curious about this. I am going to try make sure it belongs to me, like you mentioned, so that there is no mistake about who wrote it.


text:
Softball infielder Lauren Chamberlain (Oklahoma) and football wider receiver/kick returner Tyler Lockett (Kansas State) have been named the 2014-15 Big 12 Conference Athletes of the Year, the league office announced.
Big 12 Athlete of the Year candidates will be highlighted each day through July 17. Fans will then be able to vote for their male and female choices from July 17-22. Fan voting will be considered in the final tally for selecting this prestigious award.
The Big 12 Conference has announced its Scholar-Athlete of the Year recipients for the 2015 spring sport season. The following student-athletes have been selected as the award-winners for their respective sports based on a vote of each sport's head coaching group.
Oklahoma senior Jessica Vest was named to the 2015 Capital One Academic All-America Second Team Wednesday after posting a 3.91 GPA majoring in Multidisciplinary studies.
When Texas softball's Randel Leahy stepped foot on campus in the fall of 2014, she arrived as a heralded catching/outfield prospect with numerous awards in tow from a standout high school career.
Baylor's Kaitlyn Thurman and Oklahoma's Shelby Pendley have been named Senior CLASS Award First-Team All-Americans for the 2015 season.
The Oklahoma softball team's season came to an end Saturday night as the 11th-ranked Sooners (49-9) dropped a 5-3 decision at No. 6 Alabama (47-13) in the third and final game of the Alabama Super Regional.
A five-run sixth inning, highlighted by a pair of two-run homers, lifted No. 11 Oklahoma (49-7) to a 5-2, comeback win at No. 6 Alabama (45-13) Friday night in game one of the Tuscaloosa Super Regional.
After helping pitch No. 11 seed Oklahoma to the Super Regionals, Sooners pitcher Paige Parker has been named a top three finalist for the NFCA Division I National Freshman of the Year award.
The University of Oklahoma softball team, seeded 11th, will open play in the Super Regional round of the 2015 NCAA Division I Softball Championship Friday night.
As the 2015 Big 12 softball regular season comes to a close, the league office has announced the winners of this year's postseason honors.
Four Big 12 Conference Softball Teams will compete in NCAA Regional play next weekend in the first of two rounds leading up to the 2015 NCAA Women's College World Series.


text:
Belton, TX – Former University of Mary Hardin-Baylor men's basketball player Marlon Miller will have a chance to continue his career after signing a contract with a professional basketball team in Germany on Monday. Miller, a guard for the UMHB men from 2010-2012, signed a one-year contract with the Crailsheim Merlins of Regionalliga Südwest. Miller will depart for Germany within the next week. The Merlins season will start in October and run through April.
"This is a step that I want to take and I've always wanted to play professionally, so I am excited about the opportunity," Miller said. "I want to make a career for myself on and off the court and be financially stable. This is a way for me to use the gifts that God has given me to do that."
Miller was a two-year letterman for the Cru from Belton High School. He was a two-time ASC All-West Division selection and earned All-Conference honors after leading the UMHB men in scoring as a senior. Miller averaged 18.0 points and 3.3 rebounds per game as a senior and added 56 assists and 38 steals. The Cru went 48-11 during his two seasons on campus and advanced to the NCAA Division III National Championships both years.
Miller is expected to play point guard for the Merlins. He drew the club's attention while participating with almost 200 players at the Instant Exposure Camp in Las Vegas this spring. Miller joins Kevin Guyden, Brandon Gatlin and Patrick Oliver as former UMHB players to sign professional contracts in the past five years. Guyden and Gatlin both played professionally in Kosovo while Oliver played in Iceland.


text:
Plan Your Visit
We look forward to your visit to Texas A&M University. In order to get the most out of your trip there are several things you should look at before making the trip. If you are planning an official campus visit through the Visitor Center, please see this additional list of scheduling tips.
Arriving in AggielandGPS Navigation: 30° 36' 47.45" N, 96° 20' 23.56" W (30.613181, -96.339878)
- Driving Directions/Maps
- Easterwood Airport
- Renting a Car
- Parking on Campus
- Construction Underway
- Local Weather


text:
Parents it is very important that you have a continuous relationship with their child as they are growing up so that when your child becomes a teenager, you will know them well enough to determine when they aren't telling you the truth. Kids will tell you a story if they think that they can get away with it. I have always told my kids that I will always find out when they aren't being truthful…
© 2015 Created by Mom Bloggers Club.
Badges |
Report an Issue |
Terms of Service
Please check your browser settings or contact your system administrator.


text:
Enjoyment on Reading
By Alma Garcia
To some, reading may be just and assignment, but to me it is a time of learning. I enjoy reading any kind of book, but as everybody does I do have my favorite kind of book. I like books about auto-help. Reading books is and enjoyment to me, but it is also a time to gain sense of control, to relax and to become sophisticated.
I enjoy reading because it helps me to have a sense of self-control. One day, I was talking with a girl about how important education is Janet, the girl I was talking to, was saying that education was not that important because once she gets married, both she and her husband would work and that would be it. I told her, "We really have different pint of view." Then I remembered I had just read something related to what we were talking about in a book called, Do Not Drown in a Glass of Water. It said, "Whenever you have a different point of view from someone else, just hear them out and analyze it. They probably think that way because of what they have live." That is what I did, and I controlled myself from being aggressive or pay any mind to her.
Reading a book helps me to relax. I can read just about anywhere. My favorite time to read is around four or five in the afternoon. When I read, I let my mind fly; therefore, reading in a noisy place does not bother me. I concentrate so much in reading that all my problems or worries go away. When I was so worried and nervous because I didn't know if I was going to get my scholarship back for this semester, I read a passage from the Bible, and after reading it, my nerves went away. After reading, I always think positive. This is why I feel so relaxed
Finally, reading books makes me to be sophisticated. Learning new words and their meanings makes my vocabulary to be more extensive. Reading is gaining knowledge on a lot of things such as culture, history, and many other things. For example, China's culture, back to the 1900s foot binding was considered a form of beauty for women. The woman's tiny feet, which made it difficult for her to walk, were a status symbol indicating her beauty. In addition, reading news is another way for me to become sophisticated because I know what is going on in the world.
Reading is an activity that I really enjoy. Reading helps me to have a sense of self-control, it helps me to relax and it makes me sophisticated. Because reading is an enjoyment for me, I will keep reading forever. Reading is an activity that everybody should practice.
|Back to essays


text:
Steve McClaren set to sign new deal and extend Derby County stay
Posted: June 17, 2014|
STEVE McClaren is expected to pledge his future to Derby County by signing a new contract.
It is understood that the Rams head coach has been offered a new deal after leading the club to the Championship play-off final last month.
McClaren, who has two years left to run on his current contract, is set to agree an extended three-year deal ahead of the 2014-15 campaign.
The former England manager replaced Nigel Clough at the helm at the end of September, with the team 14th in the table after nine games.
He had an immediate impact and the Rams went on to finish third with a club record 85 points.
They were ultimately pipped to a place in the Premier League by Queens Park Rangers at Wembley last month.
But Derby chiefs have now moved to back McClaren as he prepares for another promotion push – as well as covering themselves should another club come knocking for the 53-year-old's services.
The Rams are making no comment on the matter at this stage.
However, after McClaren was recently linked with the Southampton job, Derby chief executive Sam Rush moved to ward off any potential suitors.
"Steve has gone on record as saying he is at the start of his project here and I am sure he is looking forward to cracking on with that," said Rush.
"I think he is very happy at Derby County and we would be very resistant to clubs coming knocking for him. I wouldn't advise them to.
"I am delighted with what Steve has done.
"I was sure he would be successful with us and I am looking forward to working with him for a long time in the future."
Southampton yesterday confirmed former Dutch international Ronald Koeman as their new manager.
The latest player to be linked with a move to Derby is Costa Rica international midfielder Yeltsin Tejeda.
The 22-year-old, who plays for Saprissa in his homeland, is currently in action at the World Cup in Brazil and helped his country to a surprise 3-1 win over Uruguay in their opening group game.
Tejeda is also reported to be attracting interest from Everton, Sunderland, Fulham and Brighton.


text:
WarwickSU.com uses cookies to help us give you the best experience on our site. If you continue to use our site, we'll assume you are happy to recieve our cookies.
Thanks for logging in to WarwickSU.com. Please take a few moments to complete your profile.
Friday 01 March 2013
midnight - midnight
Sports Matches on Campus, Social at Saints
Filter Events: All | Clubnights | Gig | Ball | Socs | Sport
Powered by MSL
If you are a current student at the University of Warwick, click the link below to log in using your IT Services username and password.
If you're a guest, graduate, student at another university or staff member, create an account and then log in below.