text:
This present invention provides users with secure transparent electronic communication, allowing them to send and receive encrypted and/or signed messages with little or no user involvement. In various embodiments, the present invention provides a user with e-mail security via automated hierarchical techniques for transparently sending and receiving secure messages, and lowers the burden on administrators. Such a system can also manage cryptographic keys and certificates for the users, and creates such keys and certificates for the users when necessary. A server according to the present invention can intercept unsecured messages from a user, automatically transform those messages into secured messages, and transmit those secure messages to the intended recipients. The server can also automatically transform messages after the recipient sends a digital identity to the server and downloads the software necessary for transforming the secured messages back into readable messages (i.e., from ciphertext into plaintext). The server can further intercept an unsecured message from a user, search for a digital identity of the intended recipient, secure the unsecured message upon finding such a digital identity, and transparently send the secured message to the intended recipient.
1. A method comprising:
intercepting, at a secure server, an unencrypted message from a sender;
searching a sequence of resources for a public key corresponding to a recipient of said unencrypted message according to a predetermined trust policy that specifies the sequence of resources as a hierarchy of networked resources on networked machines connected to said secure server including a local cache, a local certificate database, a recipient domain server and a designated key server;
when said public key is found, encrypting said unencrypted message using said public key to create a secure message created during an encryption˜operation; and
transmitting said secure message to said recipient;
wherein said secure server transparently locates said public key and transmits said secure message to said recipient without input from said recipient during said encryption phase operation and' without said sender specifying that said secure message be transmitted; and
wherein said secure server further comprises a module to identify that a user has established a first authentication connection with an electronic mail server and automatically creates a certificate for the user in response to the first authenticated connection with the electronic mail server.
2. A system comprising:
a server, further comprising:
a message receive module for receiving an unencrypted message from a sender;
a public key certificate search module to locate a digital identity corresponding to a recipient of said unencrypted message according to a predetermined trust policy that specifies the sequence of resources as a hierarchy of networked resources on networked machines connected to said secure server including a local cache, a local certificate database, a recipient domain server and a designated key server;
a crypto module for encrypting said unencrypted message using a public key for said recipient from said digital identity identified by said certificate search module to create a secure message created during an encryption operation; and
a message transmit module for transmitting said secure message to said recipient;
wherein said server transparently locates said stored digital identity and transmits said secure message to said recipient without input from said recipient during said encryption phase operation and without said sender specifying that said secure message be transmitted, and
wherein said server further comprises a module to identify that a user has established a first authentication connection with an electronic mail server and automatically creates a certificate for the user in response to the first authenticated connection with the electronic mail server.
This patent application claims priority to U.S. Provisional Patent Application No. 60/483,302, filed Jan. 7, 2003 and entitled "SYSTEM AND METHOD FOR SECURE ELECTRONIC COMMUNICATION IN A PARTIALLY KEYLESS ENVIRONMENT," and is related to U.S. patent application Ser. No. 10/462,775 filed Jun. 17, 2003 entitled, "SYSTEM AND METHOD FOR SECURE AND TRANSPARENT ELECTRONIC COMMUNICATION," now abandoned, and is related to U.S. patent application Ser. No. 10/462,607 filed Jun. 17, 2003 entitled SYSTEM AND METHOD FOR TRANSPARENTLY PROVIDING DYNAMIC USER REGISTRATION AND CERTIFICATE UPDATE," now abandoned, the entirety of which are incorporated herein by reference.
This invention relates generally to securing electronic messages in a computer network. More particularly, this invention relates to techniques for providing automated hierarchical techniques for sending and receiving secure messages without keys.
Encryption is the process of using a cryptographic key to scramble the contents of an electronic message (i.e., the plaintext) rendering it unreadable by anyone but the holder of a corresponding key (i.e., the intended recipient), the result being an unintelligible message (i.e., the ciphertext). Decryption reverses the encryption process by converting ciphertext back to plaintext, thereby restoring the original message. Encryption and decryption can be used to provide message security. Message security, particularly electronic mail (e-mail) encryption and decryption, has seen a relatively low adoption rate amongst Internet users. Many users know that messages transmitted via open networks such as the Internet are plainly readable, yet they commonly do not use encryption to solve this problem. Furthermore, from organized studies to anecdotal evidence, many people seem to have difficulty with effectively using encryption software.
As shown in
The overarching architectural goal of secure electronic communication is to make encryption easy to use and ubiquitous. Unfortunately, security experts often view security as an "all-or-nothing" prospect. This has led to, for example, complex software, difficult to use interfaces, and poor performance. What is needed, then, is a secure, transparent electronic communication system that alleviates the need for end users to interact with encryption software.
This invention provides secure transparent electronic communication. It allows users to send and receive encrypted and/or signed messages with little or no user involvement. In an embodiment, secure transparent electronic communication provides end-user transparency. A user does not need to know the details of security or, for example, that a session is encrypted. Instead, the secure transparent electronic communication is provided by, for example, a separate server. Consequently, secure transparent electronic communication provides a user, in one embodiment, with e-mail security via automated hierarchical techniques for transparently sending and receiving secure messages. A second feature of secure transparent electronic communication is that it lowers the burden on administrators. It focuses the software setup on a relatively few servers rather than on many clients. Also, from an administrator perspective, secure transparent electronic communication allows for a public key infrastructure (PKI) to be dynamically constructed and operated. A third feature is that it offers a scale of tradeoffs of security with ease of use. In its most refined form, secure transparent electronic communication is encryption done entirely on servers. Secure transparent electronic communication interoperates fully with client-based encryption, and provides even stronger security for users who demand such higher security. It further provides for sophisticated digital certificate searching for users that may not have cryptographic keys and certificates.
An embodiment of the present invention includes a server in a local network that acts as a proxy between a user and an open communications network, with the server intercepting messages to or from the user in the local network and transforming those messages using indicia contained within or related to the messages, thereby providing transparent transmission and receipt of secure messages for the user. In an exemplary embodiment, a system according to the present invention could be used for sending and receiving secure e-mail. In another embodiment, such a system could be used for securing instant messaging (IM). In yet another embodiment, such a system manages cryptographic keys and certificates for the users, and creates such keys and certificates for the users when necessary.
According to another aspect of the present invention, unsecured messages from a user are intercepted at a server, automatically transformed into secured messages, and transmitted to recipients. In another embodiment, the messages are automatically transformed by a server after the recipient downloads the software necessary for transforming the secured messages back into readable messages (i.e., from ciphertext into plaintext) and sends a digital identity to the server.
Similarly, another aspect of the present invention involves intercepting secured messages for a user, automatically unsecuring the message for the user, and sending the unsecured message to the user.
In yet another aspect of the present invention, a server receives an indication that a user has been properly authenticated, checks whether the user has a cryptographic key, and automatically creates a key if the user does not have one, thereby automatically registering the user within a predefined community and allowing the user to transparently send and receive secure electronic messages.
A further aspect of the present invention involves intercepting at a server an unsecured message from a user, searching for a digital identity of the intended recipient, securing said digital message upon finding such a digital identity, and transparently sending the secured message to the intended recipient.
Secure transparent electronic communication is a set of strategies that offer great improvements over the prior art for end users and IT staff. Secure transparent electronic communication also provides an improved development platform, making it easier to test and perform quality assurance, thus providing a lower cost to customers. In one embodiment, no client program is installed on the user's computer. Instead, a server manages all of the secure messaging for the clients.
Secure server 208 is transparent, meaning that to the user, the addition of secure server 208 to internal network 202 causes no perceptible change in functionality since the user's computer still sends and receives e-mail as usual. In an embodiment shown in
As will be described in further detail below, secure server 208 proxies standard network protocols between user computers 204 and 206 and the actual e-mail server 210. As a result, user computers 204 and 206 and e-mail server 210 can use nearly any e-mail client or e-mail server. As long as user computers 204 and 206 utilize standard protocols, the secure transparent electronic communication functionality provided by secure server 208 can enable secure transparent e-mail. Secure server 208 can also be used in conjunction with other proxies that scan for viruses or hostile content.
In one embodiment, secure server 208 runs its own operating system and contains software that allows it to receive software updates from PGP Corporation. Secure server 208 may be shipped as a turnkey box (e.g., a 1U rack-mount system, or possibly a small office/home office (SOHO) computer), or as software installed on a suitably configured piece of hardware, such as personal computers from major manufacturers (e.g., Dell, HP, etc.)
Proxy Mode
Secure server 208 performs the encryption and decryption processes based on indicia contained within or accompanying the messages, including, without limitation, any combination of a username, distinguished name, common name, domain name, or certificate. In proxy mode, all e-mail on e-mail server 210 is stored encrypted, and is only decrypted by secure server 208 when the user of client machine 204 or 206 downloads it. In addition, secure server 208 decrypts e-mail when downloaded by remote users of local network 202 (i.e., users physically located outside local network 202, such as remote user 220). Further, outbound e-mail is optionally relayed through a separate SMTP relay (not shown in
More particularly and in an exemplary embodiment, secure server 208 proxies e-mail between existing e-mail server 210 and an existing e-mail client program running on a client machine 204 or 206. E-mail server 210 is also known as a Mail Transport Agent (MTA), which is the tool utilized in a network for delivering e-mail. The e-mail client program is also known as a Mail User Agent (MUA), which is the interface between the user and the MTA. Secure server 208 works with any e-mail server or client that employs standard network protocols, such as SMTP, POP3, and IMAP4. Additionally, secure server 208 supports MAPI interfaces for Microsoft Exchange servers as well as Lotus Notes. It also supports these protocols over the well known Secure Sockets Layer (SSL) protocol or the Transport Layer Security (TLS) protocol (together SSL/TLS). Typically, server 208 acts as a live proxy, meaning that it mediates the actual connection between the MUA and the MTA. At times, the server may also act as an SMTP relay, in cases where it cannot immediately process a connection.
In order to provide transparent encryption and decryption, secure server 208 manages all cryptographic keys, certificates, and processes for users. A system using secure server 208 requires no software to be placed on end user systems. When no software for providing encryption or decryption exists on the machines of end users, there would be no discernible indication to the end users that the communications are being protected. In an alternative embodiment, security software can be installed on client machines 204 and 206 to reduce some of the processing done by secure server 208.
Secure server 208 creates keys and certificates opportunistically, meaning that when it first sees a valid user connecting to e-mail server 210, it automatically and transparently creates a key and certificate for that user. It can update that key and certificate using the valid FROM address on an authenticated SMTP connection. The key database containing the keys and certificates is regularly backed up and stored on another system by FTP or by e-mail. In an embodiment, the backup database is PGP-encrypted using an administrator key.
In proxy mode, e-mail messages are stored on e-mail server 210, and encrypted and decrypted by secure server 208 upon retrieval. Secure server 208 can, according to policy, perform the encryption and decryption operations completely transparently, it can add text headers indicating that the e-mail was encrypted or signed, or it can even add in rich text with notifications. Note that secure server 208 must also parse ordinary messages to defeat spoofing.
Typically, secure server 208 does not store account names and passwords of the users of client machines 204 and 206. Rather, since secure server 208 proxies a connection on behalf of the user to another server (i.e., e-mail server 210), secure server 208 considers that connection to be authenticated if e-mail server 210 considers the connection to be authenticated.
In an exemplary embodiment, security software running on client machines 204 and 206 transparently provides traditional PGP functionality to the end user, such as file encryption and decryption, disk encryption and decryption, and secure file deletion. Furthermore, security software allows sharing of a digital certificate (also referred to as simply a certificate) between client machines 204 or 206 and secure server 208, which gives the users the benefit of certificate-based systems, while reducing the chance of data loss. The security provided by secure server 208 works for mobile user 220, as well. In one embodiment, the connection between mobile user 220 and internal network 202 is protected with SSL.
Microsoft Exchange
The Exchange product from Microsoft Corp. of Redmond, Wash. uses a proprietary protocol for client-server communication. Consequently, in one embodiment of the present invention, specific changes are needed in order to allow secure server 208 to interoperate with an Exchange-based e-mail server (which could be one type of e-mail server 210). An Exchange server plug-in (i.e., small program module) allows the messages on the Exchange-based e-mail server 210 and the messages on secure server 208 to be easily sent to and received from each other.
In operation, the Exchange plug-in running on e-mail server 210 intercepts an e-mail message and transfers it to secure server 208. Secure server 208 then performs any key lookups and message transformation. An outbound SMTP message is then sent to the recipient (which could include a user connected to a remote e-mail server 230), optionally through an SMTP relay. Messages intended for a local Exchange user are sent back to the Exchange server.
Communication between secure server 208 and an Exchange-based e-mail server 210 utilize Secure Hypertext Transmission Protocol (SHTTP). Authentication involves client-side Transport Layer Security (TLS) on both sides; that is, secure server 208 authenticates the certificate of Exchange-based e-mail server 210, and Exchange-based e-mail server 210 authenticates the certificate of secure server 208. The administrator configures secure server 208 with the TLS certificates of Exchange-based e-mail server 210, and vice-versa. Since port 443 will cause conflicts on both servers, port 444 is used as a default in one embodiment.
In cases where the communication is initiated by a user, such as through the user configuration console, secure server 208 connects to the plug-in in Exchange-based e-mail server 210 to verify the user's username and password. Since user authentication is very costly in terms of processing power, and needs to happen very frequently, when the communication comes directly from the Exchange plug-in running on Exchange-based e-mail server 210, no authentication is needed since secure server 208 trusts Exchange-based e-mail server 210 to designate what operation needs to be performed and what user needs to perform the operation. This trust exists since the TLS certificate of Exchange-based e-mail server 210 has already been authenticated.
The messages Exchange-based e-mail server 210 sends to secure server 208 do not have standard e-mail headers, so the communication also includes information such as sender and recipients. In addition, the Exchange plug-in running on Exchange-based e-mail server 210 recognizes when a message is sent to an Exchange distribution list, and signals to secure server 208 that the message should not be encrypted.
Gateway Mode
In gateway mode, secure server 308 is logically positioned between e-mail server 310 and Internet 1000. E-mail server 310 handles all communication with the local users of client machines 304 and 306. The only tasks handled by secure server 308 are encrypting outbound SMTP e-mail and decrypting incoming SMTP e-mail. In this configuration, all e-mail is stored unencrypted on e-mail server 310. In addition, outbound e-mail is optionally relayed through a separate SMTP relay. Secure server 308 operates in this mode when the administrator has configured secure server 308 to decrypt e-mail as that e-mail is received.
Proxy Mode With a Supplemental Server
Communication Amongst Secure Servers and Clients
Client Software
Client machine 470 includes standard client computer components, including a network connection device 474, a CPU 472, and a memory unit 475 containing communications module 476 to realize standard network communications. Client software (e.g., message client module 478) running on client machine 470 communicates with secure server 408 through an SHTTP interface provided by communications module 456 running on secure server 408. Communication between message client module 478 on client machine 470 and secure server 408 includes:
Secure server 408 recognizes when a user downloads or sends a message, and whether client machine 470 is running message client module 478 or not. When client machine 470 is running message client module 478, secure server 408 does not decrypt downloaded messages or encrypt messages to be sent since these tasks are performed by message client module 478. For POP and IMAP communications, message client module 478 running on client machine 470 detects when it is communicating with secure server 408 by, for example, either identifying a special string in the server greeting, or by the CAPABILITY command in IMAP.
In order to connect to secure server 408, message client module 478 provides a username and password. Because there are certain times when client machine 470 never sees the user's password (e.g., if his e-mail client uses an MD5 challenge password scheme), when client machine 470 successfully authenticates to secure server 408, secure server 408 provides a small, unique data file to the client (e.g., a cookie), which client machine 470 then later uses to authenticate to secure server 408 without needing the user's password.
Once client machine 470 knows it is communicating with secure server 408, client machine 470 can then send a new command, such as "DONTDECRYPT" or "DONTENCRYPT", which only secure server 408 can interpret.
Secure Sockets Layer (SSL)
An administrative preference specifies whether communications between client machine 470 and secure server 408 over a local communications channel (e.g. local network 490) should use SSL/TLS. Administrative options include: (1) require SSL/TLS, or (2) allow SSL/TLS. In order for this communication to work transparently to the user, the certificate for secure server 408 is installed in the appropriate e-mail client on client machine 470.
A PGP keyring (i.e., the repository for PGP public keys and certificates that exists on any machine that runs the PGP algorithm) resides in memory unit 455 on secure server 408 for use by key processing and crypto module 464, allowing certificates on customers' existing e-mail servers to be verified. In an exemplary embodiment, the PGP software on secure server 408 allows the TLS package from PGP Corporation (known as PGPtls) to be used for the SSL/TLS functions. Additionally, the use of a PGP keyring allows a customer to add additional CA certificates to an X.509 CA keyring, in case the customer is already running its own internal CA.
SMTP (which is the protocol implemented in message processing module 468 and used by secure server 408 for transferring e-mail messages) utilizes two different mechanisms for implementing SSL/TLS. First, a STARTTLS extension (according to the well known RFC3207) is used, which performs a TLS negotiation on port 25 (the "official" method, since it follows RFC3207). Second, an SSL-wrapped SMTP service on port 465 is used (the "unofficial" method, since it does not follow RFC3207). Because there are some client software packages that don't support the STARTTLS extension on port 25 (Ximian Evolution, for example), and there are other clients that don't support the unofficial port 465 SSL-wrapped SMTP (Microsoft Outlook, for example), secure server 408 supports both methods.
The SSL certificate request/retrieval process is an integrated part of the administration console of secure server 408. Prior to generating a certificate, secure server 408 authorizes the customer's license number, license authorization, and DNS name. The administration console of secure server 408 requests the certificate by communicating with a designated authority over SHTTP and attempting to download the certificate immediately. In such an embodiment, no manual intervention is needed to approve the certificate request.
In an exemplary embodiment, SSL certificates are valid for one year from the date of issuance. As discussed in further detail below, when the certificate expiration date nears, key processing and crypto module 464 within secure server 408 automatically renews the certificate. For convenience of the users, new SSL certificates can continue to be provided for as long as the customer license number indicates that the user is licensed to use the product.
Sending E-mail
When secure server 408 receives a message from client machine 470 (in proxy mode) or e-mail server 420 (in gateway mode) over SMTP, this corresponds to sending a message. This is referred to as sending a message because the connection corresponds to some user (a local user or a remote user) sending a message that needs to be secured. Secure server 408 can work with either authenticated connections (e.g., SMTP-AUTH, which is an SMTP service extension in SMTP nomenclature indicating an authentication method to be used by a server) or unauthenticated connections. Authenticated connections are ones that represent users sending e-mail (e.g., a user of client machine 470 sending a message), while unauthenticated connections represent e-mail that is being received for users from, for example, Internet 1000.
In a typical embodiment, a secure server (e.g., secure server 408 in
If the certificate is not found in the local cache, the local network is searched in a step 520. Again, if the certificate is found somewhere within the local network, control passes at a step 525 to a step 555. If the certificate is not found in the local network, a search is performed of the entire network in a step 530. If the certificate is found within the local network, control passes at a step 535 to a step 555. If not found on the entire network, a secure message URL (e.g., a Boomerang message) is sent to the recipient in a step 540. This allows the recipient to receive a piece of software that provides the ability to exchange secure messages (e.g., via an encryption client from PGP Corporation or some other type of client-side protection software). If the recipient is willing to receive such a client software package (as determined in a step 545), the client software is sent to the recipient in a step 550.
Certificate Search
An important part of sending secure e-mail is retrieving the certificate of the intended recipient. A certificate is a data object that contains one or more public keys, along with any combination of (a) data about the holder of those keys, and (b) one or more signatures binding some subset of the data about the holder of the keys with some subset of the public keys themselves. The data about the holder of the keys can include, for example, the name of they key holder, the key holder's e-mail address, a picture of the key holder, and some indication of the authorization of that key holder.
Referring back to
When looking for an appropriate certificate, a secure server might find it in a number of places including:
The administrator of secure server 408 can tailor the actual options that secure server 408 might use for certificate searching, as well as the ordering. The search strategies above are among the policies that secure server 408 is configured to follow in one embodiment of the present invention.
In an exemplary embodiment of the first scenario described above, secure server 408 shown in
In an example of the third scenario above, a secure server can query another server by using an LDAP lookup, an http request, or a "piggybacked" request on an SMTP request to another secure server. Secure servers provide an SMTP extension for a certificate request. This is how secure servers implement direct trust—when sending e-mail to a user in another domain, a secure server in the sending domain will simply query the e-mail server in the receiving domain for the proper certificate. If the e-mail server in the receiving domain has a certificate for that e-mail address, that certificate is retrieved and used.
A direct trust strategy, as discussed in further detail below, provides two enhancements over previous mechanisms—easy coordination with partner organizations, and a shortcut on the certification problem. For example, two workgroups that install secure servers cause encrypted e-mail to automatically spread through the two organizations. The trust relationship is based on simple cooperation between the two e-mail servers. It can be further enhanced by other network security protocols such as DNSsec and IPsec.
A fourth possibility for searching for the recipient's certificate in an exemplary embodiment includes searching one or more designated PGP key servers. A PGP key server is a server that contains a database of PGP users, their public keys, and certificates. Secure server 408 can contain, in one embodiment, a set of designated PGP key servers as the next entry in its search path for finding a recipient's certificate. The designated PGP key servers could be, for example, located in areas geographically near to where secure server 408 and local network 490 are located, or could be housed at institutions where a significant number of recipients may exist (such as a particular university).
In addition to searching one or more designated PGP key servers, in a fifth scenario secure server 408 can also be configured by policy to search all public PGP servers for the certificate of the designated recipient. A public PGP key server is a PGP key server that can be reached via the Internet by anyone (i.e., certificates within the database of that public PGP key server can be accessed and retrieved by anyone with access to the Internet). One reason for placing this at a lower priority is that a search of all public PGP key servers could take considerably longer than searching a local cache, a local database, other secure servers, or a set of designated PGP key servers.
Finally, secure server 408 could be configured to search one or more other directories for the certificate of the intended recipient of a message from a user. Such other directories could include, for example, custom enterprise directories that contain a particular subset of certificates or nonpublic certificates.
Once a certificate has been found, the certificate is added to the local public certificate cache, to speed up multiple lookups of the same certificate. Certificates added to the local public certificate cache expire after a time the administrator has configured and are then removed.
If a certificate cannot be located for the intended recipient of a message, secure server 408 provides several alternatives, with the behavior depending on administrative preference. In one embodiment, possible actions can include:
Secure URL e-mail describes the concept where outbound e-mail that should be encrypted actually stays on secure server 408 and requires the recipient to view the e-mail through an SHTTP web page on secure server 408. Instead of receiving the unencrypted message, in one exemplary embodiment, the recipient receives a message containing a URL pointing back to secure server 408, as well as other URLs for downloading, for example, encryption client software. In an exemplary embodiment, the URL leads the recipient back to an SHTTP web page on secure server 408. The web page, secured with SHTTP, allows the recipient to securely read the message. For example, the web page could contain the following questions followed by the original clear message beneath it (but still secured via the SHTTP connection):
"You may read messages from John Smith <email@example.com> securely in the future. Please select one of the following options:
In one embodiment of the present invention, for each e-mail address to which secure server 408 tries to send e-mail, secure server 408 creates a new secure URL e-mail account. This provides a way for secure transparent electronic communication to be enabled by default. Even if a certificate is not found for a particular recipient (as described earlier), the provision of a secure URL e-mail account will mean that communications between the user and the recipient are secure.
Upon a recipient selecting option 2 above, secure server 408 creates a passphrase to the entry for that account in the secure URL e-mail database. Future messages to that recipient are read using this passphrase. By providing a passphrase, a further level of security is added since only the recipient with that passphrase can view messages sent by secure server 408. This provides a rudimentary level of authentication.
If a recipient selects option 3 above, secure server 408 adds a flag to the entry in the secure URL e-mail database so secure server 408 will send that recipient messages in the clear (i.e., unencrypted) but still secured by the SHTTP connection.
Thus, in an embodiment of the present invention, secure URL e-mail provides a form of secure transparent electronic communication, even when the recipient does not have secure communication capability on the recipient's computer or other electronic device. Secure transparent electronic communication causes the communication between the user and the recipient to be secured, regardless of the intent of either the user or the recipient.
Receiving E-mail
When a user retrieves e-mail from secure server 408, the server proxies the connection in message receive module 458 and decrypts messages in key processing and crypto module 458 before they are sent over SSL to the user's system. This process, as directed by the applicable policy, can be completely transparent, or can be enhanced with text or HTML to let the user know that the e-mail was sent encrypted or signed.
Verifying a digital signature on a received e-mail message involves a certificate search similar to one needed for sending e-mail. Verification of a digital signature can also utilize the OpenPGP Preferred Key Server signature subpacket (RFC 2440, section 188.8.131.52) that tells where to find the proper certificate to update the signing certificate's status (such as revocation).
Automated PKI
Unlike a traditional PKI, installation of secure server 408 creates a PKI as it is used. Secure server 408 needs little provisioning in such a PKI since secure server 408 relies on the interactions of authorized users with the main e-mail server to determine who its users are. It creates certificates as it discovers users, and also expands its dynamic infrastructure as messages are exchanged with other organizations using either PGP key servers, Lightweight Directory Access Protocol (LDAP) certificate servers, or other secure servers. This further minimizes the need for IT staff to provision secure server 408. Furthermore, this dynamic PKI works with X.509 certificates as well as PGP certificates, and can provide interoperability between PGP and S/MIME based systems.
Key Generation
When a user successfully authenticates to secure server 408 (via the authentication with e-mail server 420 via SMTP, POP, or IMAP), a check is made to determine whether that user has been issued a certificate. If the user does not have a key, secure server 408 generates a new public key pair and certificate using key processing and crypto module 464, and automatically signs the new certificate using a PGP certification key from secure server 408.
To generate the key pair, two pieces of user-specific information are needed: the user's name and e-mail address. In the case of the user sending an SMTP e-mail, both the username and the e-mail address can be read from the "From:" line of the e-mail being sent. In the case of the user receiving e-mail via POP or IMAP, the username is acquired from the name used for authenticating to the system, and the domain is likely already known (although this may not be the case when managing multiple e-mail domains). In addition, for POP and IMAP the e-mail address is determined. There is not a way, however, for determining the real name of the user. To work around this problem, a certificate is generated with just the e-mail address. When the user later authenticates via SMTP, the certificate's self signature is updated with the name taken from the "From:" line of the outbound message.
Local user public keys generated by key processing and crypto module 464 in secure server 408 will have the "group key" flag set in the corresponding certificate (as specified in RFC 2440, section 126.96.36.199), notifying other users that the user's private key is not in the sole possession of the intended recipient. In addition, the "preferred key server" option (as specified in RFC 2440, section 22.214.171.124) is set to the Open LDAP running on secure server 408. In an embodiment, the URL is a standard LDAP URL such as:
Within message processing module 468, additional user IDs can be associated with user certificates in secure server 408, particularly when a user is detected to have one or more alias addresses, such as firstname.lastname@example.com and email@example.com. When a user sends a message with the "From:" header containing an address that is not on his certificate, secure server 408 will add that address.
A more complicated case occurs when a user has multiple aliases, but only ever sends e-mail from one address, e.g., Mike Smith sends e-mail from email@example.com, but also receives e-mail for firstname.lastname@example.com, email@example.com, etc. In this case, a new header (such as "X-Ovid-Recipient" in an embodiment of the present invention involving an Ovid server) is added by message processing module 468 to all incoming non-mailing list e-mail (i.e., individually addressed e-mail) received by secure server 408. The new header contains the actual SMTP recipient address (i.e., the address specified in the RCPT command in the SMTP session). When the user downloads e-mail, secure server 408 compares the recipient address added to the X-Ovid-Recipient header with the authenticated username. If the recipient address is different from the username, secure server 408 associates the recipient address with the user's certificate as a new user ID.
All internal mailing lists within e-mail server 420 are added to an exclusion list. In an embodiment, messages sent to mailing lists will not have the X-Ovid-Recipient header added to them, nor will they have this header checked when downloaded. If a mailing list fails to get added to the exclusion list, an e-mail sent by a non-local user to an internally-hosted mailing list (e.g., email@example.com), would cause the header "X-Ovid-Recipient: firstname.lastname@example.com" to be added to the SMTP message when it was first received. When the recipient downloads the message, secure server 408 would process the X-Ovid-Recipient header and add firstname.lastname@example.com to the user's certificate. A mailing list detection mechanism within message receive module 458 in secure server 408 detects and prevents this situation when a user downloads a message.
Note that in gateway mode, the e-mail does not get processed by secure server 408 when the user downloads it, so it only adds aliases when a user sends a message from a different address.
Certificate Expiration and Renewal
Certificates generated by key processing and crypto module 464 in secure server 408 have an expiration time configurable by the administrator, in one embodiment ranging from one day up to no expiration. A default expiration is set, which, in an exemplary embodiment, is two weeks. When a certificate maintenance function within key processing and crypto module 468 of secure server 408 determines that a certificate is nearing expiration, a new certificate with a new self signature for the certificate and a new expiration date is generated (instead of leaving the existing certificate expired and generating a new certificate for the user). This allows a user to retain the same cryptographic key, but with a new expiration date and new signature in the certificate.
In order to solve the "dead certificate" problem (i.e., expired certificates being retained indefinitely), three configurable timeout intervals exist in an embodiment of the present invention:
The first timeout, the certificate expiration timeout, is the default certificate expiration time. When a certificate maintenance function described above finds any certificates that are expired, or will expire within a predetermined amount of time, secure server 408 checks the last time the user has logged in to e-mail server 420. If the user has logged in within the time period specified by the account inactivity timeout (the second timeout interval), a new self signature is generated for the certificate with a new expiration date. If the user hasn't logged in within the account inactivity timeout, the certificate is left to expire. Once the final account inactivity timeout has elapsed, if the user still hasn't logged in, the certificate is removed. In order to avoid removing certificates for users that may be gone for an extended period of time, the final account inactivity timeout should be set very high.
Trust Policies
There are three basic trust policies that specify certificate validity. They are hierarchical trust, cumulative trust, and direct trust. The server providing secure transparent electronic communication uses all three policies. Hierarchical trust considers a certificate valid if it is certified by some trusted root authority or one of its designated authorities. A trusted root authority can include, for example, a Certification Authority (CA). Traditional X.509 certificates or PGP Meta-Introducers are examples of mechanisms found in hierarchical trust systems. Cumulative trust considers a certificate valid by summing its certifications, weighting those certifications, and checking to see if they are greater than some threshold. The PGP Web of Trust is a cumulative trust system. Direct trust considers a certificate valid if it was received directly from its owner or the secure server used by the owner of the certificate. Typically, individuals use direct trust. In such a system, if a person considers a certificate to be valid because its fingerprint is printed on the business card of the holder of the certificate, the recipient is using direct trust.
Secure server 408 allows its administrators to specify certificates of root authorities for hierarchical trust, and weighted certificates for cumulative trust. For example, in one embodiment the administrator can upload a normal PGP public keyring file (having a .pkr extension) with all of the appropriate keys, certificates, signatures, and trust levels for the organization. Secure server 408 can also use direct trust. It does this by searching for a certificate from the recipient's domain, and making the assumption that if the domain to which the user was going to send plaintext has spoofed a certificate, then it's not substantially worse than sending plaintext. Secure server 408 will thus use direct trust whenever it has received a certificate from a source having a direct relationship with the recipient. In an embodiment, a certificate is directly trusted when it comes from one of the following sources:
Policies define the set of rules that govern how a secure server operates in various situations. In an embodiment, the server providing secure transparent electronic communication includes configurable policy elements, such as:
In an embodiment of the present invention, the administration console also allows the administrator to perform the following tasks:
In an exemplary embodiment, secure server 408 utilizes a modified Linux operating system, such as the RedHat 7.3 Linux distribution, made by Red Hat, Inc. of Raleigh, N.C. RedHat already provides many extra libraries and applications needed for secure server 408, such as openldap and apache. In a different embodiment, another RedHat-based distribution could be used, such as Immunix. The versatile and modular design of the secure server software allows for easy porting to other Unix-based operating systems, and also to a Windows-based architecture, if needed.
The programs/libraries for secure server 408 are packaged as standard signed RPMs. An RPM is a package written to comply with the RedHat Package Manager. This allows for easy inclusion into the RedHat installer, and simplifies the automatic update mechanism. One distribution of secure server 408 will include some of the RedHat RPM packages, as appropriately modified, with whatever default configurations are needed. By not including unneeded packages, the entire distribution fits onto a single installation CD.
Initial Setup
In order to ease the transition to use of secure servers to provide secure transparent electronic communication, a "Learn Mode" exists in an embodiment of secure server 408. In this mode, secure server 408 does not perform any encryption/decryption, but POP, INAP, and SMTP messages would still be proxied to e-mail server 420, allowing a public key infrastructure (PKI) to be constructed and exclusion lists to be built.
In an embodiment, software updates to secure server 408 are provided over the network automatically. These updates are signed so that only legitimate updates are installed on secure server 408. Automatic updates are distributed as signed RPMs, which is facilitated by the fact that RPM already allows for embedded PGP signatures.
In an exemplary embodiment, secure server 408 has a scheduled task (such as a Unix 'cron' job) to periodically download updated RPMs, verify the PGP signatures, and either (1) automatically install them for the administrator, or (2) notify the administrator by e-mail and allow the installation to be initiated manually from the administration web console. Access to the updated packages is restricted to verified customers. An SHTTP server is maintained which requires the customer to provide a valid license number and license authorization. Using standard RPMs also allows externally provided security updates to be made to any other packages used in secure server 408.
While the above-described embodiment focuses on e-mail, there are a number of other protocols that closely relate to users' needs, including, for example, instant messaging. Instant messaging protocols are widely used and are the fastest growing type of Internet communications. Also, they are completely unsecured. Secure server proxies can provide security to these protocols.
Set forth in detail above are aspects of at least one embodiment of the present invention. Each of the features set forth above may be implemented in one system, method, and/or computer executable code in accordance with an embodiment of the present invention. Alternatively, each of the features set forth above may be separately implemented in different systems, methods, and/or computer executable codes in accordance with embodiments of the present invention.
Furthermore, the principles, preferred embodiments, and modes of operation of the present invention have been described in the foregoing description. However, the invention that is intended to be protected is not to be construed as limited to the particular embodiments disclosed. Further, the embodiments described herein are to be regarded as illustrative rather than restrictive. Others may make variations and changes, and equivalents employed, without departing from the spirit of the present invention. Accordingly, it is expressly intended that all such variations, changes and equivalents which fall within the spirit and scope of the present invention as defined in the foregoing claims be embraced thereby.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image


text:
Forgot Password? | Not a User? Sign up
Your browser does not support iframes.
Flood waters have receded across most of the county, however, some back roads continue to be impassable. These include Gunning Lane, Blanton Road and Old 52 South (Lyons Station, Athertonville and Youngers Creek) and Dangerfield Road.
Wednesday evening, U.S. 31 E was cleared to traffic through Athertonville and New Haven.
Officials urge caution when driving in these areas.
Jerry Herndon, the architect who designed the $10.8 million new Sunrise Manor Nursing Home under construction in Hodgenville, described the facility in detail and took questions from an audience of about 50 people gathered in the current nursing home's chapel April 20.
"I am excited and can tell you that there is something special about the impact this nursing home will have on the community," said Herndon, whose office is in Lexington.
LaRue District Court proceedings were moved to the larger Circuit Courtroom April 28.
When Circuit Clerk workers arrived at work in the courthouse annex, they smelled a foul odor after the heater was turned on, according to LaRue County Judge/Executive Tommy Turner.
A Magnolia man was injured in a pickup vs. tractor collision Friday afternoon.
About 4:30 p.m., David Owen, 52, of Magnolia was driving a 1973 John Deere 4430 tractor north on U.S. 31E. The tractor, which was pulling a fertilizer buggy, attempted a left turn into a field, according to Deputy Matt Darst's report.
Owen turned into the path of a southbound 1997 Ford F150 pickup driven by Manley Cruse, 74, of Magnolia. The vehicles hit head-on and both had extensive front end damage.
A Hodgenville man accused of raping a young girl has pleaded guilty to amended charges and was sentenced to 90 days in jail for his crimes.
Joshua O. Henderson, 25, of 320 Devores Lane was indicted by a Taylor County grand jury in July 2009 on charges of third-degree rape and intimidating a participant in a legal process.
On Tuesday, Henderson pleaded guilty to sexual misconduct and facilitation to commit intimidation in Taylor Circuit Court.
According to the indictment, Henderson was accused of having sex with a girl younger than age 16 in July 2008.
LaRue County Judge/Executive Tommy Turner spent most of his time at the April 13 candidate forum describing the improvements made to the county during his tenure – and what he'd like to see in the future.
"I think we've done quite well," Turner said.
He said 25 years ago when he took office, the county roads were rated 40th in the state – they're now fourth. All bridges have been brought up to weight-bearing codes.
Kentucky Chrome Works, an automotive supplier, will begin manufacturing operations in Hart County, according to the Governor's Communications Office. The start-up project will create 80 new full-time jobs within two years and result in a more than $2.6 million investment in the Commonwealth.
One of the points of contention in the LaRue County Sheriff's race deals with salary.
At the April 13 candidate forum, one of the questions was "Do you anticipate having additional officers and how will you pay them?"
Democratic challenger Terry Cruse said his potential deputies include former sheriff Merle Edlin, former Kentucky State Police detective Rob Foster, former city officer Donald Jewell and current city officer Doug Sherrard.
Patrick Andrew Bender, 18, was charged with two counts of unlawful transaction, illegal controlled substance, after allegedly smoking marijuana with a 15-year-old female and a 17-year-old male April 12. He was charged also with possession of marijuana, possession of drug paraphernalia and tampering with physical evidence after allegedly attempting to dispose of the marijuana at a traffic stop in Buffalo.
LaRue County Deputy Marcus Jackson wrote in the citation that a baggie of marijuana and rolling papers were taken into evidence.
The case of a store manager charged with theft by unlawful taking was waived to the grand jury April 21.
Bill Woodrow Willis, 29, of Radcliff is accused of making illegal transactions on cash registers without items being purchased at Pamida. Hodgenville City Police Chief John Cottrill said the transactions total about $5,700.
Willis pleaded not guilty at his arraignment in LaRue District Court.
The grand jury will determine if there is enough evidence to send the case to LaRue Circuit Court.
Copyright © 2015
The LaRue County Herald is your source for local news, sports, events and information in LaRue County, KY, and the surrounding area.

subset: commoncrawl


text:
Venture Capital Blog
The P-I traces startups, venture capital and life in the Pacific Northwest technology community.
Posts filtered on Category
The Google phone and Medio's response
Following up on coverage from last month, The Wall Street Journal reports today on how Google is working with wireless carriers to carry new handsets that are designed specifically for the search giant's stable of Internet products. [Read More]
Report: Google works on new mobile search product
Citing anonymous sources, The Wall Street Journal reports on a new mobile search effort at Google that will allow cell phone users to find ringtones, games and other content on their devices. The Journal did not know when the service would launch, but reporter Amol Sharma writes that it has "been marred by a series of technical delays." [Read More]
Medio taps top executive
Medio Systems, the Seattle startup that is bringing Internet search technology to mobile phones, has named Robert Lilleness as chief operating officer. [Read More]
Show More


text:
In response to a report from the Institute of Medicine's (IOM), health care organizations are looking to increase their bachelor's-prepared RN staff to 80% and double the number of nurses with a doctorate by 2020*. With the common goal of preparing a well-educated, highly skilled nursing workforce, we have aligned with employers, including hundreds of hospitals, clinics, care centers, and national nursing associations that recognize that our online nursing programs are designed to meet and exceed the IOM recommendations.
* Institute of Medicine. (2010). The Future of Nursing: Leading Change, Advancing Health. Washington, DC: National Academies Press.
Earn your BSN on the way to your MSN.
Capella University is accredited by the Higher Learning Commission.The Higher Learning Commission is among the 6 regional accrediting bodies recognized by the U.S. Department of Education. Regional bodies accredit colleges and universities; national bodies accredit trade and vocational schools.
The BSN, MSN and DNP degree programs at Capella University are accredited by the Commission on Collegiate Nursing Education, One Dupont Circle, NW, Suite 530, Washington, DC 20036, (202) 887-6791 http://www.aacn.nche.edu/ccne-accreditation
The Commission on Collegiate Nursing Education (CCNE) is a nationally recognized accreditation agency approved by the U.S. Secretary of Education. The Commission ensures the quality and integrity of baccalaureate, graduate, and residency programs in nursing.
Capella is a proud partner with the American Nurses Association, giving ANA members many great benefits, including a 10% tuition discount on Capella degree programs.
In addition, ANA has chosen Capella as a partner on the ANA Leadership Institute. The following ANA Leadership Institute offerings are powered by Capella University, providing nurse leadership development in a flexible format for nurses at the bedside or in the boardroom.
View an ANA Leadership Institute™ Webinar: Values-Based Leadership: Creating a Culture of Ownership, featuring author and leadership expert Joe Tye.
Our online healthcare administration, public health and nursing degrees are designed to deliver skills you can apply directly to your career right now. To meet the demands of an evolving health care system and the changing needs of patients, Capella has designed virtual labs with Vila Health™ and Riverbend City™ to practice solving real health care challenges. Through these simulations, you will quickly gain the interprofessional leadership skills and competencies that can make an impact in your career.
Every member of Capella's nursing faculty has a doctoral degree combined with leadership experience, and a background in frontline nursing. Our expert nursing faculty will help you deepen your expertise, develop new skills and gain knowledge, while providing the support you need to prepare for challenging and rewarding career opportunities.
To be eligible for the $2,000 Nursing Scholarship you must enroll in the RN-to-BSN program by December 7, 2015, pass your first course, and meet all other eligibility requirements.
Capella is proud to provide military benefits, including a 15% tuition discount off bachelor's programs.
Tuition discounts from Capella-affiliated employers and colleges can make your degree more affordable, saving you thousands.
You can earn credits through our Prior Learning Assessment (PLA) process by demonstrating mastery of competencies, and may be eligible to earn credit for previous coursework, experience and learning.
Many employers offer tuition reimbursement to their employees — even those without a formal program. Check with your HR department or manager to see if you are eligible.
At Capella, you will enjoy the flexibility of earning your degree on a schedule that fits your life. In our online course rooms, students and faculty participate in discussions at different times throughout the week. You will not attend class at a specific date and time, but you can expect to complete weekly assignments, reading, and participation requirements.


text:
(This post is part of Frequency's coverage of the best music of the past decade. You can see all of that coverage in one place by clicking here. And be sure to tune in Dec. 18, when I'll post "Near/Far," our annual, downloadable MP3 compilation of the best music of 2009, to go along with our year-in-review package in that day's GO! Magazine.)
This Massive Attack beat absolutely destroys anything in its path. Mighty Mos holds his own on the mic, too. What an effort. I believe this song first appeared on the soundtrack of "Blade II," some vampire movie from 2002 starring Wesley Snipes. The Internet tells me that movie is nearly 120 minutes long.
I am pretty sure I'd rather listen to this song 23 times in a row than watch "Blade II."
Tags: Best of the 2000s, Massive Attack, Mos Def


text:
Views: 1631
Runtime: 2:18
Date: 2 years ago
All Comments
Great ass to lick.
Fukn HOT, Sir.
my submissive li'l prick is fully stiff just from imaginging the ripe, musky odor that would be cuming from Your damp, furry AssCrack and from around and inside of Your AssH@le, Sir.
Please know that i have a rimseat availble for You to spread Your big, round, meaty ButtCheeks across, and relax Your Pucker into my warm, wet, and eager mouth.
Thank You for posting, Sir.


text:
updated: 5/7/2012 4:35:06 PM
Batesville-based Hillenbrand Inc. (NYSE: HI) is reporting net income of $27 million for its second fiscal quarter, compared to $33 million for the same period the previous year. Chief Executive Officer Kenneth Camp says the drop was due in part to "seasonal effects on burials."
May 7, 2012
News Release
Batesville, Ind. -- Hillenbrand (NYSE: HI) revenue for the second quarter of 2012 grew 13% to $260 million compared to the same quarter last year. This was driven by Process Equipment Group revenue growth of 66% to $96 million (18% organic growth). In addition to the strong revenue growth, the group�s order backlog continued to grow sequentially, ending the quarter at $137 million, an increase of 6% over the prior quarter.
Batesville revenue dropped 5% to $164 million due to an estimated 6% reduction in the North American burial market. The decline in the burial market was driven by an estimated 3% decline in North American deaths during the first half of fiscal 2012, in part due to a very mild pneumonia and influenza season. North America experienced the steepest drop in deaths since 1982.
�Our Batesville business is highly dependent on the seasonal effects on burials, and the decline we�ve seen is consistent with public reports from government sources, customers and competitors,� said Kenneth A. Camp, president and chief executive officer of Hillenbrand.
Consolidated gross profit margin in the second quarter was 40.2% compared to 44.3% in the prior year, due largely to volume declines at Batesville. On an adjusted basis, the consolidated gross profit margin was 41.0%. Other income decreased by $6 million, $3 million due to the full collection of the Forethought Note in April 2011 and $3 million for investment gains that occurred in 2011.
Net income decreased 17% over the prior year to $27 million, with diluted EPS down 17% to $0.44. On an adjusted basis, net income declined 9% to $31 million and diluted EPS declined 7% to $0.50, as the strong growth from the Process Equipment Group was more than offset by lower Batesville volumes and reduced other income. EBITDA was $53 million, a 10% decrease from the prior year. On an adjusted basis, EBITDA declined by 3% to $58 million. Hillenbrand once again delivered strong cash flow from operations, reporting $33 million in the second quarter, a 30% increase over the prior year.
Due to the decline in Batesville revenue, the company lowered diluted EPS guidance to $1.70 to $1.78 ($1.68 to $1.76 on an adjusted basis). Full-year revenue is now expected to increase between 13% and 15% on a constant currency basis over 2011. This represents a shift toward the lower end of the original revenue guidance range due to the sharp decline in deaths during the first half of the fiscal year, offset in part by stronger-than-anticipated growth in the Process Equipment Group.
�We are pleased with the success of our Process Equipment Group as it continues to grow both organically and through acquisition,� said Mr. Camp. �We are also pleased with the response of Batesville in managing its business during this unusual and unanticipated drop in North American deaths.�
Year-to-Date Summary
For the six months ended March 31, 2012, Hillenbrand�s revenue increased by $50 million (11%) over the prior year to $491 million. Gross profit margin was 40.3% (40.8% on an adjusted basis) compared to 43.8% in the prior year. Cash flow increased 13% to $60 million, while net income of $59 million decreased 2% and diluted EPS of $0.94 decreased 3%. On an adjusted basis, net income decreased 9% to $56 million ($0.89 per diluted share). At $98 million, EBITDA decreased $12 million (11%) from the prior year and $4 million (4%) on an adjusted basis.
Webcast and Conference Call
The company will host a conference call and simultaneous webcast Tuesday, May 8, 2012, at 8 a.m. ET to discuss the results for the second quarter of fiscal year 2012, which ended March 31, 2012. The webcast will be available at http://ir.hillenbrandinc.com and will be archived on the company�s website through May 8, 2013. To access the conference call, listeners in the United States and Canada may dial 1-877-853-5642, and international callers may dial 1-253-237-1134. Use conference call ID number 43746905. A replay of the call will be available until midnight ET, Tuesday, May 22, 2012, by dialing 1-855-859-2056 toll free in the United States and Canada or 1-404-537-3406 internationally, and using the conference ID number 43746905.
Hillenbrand�s financial statements on Form 10-Q are expected to be filed jointly with this release and are available on the Company�s website (www.HillenbrandInc.com).
Hillenbrand (www.HillenbrandInc.com) is a global diversified industrial company that makes and sells premium business-to-business products and services for a wide variety of industries. We pursue profitable growth and meaningful dividends for our shareholders by leveraging our leading brands, robust cash generation capabilities and strong core competencies. HI-INC-F
Source: Hillenbrand Inc.


text:
In part one of this series, Great Beginnings: What Moms Are Saying, Isis Mom Erin shared with us her experience having her first baby and joining a Great Beginnings Group at Isis. Over the years, the group of friends Erin and her son, Tyler, met, have kept in touch, and in this post they share their experiences in the class and what they gained from it as new mothers.
How did Great Beginnings impact your experience as a new mom?
"Looking back on my first few months as a new mommy, I CANNOT imagine having gone through such a transformative experience without the support of my Great Beginnings group. Having our meetings and lunch dates to look forward to week after week made those sleepless nights so much more bearable. The little things I would have anxiety about walking into class (nursing, sleep, my body, hubby, baby poop!, etc…), I would wind up laughing about in class." – Lyn S.
"Being a new mom is fun, scary, joyous all at the same time. It can also become very lonely once all the excitement of baby's arrival has quieted down. Every new mom has a unique situation, a colic baby that is driving the exhausted mom nuts, breastfeeding problems, work issues – should I still work, quit, go part time, an over helpful mother-in-law or a not so helpful husband – the list is long. We had an amazing instructor, Marena, who guided us through some very tough questions and challenges that motherhood brought for us. What a relief it was to unload ourselves in our cozy little group, shed embarrassment and ask for advice and freely praise each other's efforts – we were all in this together!! We came to know each other and at such a delicate and vulnerable time of our life. The love and support that went around then made strong bonds between us that continue to grow and strengthen." – Pramila
"The Great Beginnings Class helped me navigate through those first few months of being a first time Mom. It was a friendly, safe and encouraging environment. The first time I publicly nursed my baby was during class. The ten of us really bonded and often would go to lunch after class. We are all still great friends and still share ideas and get advice from each other. I am so blessed to have these women and their families in my life!" – Susan
"I signed up for Great Beginnings because a colleague of mine had mentioned that it would be fun to join the class together. I was hesitant because I am a private person by nature! I joined Great Beginnings when my son was only 3 weeks old and I remember feeling overwhelmed by everything. The thought of going out to lunch on that first day seemed like an impossible task but with the comfort and support of the other new moms that I had just met, I immediately felt safe. I did not know this at the time, but I was suffering from Post Partum Depression that lasted the whole first year of my son's life. I had a hard time going out to do simple errands and I even had a hard time communicating with my family. But I looked forward to my Great Beginnings class every week and I never said no when my new mom friends called to invite me and my son out for a play date. These moms gave me constant support and courage. I am thankful that Isis offered this class." – Sofia
"I took the Great Beginnings class when my first son was 5 weeks old. I was so lost and scared and unsure of what to do with this little human and this class was a beacon in the churning sea of new mommyhood. Marena was our teacher and she held her hands out to rescue me and the other moms in the class from drowning in our uncertainties. We all bonded immediately and have been great friends ever since. Even more fun has been watching our kids play and grow together. This class was amazing and it should be a must for all first-time moms!" – Rebecca
"I had a wonderful experience in my Isis Great Beginnings class. As a new mom, there are so many joys, anxieties, and questions that come up and it was truly amazing to have a group of people going through the same experience at the same time. People from my group are spread out geographically and I remember wondering if we'd manage to keep in touch or not. In the end, we did more than keep in touch. This group of awesome momma-friends has joint birthday parties for the kids, plans fun kid outings, hosts moms' nights out…And they are the most open, honest group I know when it comes to the fun and the challenges of each parenting stage. I'm so glad we can all experience this together. I tell all my friends who are becoming parents for the first time that they have to join a Great Beginnings group." – Kara


text:
Sally Geistweidt thought she was doing a great thing. And really, she was. While her heart was in the right place though, her husband's 1970 Boss 302 ended up in a very wrong place.
The Texas Cockroach
The Texas Cockroach is a satirical newspaper from the mythical small town of LaCucaracha, Texas. In LaCucaracha, football is king, and citizens have a choice of 137 churches. The Texas Cockroach parodies the unique culture, lifestyle and politics found nowhere else but Texas. Pour yourself a tall glass of iced tea, sit back, and take a virtual stroll through the streets of LaCucaracha. God Bless Texas.


text:
Best seller.
The combination pack includes four sticker sets for the price of two. Master the blues, or use the A major scale or A harmonic minor scale to find new melodic hooks. Need to learn the names of the notes first? Don't worry, the fretboard notemap is included too.