text:
I was sitting alone in the spanking-new Rosa Mexicano dining room, finishing up my chicken enchiladita appetizer. Actually I was already done eating the two small, soft corn tortillas wrapped around succulent shreds of pulled chicken, chorizo sausage, and meaty red beans, and at the moment, using the tines of my fork, was lifting piddly amounts of the remaining mole de Xico sauce to my mouth. This deep, dark Veracruz specialty — richer, fruitier, smokier than the more common Oaxacan rendition — was riveting, with its roasted ancho, mulato, and pasilla chilies, and intimations of hazelnuts, pine nuts, raisins, plantains, chocolate, and spices. While continuing to work diligently on cleaning all traces of it from my plate, I became aware of an eerily intangible presence. At first I thought it might be the emaciated ghosts of Mexican children urging me, in their name, to finish every last drop. I got goose bumps. Then I turned around and saw a couple of impatient waiters standing by a cart that was stationed behind the table; they were looking at me the way one might stare at a homeless person as he continues to gnaw at a cleanly picked chicken bone. My main course was sitting atop the trolley, so I reluctantly placed the fork down and allowed them to make the switch.
This visit to Rosa Mexicano was spur of the moment, a matter of finding myself hungry, at dinnertime, in the downtown Brickell vicinity. I knew the restaurant had been doing well since opening just weeks earlier, but surely an establishment with a seating capacity nearing 300 would have one empty chair at 7:00 on a Thursday evening. Surely not — the hostess handed me a buzzer/flasher gizmo, wait time estimated at 20 to 30 minutes. I ambled to the action-packed bar, where bottles of spirits glow against an illuminated, rose-pedaled backdrop. There are more than 60 pure agave tequilas offered, but many patrons are partial to the signature frozen pomegranate margarita. A rocks glass of the pleasantly sweet/tart cocktail is $7.75 and packs enough punch that after I drank one, the caterwaul of the crowd crept into a background buzz. And then my buzzer buzzed.
Architect David Rockwell's spicily colored interior features Rosa Mexicano's trademark 15-foot waterfall wall patterned with cliff diver figurines and, on the other side of the room, an open tortilla-making station. It is a stylish and comfortable space (assuming you don't sit under one of the ceiling's tubalike air-conditioning vents) with a capacity of 100 (a private dining area off to the side accommodates another 55, and a pair of indoor/outdoor lounges together seat 140). There is also a formulaic sleekness to the room, a franchised feel that doesn't evoke Mexico any more than P.F. Chang's channels China. But the rapturous flavors and aromas of the food — especially the sauces — are by themselves more than capable of transporting diners south of the border.
Rosa Mexicano
900 S Miami Ave, Miami; 786-425-1001. Open for lunch Monday through Friday 11:30 a.m. to 3:00 p.m.; dinner Sunday and Monday 5:00 to 10:00 p.m., Tuesday and Wednesday 5:00 to 11:00 p.m., Thursday through Saturday 5:00 p.m. to midnight.
The waiters transported my tacos de carne asada from cart to table. The main components, juicy red strips of grilled skirt steak atop melted Chihuahua cheese, came presented in a hot cast-iron skillet with grilled scallions draped across the top. The meat was gutsily seeped in a pungent marinade of garlic, cumin, and guajillo and pasilla chilies; the cheese was mild and cheddarlike. Surrounding the skillet were numerous little dishes, each filled with some tasty treat to mix, match, and roll with the beef into soft corn tortillas: red bean–chorizo chili; creamy corn esquites tossed with scallions, chili de arbol powder, and queso fresco; and a chili de arbol salsa, whose heat barrels down the throat like a freight train. The tacos are likewise accompanied, as are all entrées, by a soup bowl each of smoothly puréed refried black beans capped with queso fresco; flawlessly cooked rice greened with fresh cilantro; sizzling, smoky pasilla de Oaxaca salsa; and green tomatillo salsa heated with herbaceous habanero. Although blessed with a hearty appetite, I didn't come close to polishing off the carne asada — and skipped dessert entirely. The bill for two courses, with tax: $26.75. Olé!
The original Rosa roused New Yorkers when it opened in 1984. The Big Apple had plenty of Mexican and Tex-Mex eateries, but Rosa's distinguished itself with a more upscale décor and much better food. It not only proffered regional specialties heretofore unsampled in the city, but also took traditional Mexican ingredients and tweaked them to accommodate modern American sensibilities (perhaps removing some passion in the process, but retaining the fire). On top of that, Rosa Mexicano was fun — especially for those imbibing the frozen pomegranate margaritas (it's worth noting that Rosa was some two decades ahead of the curve on this faddish fruit).
In recent years, the restaurant has added two more New York locations, along with outlets in Atlanta, D.C., and Palm Beach Gardens. Omar Covarrubias, born in Mexico City, is the executive chef for this latest link in Miami. Covarrubias — who formerly held the same position at the Mexican embassy in Switzerland, and is a spokesperson for Goya foods — collaborated on the menu with Mexican culinary whiz Roberto Santibañez. The selection differs slightly from branch to branch, as does interior design, but to paraphrase Gertrude Stein: A Rosa is a Rosa is a Rosa.
On a return visit, I arrived with an entourage, my plan being to blend in and thus avoid having one of the waiters point me out to the others: "Hey, there's that dork with the fork!" To be fair, I must say the staff here is friendly and functions with an impressive degree of competency.
This time we ordered Rosa's renowned guacamole, and minutes later a cart rolled up bearing a bowl brimming with knobby Hass avocados. The waiter asked our preference of heat and then went about the task of barely mashing the three Aztec elements (avocado, tomato, and chili) with onion, cilantro, and salt in a lava molcajete. Handmade corn tortillas and cleanly fried tortilla chips were served alongside the unctuous green custard. Other starters were equally satisfying, particularly zarape de pato, pulled morsels of roast duck layered between corn tortillas and bathed in a sweet, sultry yellow pepper–habanero sauce.
If you like this story, consider signing up for our email newsletters.
You have successfully signed up for your selected newsletter(s) - please keep an eye on your mailbox, we're movin' in!
The Yucatecan specialty cochinita pibil entails marinating pork shoulder in achiote, spices, and bitter orange juice; wrapping it in banana leaf; and roasting it in an underground pit, or pib. There is no pit here, and though the pork was served in a neat banana leaf boat, the meat didn't carry the herby taste of having been cooked in it. Still, the stewed pork was tartly tasty, topped with pickled onions and sided by a circle of grilled green and yellow squash perked with pineapple. No less impressive was a whole deboned roasted red snapper, the fleshy fish butterflied like an open book and piquantly painted with guajillo chili sauce. Tomatillo salsa gets freshly mashed tableside in a molcajete and dolloped atop the snapper.
Nothing beats a beer with dishes such as these; the choices here are exclusively Mexican. A limited wine list leans toward budget choices, including a category of "$25 and under." Food prices are family-friendly, too, most starters going for $7.50 to $8.50, main courses $14 to $22.50. The other Rosa locations charge a few dollars more for everything; the guacamole, for instance, is $10 here, $14 everywhere else. Appreciate it while you can, for this differential is not likely to last long.
Desserts are pretty much the same as those found at other restaurants, except with seemingly makeshift Mex twists. The ubiquitous molten chocolate cake is Hispanicized with sweet tomatillo dipping sauce. Flan is flecked with coconut. The tres Marias sundae brings a scoop each of peanut butter crunch, Mexican chocolate, and raspberry-rose ice creams accessorized with roasted pineapple, plantain, spiced blackberries, chocolate and cajeta (caramel) syrups, and whipped cream. All the ingredients melt and meld into an indistinguishably creamy hodgepodge of sweetness — which, I suppose, is the point of a sundae.
Miami folks in 2007 are in the same place New Yorkers were in '84: hungering for the clean, complex flavors that characterize real Mexican cooking. Just like back then, Rosa Mexicano comes through for its new hometown.


text:
A 25-year-old man succumbed to the head injury which he had sustained after he was hit by his co-worker with an iron rod.
According to Mangalhat police, the victim, Vikram Divaji, of Saklivadi and a worker of a plywood shop in Osmanganj, reportedly passed some objectionable comments against his co-worker Kamlesh Kumar, during an argument between them on Saturday. Out of rage, Kamlesh hit Vikram on the head with an iron rod. He suffered a grievous injury and was rushed to a private hospital where he died on Sunday.
Mangalhat police have registered a case of murder under Section 302 IPC against Kamlesh, who is said to be absconding. (INN)

subset: commoncrawl


text:
Pay-Per-Minute Viewing
You can now enjoy this movie on your iPhone®, iPad®, or compatible Smart TV & Android devices.
Purchase Options
Pay-Per-MinutePurchase Minutes
Streaming Rentals
Available MP4 sizes:SD 480p (1.94 GB)
DRM-free downloads offer content that is not limited by standard Digital Rights Management (DRM) access technologies. These technologies allow hardware manufacturers, publishers, copyright holders and individuals to limit the usage of digital content.
When you purchase DRM-free downloadable content, that content is available for you to download on any computer and save to a disk whenever you like. You can also download to multiple computers. There is no timeframe associated with your purchase and the content will not expire.
Running Time: 124 minutes
Released: 10/2010
Studio Name: Amateur Xxx Platinum Media
Series: Anal Attraction
Description: Roxy, Leigh, Holly, Jamine and most will agree that it's a happy day when the wife finally let's you stick it in her ass!! This is a series that is dedicated to the men who like it tight and the women that can't do without a good ass pounding!
4 Scenes from Anal Attraction 3
Anal Attraction 3: Scene 1 Free Preview
Starring: Leigh ... More Details
Stars: Leigh
Sex Acts: Breast Play, Anal Sex, Handjob, Masturbation, Vaginal Sex, Oral Sex
Positions: Standing Doggy Style, Side Saddle, Spoons position, Missionary, Laying, Reverse Cowgirl, Cowgirl, Kneeling, Doggy Style
Settings: Living Room
Anal Attraction 3: Scene 2 Free Preview
Starring: Roxy * ... More Details
Stars: Roxy *
Sex Acts: Anal Sex, Vaginal Sex, Handjob, Deep Throating, Masturbation, Oral Sex, Smoking
Positions: Standing Doggy Style, Standing, Standing Missionary, Sitting, Laying, Reverse Cowgirl, Kneeling
Settings: Living Room
Anal Attraction 3: Scene 3 Free Preview
Starring: Holly ... More Details
Stars: Holly
Sex Acts: Handjob, Oral Sex, Vaginal Sex
Positions: Missionary, Laying, Cowgirl, Doggy Style
Settings: Bedroom
Anal Attraction 3: Scene 4 Free Preview
Starring: Jamine ... More Details
Stars: Jamine
Sex Acts: Breast Play, Anal Sex, Vaginal Sex, Grooming, Handjob, Oral Sex, Masturbation
Positions: Standing Doggy Style, Standing, Missionary, Laying, Cowgirl
Settings: In Vehicle, Woods/Jungle
Recommended Movies
AEBN Cams


text:
your browser is out of date
To get the best experience please upgrade to a new browser
We picked up this Latina at the mall. Ryan was looking sexy eating a hot cinnamon roll by herself. Sergio took upon himself to reel this one in. After a few minutes of getting to know each other, she was ready to hit the road with us. Back at the house, she showed us how Latinas get it done. Man, this girl had a delicious Booty, and a pretty smile to drop a load on. Enjoy...


text:
Like many people on this board, I've always dreamed of owning a home in Paris. I'm curious, has anyone done this or have you considered it? To me the idea sounds very similar to owning a timeshare where you purchase 1/2, 1/4 to 1/12 ownershop. Cost wise, this *sounds* very appealing but, I'm wondering investment wise if it's a good idea? Everyone here in the USA seems to end up unloading their timeshares at a loss. I honestly don't know anyone who purchased a timeshare who would do it again! On the other hand, you could rent an apartment on a monthly basis for A LOT less than what you'd pay to own. The issue is long term, I would assume that real estate values in Paris are on the rise so perhaps it would be a good investment in the long run? Just dreaming at work and weighing my options!
Recent ActivityView all Europe activity »
- 1 HP PRINTER @ I8OO*68I*72O8 in$tallation CONTACT HP PRINTER Tec*h care 24/7
- 2 Tips for first trip to UK
- 3 Malaga Christmas lights
- 4 Devon and Dorset: Where to Base?
- 5 September in Venice, Croatia, and Slovenia
- 6 What To Do in Athens on a Sunday
- 7 Buying RER Ticket CDG-Paris
- 8 Must See/Do/Eat in Vienna?
- 9 "chunnel" to change it's offical name.
- 10 Paris, Normandy & Amsterdam with College Graduate
- 11 London vacation rental agency
- 12 The 2017-18 Ashes thread - up now on the Aussie forum.
- 13 Scotland ideas
- 14 land vs river cruise
- 15 The World's Greatest Churches
- 16 London flat feedback wanted - yes, I'm going slightly crazy!
- 17 Germany, Switzerland and Paris with teens
- 18 Italy Croatia Bosnia
- 19 Sampling Some of Sicily and Bits of Italy Beyond
- 20 Trans Siberian Train
- 21 And the winner is ...India? Egypt? no, Italy!
- 22 South of France
- 23 Czech Republic & Germany in Eleven Days
- 24 Traveling to Ukraine with a travel guide
- 25 My France Vacation
Buying an apartment in Paris - Fractional Ownership
Report Abuse
Well, before you get carried away with this (lovely) idea...you might want to get hold of the "Guides Pratiques du Logement," published by De particulier à Particulier, and read about Les Sociétés civiles immobilières, which is, I believe the French equivalent of a time share agreement. As with anything French, it's complicated. And there are those pesky inheritance laws, which befomre peskier when more than one person owns a dwelling.
Of course, it's been 16 years since I bought property in France, and maybe everything has changed. Maybe a time share is just a time share is just a time share. And maybe someone on this board who's recently bought property in Paris knows more specifically what your options are.
Report Abuse
If you do a search here, there were a couple of long threads maybe 10-12 months ago about this very topic... I know, because I have the same dream!
It's more complicated than it seems. My goal would be to have place, use it 3-4 weeks a year and rent out the rest of time using an agency.
With no intention of promoting anything, I do get a newsletter from Parler Paris, They offer seminars on buying in France, as well as a newsletter on the topic.
I will follow this thread with interest.
Report Abuse
You know I searched "Fractional Ownership" and "buying an apartment in Paris" and nothing recent turned up! I hate when that happens!
Now what I'd really like to do is sell our house here and rent an apartment then buy a home in Paris and rent it when we're not there! Now THAT would be living the dream!
Report Abuse
There was an article in the NY Times on this exact topic just a few weeks ago. I'm sure you can find that online still (pretty sure). It was much less than 1/4 ownership, I think there were about 10-12 owners of the Parisian apt.
Personally, I thought it sounded pointless. The couple in the article were wealthy physicians and said they went there once a year or more. I believe they were retired. However, the reason is sounded pointless to me was that it was exactly like a timeshare (only with no timeshare benefits of being able to go to other cities). They only had the use of the apt. for a couple weeks a year because there were so many owners (I think more than 12). So then they had to duke it out over who got certain times, I suppose -- but also, because there were so many owners, it really wasn't like your own place in many ways. The amount they paid was so expensive (to me, they thought it was cheap -- which it was in comparison to buying one) that they could easily have paid that for a very very nice vacation rental apt. or luxury hotel in Paris, instead. Then they wouldn't be tied to the legal and other problems of ownership, and could go whenever they wanted. Also, they wouldn't have to stay in the same place all the time if they didn't want to. For this couple, who was at least 65 years old, I believe, if you amortized that payment amount over say 20 years (my assumption for use), it wasn't that cheap, as I said. I think it was around $200K for this small partial share of a studio apt. in the 7th arr. and they only got the use of it for a couple weeks a year.
I just really don't understand the appeal of this at all.
Report Abuse
Report Abuse
Here's the article for discussion:
I remembered the figures a little wrong, but I did some math when I read it and did have those opinions. They paid $112K for a 500 SF studio share with about 12 people. SO they are allowed to use it four weeks a year. I figured $112K over 20 years (which is simplistic, but I'm assuming what you could earn on that invested would balance out raise in rents/fees for a vacation apt. or hotel) is an average cost of $5600 per year or $1400 a week for the time they are allowed. That's $200 a day. Now maybe it's worth it to them to pay that, but I just think the drawbacks would outweigh any advantage (such as if it were nicer than what you could rent from an agency for $200).
Report Abuse
If you are having difficulty finding info on this..try Googling "fractional ownership France" or "fractional ownership Paris" There is lots of information out there.
Report Abuse
Ive read a little about fractional ownership/destination clubs and one thing that sticks out in my mind is that it might be better to think about buying into a place run by one of the companies that would give you the option of using not just one property, but also the others in the group..that would give you a lot more flexibility. Try searching for destination clubs...
Report Abuse
Hello to everyone on this board. I am the owner of the apartments that the New York Times article on Aug. 8th was referring to and I thought it would be fair for me to clarify/ some points concerning our fractional ownership program:
1. On the difference between timeshare and fractional ownership: There's a lot of information on the Internet about this subject. For me, however, the main differences are, (1) in time share, you usually buy time, not real estate; (2) since you don't own real property, you don't have much control over upkeep and maintenance, or their cost, and often end up with either run down units over the years or overly expensive maintenance costs that only benefit the promoter; (3) Fractional properties are typically up market as you are buying into a property or unit, rather than time in a hotel room or resort.
It is general knowledge that timeshare has been a poor investment. And the reason surely must be a chronic oversupply created by developers, plus that there is no underlying property investment. It is difficult to predict what the resale market will be on the performance of fractionals, but I expect their exclusivity will prevent an oversupply developing. That is to say, as long as developers don't go down-market and market these as fractionals.
Thus, from the buyer's point of view, the best insurance against an oversupply is to buy into upmarket exclusivity. Ask yourself the question: How easily can this property be replicated? -
2. Buying versus renting: We rent vacation apartments in Paris too, so I can't say that there's anything wrong with renting. The main differences here are, (1) if you are a regular visitor to Paris, then it makes sense to buy into a fractional ownership, as you will most probably get your money back when you sell (more on that below). In other words, let's say you keep your share for 10 years, you can say "I spent one month a year in a wonderful Parisian apartment and it did not cost me a thing". In this case, rental money would be wasted money. (2) There is a psychological factor involved in having your own pied-à-terre in Paris, even if you own a fraction of it only. Over the years, you get to really know the place, the neighbors, the neighborhood butcher and boulangerie, the local market... All of which makes you feel like a true Parisian. With rentals, you are never guaranteed to stay in the same apartment every year.
3. About real estate values in Paris: These have been increasing steadily over the past few years, and I don't see any reason why they should stop doing so. Demand is bigger than supply, interest rates are low, banks lend easily, and Paris is still by far cheaper than either London or New York. Investing in fractional ownership is not normally done for purely business reasons. If you had some cash and wanted to invest it in order to secure a good return in the future, you are better off putting it in another instrument. Fractional ownership is more of a lifestyle investment. In the case of Paris, if prices continue to increase, you might not only have spent 10 years in your own wonderful apartment for free, but you might even make some return on your investment. The worse case scenario is that you sell out at a loss, but you still get some money back and your 10 years of vacationing in France will have cost you a lot less than renting or going to a hotel. Remember, you and the other 12 owners (time shares usually involve a lot more people) can sell the whole property anytime you like.
4. Concerning buying a whole apartment and renting it out when you don't use it: I get a lot of requests from people who would like us to help them buy an apartment and rent it out for them. Here's what I usually tell them: unless you are going to stay in it for at least 3-4 months, and unless you will not use the high season months for yourselves and keep some quality time for renters, and unless you are willing to put up a large sum of cash to cover your down payment and transfer tax costs; and unless you are willing to rent it out by yourselves and save on the hefty commissions you will pay to agents (30-50% is normal, which might not cover your mortgage costs), and unless you have time to attend HOA meetings and take care of leaks and maintenance yourselves and guarantee a good service to your renters, and unless you want to avoid a lot French tax and inheritance law and other legal hassles... don't buy direct.
5. Concerning the "wealthy couple" that bought into our program: They are extremely nice people who are now retired and have some disposable income to afford a share of a Parisian apartment. What they bought into was a full program, with services and amenities, plus the possibility to trade their four weeks (not two), not only with other apartments in our program (they can choose to stay with friends in a larger unit if they wish, or trade their week for another one during the year), but they can also trade any of their weeks with our property in Provence, and others to come in France. One advantage to trading with our other units is that they are sure to get same quality of interiors and service. Having said this, we are currently working on adding other trading facilities, but we want to make sure that our owners get the same quality everywhere they go.
6. Concerning the price: The starting prices that our properties are going for are 82,000 euros for the one-bedroom apartment (not a studio), and 137,000 euros for the 2-bedroom apartment. And you get a minimum of four weeks per share for each.
Using the same calculation method as was used by Christina, 82,000 euros amortized over 20 years would be 4,100 euros per year. Should you rent the same apartment for four weeks every year, you'd have to pay at least 6,000 euros. Over 20 years, you would have "wasted" 120,000 euros in rentals, whereas if you were to sell your share after 20 years, even if you were to sell it at the same price -- highly unlikely for Paris, you get your money back and you can say "this did not cost me anything -- and it was hassle-free". Obviously, there's a lot more to it than that, but I'm just using the same method you used.
Walid Halabi
Live like a Parisian… with an advantage
Report Abuse
Sorry, I've been doing lots and lots of reading since I made the original post. Thanks to everyone for your thoughts and a big thanks to WH for all the info he posted.
Report Abuse
Report Abuse
Sign in to comment.


text: One of our early concerns with NIO was its raw performance, and for good reason: In it's original JDK 1.4.0 release, performance was terrible. By the 1.4.2 release, the performance had improved (in some tests) by a factor of 3:1, and you can see in the following test output that it's "only" about 3x slower than putting data into a byte array, and "only" about 4.5x slower than accessing data from a byte array. Since there should be nothing theoretically faster than accessing data from a byte array, this is impressive, right?Read Cameron Purdy in Raw NIO Performance


text:
A couple weeks ago I took the family camping on Shell Key. Getting ready I had stopped by Bass Pro and they had a fold up fish trap. It looked cool so I bought it. I tied it to the boat and left it over night. The next day it had blue crabs in it. My kids enjoyed catching crabs to rest of the weekend. They had so much fun we would like to go and do it again. I keep the FWC reg pdf in my phone. It says 10gal whole per day. 5 traps maximum. Trap requirements apply. See page 24. The pdf is only 2 pages long so I can't read page 24. I have gone to myfwc.com and found three different places that say three different things. I want to be legal but that is becoming difficult to know for sure. So here are a few question I have:
1 It says on the package fish trap which is what I was originally wanting to catch. If a crab walks in does that make it a crab trap and have to follow crab rules?
2 One place it says you can use the fold up traps then in another it says they have to be made out of wire and have 1 1/2 mesh. One place says must be less than 1cf and another says les than 8cf. Would something like this be legal in Florida? http://www.youtube.com/watch?v=Blb6gNB9NNQ
3 We are thinking of putting out 3-4 traps by walking out in 1-2 foot of water. Sticking a post in and tieing the traps to the post. One place said the traps need a 6in buoy and another said it does not need a buoy if tied to private property. Would the post I buy be considered my property?
Thanks or any information. I have a lifetime Salt Water license and would not want to do any thing to lose it. If the traps are not legal what would the fine be? I seen where traps are not suposse to be in any marked channel. Every time I go out I am dodging traps in the channel so are traps something they just don't bother much with?


text:
A PLUS Village Other PLUS locations are Venice - Camping Alba D'Oro Florence - CampingMichelangelo Rome - Camping Roma Tuscan Coast, Grosseto - Camping Le Marze Amalfi Coast- Camping Santa Fortunata We are situated in the beautiful heartland of Chianti, home of all that famous red wine that you either drink or have heard about. The village is about 30 minutes from the centre of Florence or alternatively you can catch the local train or Eurostar from Florence (1/4hr) or stop at Figline Valdarno on the way to Florence from Rome. PLUS is an ideal stopover for backpackers, cyclists, walkers, individuals, groups and those that enjoy the great outdoors. Camping Village Norcenni is part of the PLUS chain of camping villages located in Rome, Venice, Florence and Sorrento. PLUS offers accommodation and activities to suit the need of every traveler.The Village, with its 300 beds in 2/3 private or shared brand new rooms with or without bathroom, is instantly recognizableby its brand name backed up by a reputation for good quality, en suite accommodation, cleanliness and a safe comfortable environment. Relax after a hard day's sightseeing, by our swimming pool, south those acing joints with a massage in our fitness centre, or just relax over a drink with your mates in one of our bars overlooking the panoramic Tuscan hills. Later on gorge yourself on some of the finest Italian food in Italy in our restaurants or take away one of our mouth watering pizzas. In the summer, we run daily trips to Florence, Sienna, San Gimignano, Pisa, Lucca as well as wine tasting in the Chianti area. Come stay with us and discover the beauty of Florence and the Tuscan Hills. Plus staff wish you an unforgettable holiday in Florence…. Not the only backpackers place to stay in Florence… but definitely the best!!Linen is not included, but can be hired for a small charge. During season, from 12 March until 31 October, we arrange a free pick-up at 6,40pm from the Figline train station upon arrival. Take the 6,09pm train from Florence towards Foligno and get off in Figline, the 2nd stop. From Rome, take the 3,14pm train, from Arezzo 5,50pm, which arrives in Figline at 6,27pm. The shuttle bus will leave just outside the bar (across the Metropolis building). Every morning and every afternoon, there is one free shuttle to bring you to and from the station. Should you arrive later please call us so we can either pick you up ourselves, or call you a taxi. By car it takes ½ hour getting into Florence depending on traffic. By Train the fast train takes ½ hour. By local train one hour as this train stops in all stations. If you book non en suite accommodation, you are booking a bed in pretty two person house tents which are equipped with very comfortable beds. Blankets and pillows are included in the price. Bed linen and towels can be hired at reception. Please note that check-in time from 1 November till 12 March is only until 7.00pm! After that you can not check in until 8.00am the next morning.
Via Norcenni 7, Figline ValdarnoCP:50063,Florencia,Italia
Teléfono:No especificadoFax:No especificado


text:
SCT-ISLEOFMULL-L ArchivesArchiver > SCT-ISLEOFMULL > 2002-09 > 1032111970
Subject: Cameron, Currie/Curry, Clow and McDougall of Mull
Date: Sun, 15 Sep 2002 13:46:10 EDT
Apologies, my previous email failed to send its attachement - so i have
pasted it in.
Dear All,
I have recently joined the list and am amazed by all that is going on. So I
thought I'd widen my query to see if anyone can help me with my other names
(Clow, Curry/Currie and McDougall.) I have the following info (please feel
free to use it or add it to exisitng info). Thanks to all who have responded
to my Cameron call and I'll look forward to seeing what this one brings in.
Can anyone help with the parents of Jannet Curry (also spelt Janet and
She was born ABT 1779 in the Parish Of Torosay/Kinlochspelve. I am also
searching for the parents of Allan Cameron born ABT 1780. Allan Cameron and
Jannet CURRY married and had 8 children (Listed below). I would also like to
get their date of marriage and death dates fort them and their children.
1. Ean CAMERON was born 1799 in Parish Of Torosay/Kinlochspelve, Argyll
2. John CAMERON was born 1799 in Parish Of Torosay/Kinlochspelve, Argyll
3. Duncan CAMERON was born 1802 in Parish Of Torosay/Kinlochspelve, Argyll
4. Archibald CAMERON was born 15 MAR 1804 in Parish Of
Torosay/Kinlochspelvel, Argyll,
5. Duncan CAMERON b: 1804 in Parish Of Torosay/Kinlochspelve, Argyll
6. Anne CAMERON b: 1806 in Parish Of Torosay/Kinlochspelve, Argyll
7. Allan CAMERON b: 1808 in Parish Of Torosay/Kinlochspelve, Argyll
8. Samuel CAMERON b: 1811 in Parish Of Torosay/Kinlochspelve, Argyll
Assume that the first Duncan died. Asume that Duncan 2nd and Archibald are
twins and that Ean and John are twins, but may simply be English and Gaelic
Jane Waddell and Dougald/Dougal McDougall
Jane Waddell married Dougald McDougall on the 6th June 1828. Dougald
McDougall was a shoemaker. I am not certain, but wondered if Dougald or his
family came from Mull. So would be delighted if anyone can help with that.
Children of Jane Waddell and Dougald McDougall are:
1. BARBARA C. MCDOUGALL 27 DEC1830 in Glasgow Lanark
2. JEAN CRUM MCDOUGALL 31 MAY1833 in Glasgow Lanark
3. CATHERINE MCDOUGALL 5 APR1837 in Glasgow Lanark
4. Rachel Bates McDougall who was born 1848 in Glasgow Lanark
Allan Cameron & Rachel Bates McDougall
Allan Cameron married Rachel Bates McDougall the 5th of March 1867 at 51
Clyde Street Port Dundas, Glasgow. He was 27 years old and she was 19 years
old. Allan was a Wood Sawyer and Rachel was a Milliner. Allan's residence
was 26 George Street Glasgow and Rachel's 5 Glassford Street Glasgow. Allan
was a widower (as yet we have been unable to trace his first wife or if there
were any children by this marriage). The witnesses were Robert Whyte and
Barbara C. McDougall, her sister. Rachel McDougall who was born in 1847/8.
Her parents were Jane Waddell and Dugald McDougall.
Children of Allan Cameron & Rachel McDougall are:
1. Allan Cameron born 1875
As yet unable to trace others
Has anyone come acros any Clow's on Mull?
thansk liz
This thread:


text:
Your donations keep RPGWatch running!
7 Days to Die - Alpha 1.1 is Available to Download
by Couchpotato, 2013-09-19 00:27:01
Alpha 1.1 is now available to download and play for backers of 7 Days to Die.
Howdy Survivalist,
We have a brand spanking new shiny Alpha 1.1 release ready for your enjoyment. The release includes Mac version support, more dedicated server options and many bug fixes. So like my Grand Pappy use to say what's good for goosing is good for taken a gander at or something like that!
So why don't you head on over to our new Customer Portal and login to download it. Don't forget if you had Alpha 1 then all you need is the 1.1 patch. And remember folks Alpha 1.1 is not compatible with Alpha 1 servers.
Newsbit options: Add / View Comments (0) | Forward this newsbit | Link to this Newsbit
Information about7 Days to Die
SP/MP: Single + MP
Setting: Modern
Genre: Shooter-RPG
Platform: PC
Release: In development


text:
Federal officials Friday released a draft plan to protect habitat for greater sage grouse in parts of the Northwest. Sage grouse numbers have been dwindling as their habitat decreases.
The Bureau of Land Management has released six options for protecting sage grouse habitat in eastern Oregon. The least restrictive option would impose no new steps to protect the sage grouse, beyond current measures, such as habitat restoration. The most restrictive option would curtail livestock grazing on millions of acres of public land. Idaho also recently released draft plans for protecting the sagebrush landscape where the birds roam there. The greater sage grouse in Washington are farther apart from other populations, so they are not a part of this plan. An agency spokesman says one goal of the new plan is to help keep the sage grouse off the Endangered Species List. The public will have 90 days to comment on the draft plans. The bureau will hold public meetings in Oregon and Idaho.
Copyright 2013 Northwest Public Radio


text:
Medial Sphenoid Wing Meningioma
by Robert G. Ojemann, M.D.
Stephen B. Tatter,M.D., Ph.D. ,
HTML editor
In the
last issue of this Newsletter, I discussed tuberculum sellae meningiomas
which arise in the midline of the skull base from the region of
the tuberculum sellae and planum sphenoidale In this issue we move
laterally to discuss medial sphenoid wing meningiomas.
meningiomas involve the region of the anterior clinoid, adjacent
medial sphenoid wing, superior orbital fissure, and cavernous sinus
(Fig 1). They may grow into the orbit. As the tumor becomes larger,
it may encase the internal carotid and proximal middle and anterior
cerebral arteries. The optic nerve may be compressed or be surrounded
by tumor. Large tumors put pressure on the frontal and temporal
lobes and provoke edema in the adjacent brain tissue resulting in
neurologic deficits or seizures.
resonance imaging (MRI) outlines the extent of the tumor and shows
the relationship to the arterial structures (Fig 2). It is often
hard to define the optic nerves and chiasm. Angiography may be needed
to determine the extent of encasement of the internal carotid artery
and its branches and determines the blood supply to the tumor. Embollization
of external carotid artery branches is occasionally indicated prior
to operation.
The treatment
decisions are often difficult because symptoms may be mild, the
natural history is variable with some tumors having a very indolent
course, the long-term results of microsurgical radical resections
that have been proposed and the newer radiation therapy modalities
(single dose radiosurgery or fractionated radiotherapy programs)
are unknown.
However, some general guidelines for
the treatmeni of these tumors can be outlined. For those with mild
or non-progressive symptoms, it may be appropriate to follow the
patient with periodic MRI and examination to determine if the lesion
is growing and to see whether the symptoms are significantly interfering
with the pafient's life. The indications for surgery in younger
patients are worsening symptoms and/or growth seen on follow-up
scans, and in older patients a large tumor with worsening symptoms.
Radiotherapy is used in older patients with small and medium size
tumors with worsening symptoms and for regrowth after subtotal or
radical subtotal removal.
For most patients, a lateral subfrontal
and anterior temporal exposure is used. Internal decompression of
the tumor is done staying away from the region of the internal carotid
and middle cerebral arteries. Some soft tumors can be more easily
removed than very firm, hard tumors. The distal branches of the
middle cerebral artery are identified and followed to the tumor
capsule to determine if it is feasible to dissect them. In some
situations arachnoid planes help in separating the tumor from and
around the encased arteries. At some point, the relationship of
the optic nerve and chiasm to the tumor is determined.
In my series of 16 patients treated
over a 15 year period, there were 12 females and four males ranging
in age from 28-79 years with two over 70 years of age. In no patient
could I be absolutely sure of a total removal of the tumor because
of involvement of important arteries and/or cranial nerves or the
extension of the tumor into the cavernous sinus or orbit. However,
15 patients have had a good result. One patient had a postoperative
intracerebral hemorrhage two weeks after surgery and has a permanent
dysphasia and hemiparesis.
In 10 patients no radiation therapy
has been given and on follow-up scan there is no change in their
tumor over a period of 2 to 14 years (mean 7.2 yr) after operation.
Six patients were given radianon therapy, two immediately after
operation and four when there was evidence of recurrence. Two of
the patients with recurrence had reoperation and then radiation
therapy to the small residual tumor Following radiation therapy,
five patients are stable and one has shown slight growth over a
follow-up of 2-13 years (mean, 5-6 yr).


text:
Waiting games bring the greatest reward
We're losing time. We're so afraid of wasting it we're forgetting what it actually means. Time's money; you just kinda wasted my precious time: the more tight-fisted we are with our time the less we appreciate the things that can only be revealed and understood by time's vast expanses.
Big, big projects offer something that no snappy phrase, no catchy song can ever get close to — the enormous books: Proust, Tolstoy, Joyce; the great oratorios. They're all works that need commitment, need your unforced offering of your own time. And so you learn that with time comes depth.
It's also true in sport. The beauty of the snooker World Championship is time. The final lasts two days — it finishes today — and is the best…


text:
Its been very long that i have posted anything on this board now. Perhaps you will never find any of my post from past two months or so. Missed this board quite a lot. Did any one realize though.
But I am back for help again people. Hope some body can help me in this. I am in the process of writing my final year project report. I am pretty stuck on methodology chapter. The crap thing which my university lectures expects me to document in the dissertation. Anyway, I have followed Xterm programming in my project. But I need to justify why I used it for my project. Since the project is based on embedded system I believe it was more relevant. But I cant just say that.
If it was something like an OOP then I could have followed with standard approach such as water fall or something perhaps used UML. But I am using C and its modular approach. What methodology would be more relevant for modular project like what I have now.
Or how would you justify xterm programming is more appropriate for embedded programming project.
Thanks a lot


text:
|Publication number
|Publication type
|Application number
|Publication date
|May 29, 2001
|Filing date
|Apr 30, 1998
|Priority date
|Apr 30, 1998
|Fee status
|Publication number
|Yi Fang, I-Lung Kao, George Conerly Wilson
|Original Assignee
|International Business Machines Corporation
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (18), Non-Patent Citations (3), Referenced by (99), Classifications (8), Legal Events (6)
|External Links: USPTO, USPTO Assignment, Espacenet
1. Technical Field
The present invention relates generally to accessing heterogeneous networks and reducing costs by increasing productivity for end-users and system administrators in an enterprise computer environment.
2. Description of the Related Art
With sprawling client-server systems growing daily, applications and information are spread across many PC networks, mainframes and minicomputers. In a distributed system environment connected by networks, a user must access many database systems, network systems, operating systems and mainframe applications. To use these systems and applications, the user must issue separate sign-on commands for each specific system or application. Indeed, it is not unusual for a user to encounter ten or more different login sessions during a working shift, and these often are different interfaces with different userid and authentication information, usually passwords. This places the user under a significant burden to remember and maintain this information.
It would be quite beneficial to provide a single sign-on (SSO) tool to enable authorized users to perform one initial sign-on to access a variety of networks, systems and applications. A single sign-on system should provide secure storage of user passwords, support for more than one user password, as well as support for multiple target logon methods. Each of these issues present varying design considerations.
With respect to the first issue, there are multiple approaches to storing and managing passwords. One approach is to use the same password for all accessible systems/applications. This technique may weaken system security, however, because a compromised password in any of the systems or applications compromises the user's privileges on these systems and applications at the same time. Further, different sign-on mechanisms may have their own distinctive password requirements and, thus, it is problematic to use the same password for multiple targets.
Another approach to storing and managing passwords is password-mapping, which refers to using the user's primary password to encrypt all the user's secondary passwords. The encrypted passwords are stored in a local storage space accessible to the user (e.g., a local file, a readable/writable smartcard, and the like). Once the primary password is verified, the local system authentication module obtains the passwords for other sign-on systems and applications by decrypting the mechanism-specific encrypted password with the primary password. The security of this password-mapping scheme assumes that the primary password is the user's strongest password, and it also depends on the security of the local storage for the secondary passwords. If secondary passwords are stored in an untrusted publicly accessible machine, an intruder is provided with opportunities for potential attacks. Moreover, although this approach is simple, the password file must be moved from machine to machine by the user to logon to more than one machine.
The target logon alternatives also influence the single sign-on system design. In particular, the method used for storing a user password heavily influences the design of target logon code. It is known to embed passwords in target specific logon scripts. This is how many "homegrown" single sign-on systems work today. This technique is the least extendible design because it ties passwords (and logon target code) to each machine the user uses. It is also hard to maintain passwords in this design because passwords need to be changed both in the applications and in the logon scripts. For a mobile user, the scripts need to be present on all machines the user might use. The overall security of this approach is thus very weak.
Another target logon alternative involves building in all the logon methods for every possible target to which any user may desire to logon. This "hardcoded" approach assumes that all workstations and applications are configured similarly and do not change. Because the logon methods are built into the solution, changes made to the logon methods require changes to the actual solution itself. This approach is costly and also is not very extensible.
These known approaches to secure password storage/management and target logon have yet to provide an adequate single sign-on solution. The present invention addresses and solves this problem.
The present invention implements a single sign-on (SSO) mechanism that coordinates logons to local and remote resources in a computer enterprise with preferably one ID and password. A particular object is the provision of a master key to synchronize a set of SSO servers. The master key is generated automatically by one server machine and pulled as needed by other SSO servers.
The SSO framework supports storage of all passwords and keys belonging to a user in secure storage (e.g., either in local storage, a centralized password service, a smartcard, or the like), so that the user needs to remember only one ID and password. Upon authentication, the SSO mechanism securely retrieves all the passwords for a user from the secure storage and automatically (i.e. without additional user intervention) issues sign-ons to each system/application the user is authorized to access.
The system framework preferably includes a number of modules including a configuration information manager (CIM), which includes information on how to logon to the applications configured on a given machine, a personal key manager (PKM), which includes information about users, systems and passwords they use to logon to those systems, and a logon coordinator (LC), which retrieves the user's passwords from PKM and uses them in conjunction with target-specific logon code to log users onto all their systems, preferably without any additional user intervention.
The SSO framework implements a "data model" where information used to sign on to applications is kept in the separate PKM and CIM databases. The PKM is globally accessible and stores user-specific information, and the CIM is locally accessible and stores application-specific information derived from PTF files. In operation, the logon coordinator (LC) accesses the PKM to obtain the user's information (e.g., which target systems and applications to which the user can sign-on), as well as the passwords and keys for those systems/applications. The LC then uses these passwords/keys, together with the target logon information found in the CIM, to sign-on to various target systems and applications. Sign-on is preferably based upon the target's own protocols and mechanisms as defined in the PTF.
The invention describes a method of sharing a master key across a set of servers operating a single sign-on (SSO) mechanism in a distributed computer network. The master key is useful for encrypting user passwords for storage in a globally-accessible registry. The method begins by establishing in the registry a group identifying which of the servers in the set, if any, have a copy of the master key. At a given server, the method continues by determining whether a copy of the master key is stored at the given server and whether the group has at least one member. The master key is then generated at the given server if a copy of the key is not stored at the given server and the group does not have at least one member. Other servers in the set pull the master key as needed.
The foregoing has outlined some of the more pertinent objects of the present invention. These objects should be construed to be merely illustrative of some of the more prominent features and applications of the invention. Many other beneficial results can be attained by applying the disclosed invention in a different manner or modifying the invention as will be described. Accordingly, other objects and a fuller understanding of the invention may be had by referring to the following Detailed Description of the preferred embodiment.
For a more complete understanding of the present invention and the advantages thereof, reference should be made to the following Detailed Description taken in connection with the accompanying drawings in which:
FIG. 1 is a computer enterprise environment in which the present invention may be implemented;
FIG. 2 is a block diagram of the main functional components of the inventive single sign-on (SSO) mechanism;
FIG. 3 is a representative single sign-on transaction according to the present invention;
FIG. 4 is a representative logon interface screen for the SSO transaction of FIG. 3;
FIG. 5 is a representative GUI screen identifying the systems/applications for a particular user;
FIG. 6 is a high level illustration of the operation of the logon coordinator (LC) of the SSO mechanism;
FIG. 7 is a flowchart illustrating the LC operation;
FIG. 8 illustrates how the logon coordinator performs a matching operation between PKM and CIM entries;
FIG. 9 is a flow chart of a change password operation;
FIG. 10 is a block diagram of a representative multiple SSO server implementation and a DCE Security Registry for supporting the PKM data model;
FIG. 11 is a flowchart of a method for distributing and synchronizing a "master key" in the multiple SSO implementation of FIG. 10; and
FIG. 12 is a flowchart of a method for changing the master key.
FIG. 1 illustrates a portion of a distributed computer environment domain 10 in which the present invention may be implemented. The signal sign-on (SSO) mechanism comprises both server 20 and client (runtime services) components 14, 16 and 18. For purposes of illustration, each of these are illustrated as a computer. It is also assumed that system users log onto the domain via client machines in a known manner.
Preferably, the server and client services components of the SSO mechanism are implemented in a computer or "machine". For example, each server may be a RISC System/6000� (a reduced instruction set or so-called RISC-based workstation) running the AIX (Advanced Interactive Executive) operating system, preferably Version 4 or greater. Alternative servers include machines running Sun Solaris V 2.5.1 or Microsoft Windows NT 4.0.
Each client machine in the domain may be a computer such as a desktop machine or laptop. A typical client machine is an Intel x86 or Pentium�-based computer running Windows '95 or greater operating system. Alternatives include machines running OS/2� Warp 3.x or higher, or a Microsoft Windows NT workstation. Each client workstation typically supports TCP/IP and may include a network operating system (NOS). A typical client is a Novell Netware client (for Netware logons), an OS/2 LAN Server client (for OS/2 LAN Server logons), an OS/2 Warp Server client (for OS/2 Warp Server logons), or the like. These examples, however, are merely representative and should not be construed to limit the invention in any way.
Many different types of target systems/applications are accessed using the single sign-on mechanism. These include distributed applications, databases, printers, and other resources throughout the enterprise. Representative systems and applications include, without limitation: 3270 and 5250-based applications, IBM OS/2 Lan Server 4.x and OS/2 Warp Server, Novell Netware 3.x and 4.x, Microsoft NT 4.0 Server, Databases (e.g., DB2, Oracle, Sybase, Informix, MS SQL Server), Lotus Notes 4.x, PeopleSoft applications, DCE applications written to conform to The Open Group (formerly known as the Open Software Foundation), and other applications. These examples, again, are merely representative.
FIG. 2 illustrates the main components of the inventive single sign-on (SSO) mechanism of the present invention. They preferably include an authentication module 21, a configuration information manager (CIM) 22, a personal key manager (PKM) 24, and a logon coordinator (LC) 26. In general, the authentication module 21 authenticates a given user to the remainder of the single sign-on (SSO) mechanism. On systems with local operating system security, the authentication mechanism 21 usually is integrated with the local OS authentication. The authentication module preferably supports different authentication mechanisms (e.g., secret key, smartcards, public/private key, and the like).
The configuration information manager (CIM) 22 includes information on how to logon to the applications configured on a given machine. Preferably, a CIM is supported on each client machine from which the SSO mechanism is provided. A given CIM typically is not globally accessible from other machines on the domain. Information in the CIM preferably is formatted according to a program template file (PTF) 25, as will be illustrated below in more detail. The CIM thus stores "configuration directives" identifying the given logon process and the methods required to access a particular application on the target resource. New logon methods may be added using the PTF mechanism as will be seen.
The PKM 24 contains information about users, systems and passwords they use to logon to those systems. Preferably, PKM 24 is a secure, globally accessible repository that facilitates the single sign-on process. Although not meant to be limiting, with respect to a given user, the PKM (as will be described) preferably stores such information as a username, a set of one or more password(s), and any other application environment-specific information such as domain name, hostname, application name, and the like. Because this access information preferably is centralized in the PKM, users can access their target resources with one sign-on from any workstation. They can also manage their passwords from this one repository, as will also be seen.
To this end, the logon coordinator 26 functions generally to retrieve the user's passwords from the PKM and uses them in conjunction with the target specific logon code (identifiable from the CIM entries) to log users onto all (or some subset of) their systems, preferably without any additional user intervention. As will be described in more detail below, the LC also preferably maintains state information for a given user and application, called a "user target", to help coordinate and execute future operations.
According to the invention, the single sign-on mechanism preferably uses a "data model" where information used to sign on to applications is kept in two separate databases. The first database is the PKM 24, which is preferably a global database and is thus accessible from all client machines in a given domain. The PKM 24, as noted above, keeps user configuration information. The second database in the CIM 22, which is preferably a local database and is thus accessible only from the current client machine. The CIM need not be merely a local database, however. Each client machine from which the SSO support is provided runs a CIM. Thus, multiple instances of CIM 22 are illustrated in FIG. 2. Likewise, each client machine preferably also runs an instance of the logon coordinator 26.
Thus, for example, the PKM 24 contains user-specific application data which includes:
Target name—uniquely identifying a user "target"
Target type—specifies what type of "application" this target is;
Domain/Host/Application name—specifies application information, specific for this target;
User ID—specifies user id on target;
Key information—specifies the user's key (password) on the target;
User preferences—specifies user specific information for this target; and
Preferred program name—specifies a preferred PTF entry to use with this target.
The personal key manager 24 enables a given SSO user to manage all the passwords the user possesses in a secure and effective manner. According to the invention, each application, server, or system to which a user needs an ID/password pair to logon is defined as a "target". Using a GUI interface, the user creates a target in PKM corresponding to each real target to which the user can logon, and the user may create as many (or as few) targets as the capability of a specific PKM implementation allows (or that the user desires). Independent of any implementation, a generic PKM application programming interface (API) preferably is used by the SSO framework to create a new target, to update a target's data, to query a target's information (with or without passwords), and to delete an existing target.
The second database, the CIM 22, preferably contains entries derived from the program template files (PTFS). This database contains application (i.e. program) specific information, which includes (for example):
Target type—specifies what type of "application" the program is;
Default target—indicates if an entry is the default of a given type;
Specific application information—describes interfaces needed to perform operations like logon, logoff, and the like;
Program Preferences—indicates timeouts and retry counts; and
Interface directory—client-specific information on how to locate the application interface code.
The expected runtime flow of a user interacting with the single sign-on (SSO) mechanism is illustrated in FIG. 3 and described as follows. At step 1, a user either logs in to a local operating system (if required by the local operating system) or logs on via a logon interface (if local logon is not required by the operating system). A representative logon interface screen is illustrated, for example, in FIG. 4. The user's local logon enables the authentication module (GSO Auth) on the local machine (if supported) to authenticate the user (step 2) to the authentication service that is integrated with the password storage service.
A successful authentication triggers the single sign-on graphical user interface (GUI) to display (at step 3) the systems/applications the user is able to logon to and the status of the logon process. A representative GUI screen display is illustrated in FIG. 5. The GUI also calls the logon coordinator on the local machine (at step 4) to retrieve the user's configuration information and target configuration information. As described, the logon coordinator gets the user's information (which target systems and applications the user can sign-on to) and the passwords and keys for those systems/applications from the personal key manager. If the personal key manager is implemented as a remote service (or if the necessary information is located remotely), the personal key manager client (at step 5) gets the information in a secure fashion (i.e. the passwords/keys are encrypted for transmission). The credentials returned from the authentication module are used by the personal key manager client to ensure that the user who logged on to the mechanism is the user who retrieves the passwords.
The logon coordinator (step 6) then uses these passwords/keys and the target logon information found in the configuration information manager (CIM) to sign-on to various target systems and applications, based upon the targets' own protocols and mechanisms. The logon coordinator preferably provides status information about the state of the logons and also allows some targets to be launched asynchronously (after the initial sign-on processing has completed).
This mechanism allows for different passwords for different target systems and applications without requiring the user to remember all such passwords. The user remembers only one password to log into the mechanism, which then performs the subsequent logging into the different system by acquiring the secret keys from the secured key manager (local or remote). This SSO mechanism enhances security as well as ease of use. It also enables the user to access existing systems without having to create or to modify existing user definitions on those systems. As will be seen, the mechanism also allows a user to change his or her single sign-on password without requiring changes of the target keys/passwords or vice versa. Target password changes can be made to one or more selected target systems.
FIG. 6 is a high level illustration of the operation of the logon coordinator 26. FIG. 7 is a flowchart illustrating one preferred single sign-on method, which may be suitably implemented in a computer program. The routine begins at step 40 when a user 30 (at a workstation 32) requests a logon to a given application (Target 1) 33. In response, the routine continues at step 42 with the logon coordinator 26 issuing a query to the PKM 24 for the information regarding the user's "key" (which, as described above, may include the username, password, and any other application environment-specific information as described above). At step 44, the information is returned to the logon coordinator. Then, the routine continues at step 46 with the LC issuing a query to the CIM to obtain the target information. At step 48, the target information is returned to the LC. The information retrieved from the CIM 22 for the particular application determines how to logon to the application (e.g. what type of invocation to make, what actual invocation, and the like). At step 52, the logon coordinator 26 substitutes given data received from the PKM into substitution variables in the invocation strings returned from the CIM. In particular, the logon coordinator performs a matching operation; for each PKM target entry, the coordinator determines whether there is a corresponding CIM entry. If so, step 52 binds the two entries together. This is illustrated in FIG. 8. At step 54, the logon coordinator 26 invokes the logon method(s) defined by and stored in the CIM. This completes the processing.
Generalizing, the logon coordinator (LC) thus takes the data from the personal key manager (PKM) and the directives in the PTF and interprets the data, together with current state information, to perform a given action. Such action is carried out with respect to the users' systems and applications and includes, for example, a logon operation, a change password operation, or a logoff operation.
If the user requests a change password operation, the LC makes the correct invocation to change the password and coordinates the password update in the PKM. Continuing with the above-described example (involving Target 1) a representative flowchart of this function is illustrated in FIG. 9. By way of brief background, the logon coordinator preferably maintains state information for a given user and application, a "user target", to help coordinate and execute future operations. By looking at the current state of a user target and interpreting data in the PKM entry and the PTF, the LC can determine which operations are required to satisfy an SSO request. For example, the PTF can specify that a user should be logged on to an application before performing a change password operation. Therefore, the LC would keep track of the logon state of a user target to determine what operations are required to satisfy a change password request. If the user were not logged on to the application, the LC would perform a logon operation and then perform the change password operation.
The flowchart of FIG. 9 is illustrative of the process. The routine begins at step 60 when the user desires to change a password for his/her Target 1. At step 62, the routine gets Target 1 information from the PKM; here, the target type is App1. The routine then gets the corresponding program of the given type from the CIM at step 64. A test is then performed at step 66 to determine whether the user has to be logged on to change his/her password. If not, the routine continues at step 68 and the user password is changed. If, however, the outcome of the test at step 66 is positive, a test is performed at step 70 to determine whether the user is logged on. If the outcome of the test at step 70 is positive, the routine branches to step 68; otherwise, the user is first logged on at step 72. This completes the processing.
A combination of the data model described and the LC implementation thus provides "free seating" support. Free seating means that the user does not have to specify a particular program on the client when using the SSO mechanism to log onto a particular target. The free seating method allows the user to install any program on his or her client machine and then have the logon coordinator pick the appropriate one to logon to the target. The LC preferably does this by examining the "target type" associated with the programs on the client and with the target the user is trying to access. If the program has the same target type as the target, then the LC knows it can use that program to access that target. This means that the user can logon to a target if any program on the system matches the target type, rather than needing a fixed program to do the logon.
For example, a user may have a target "HOST1" of type "3270 Emulator." On the machine on the user's desktop, the user may have the "telnet3270" program, which is of the type "3270 Emulator" available to logon to HOST1. On the user's laptop, the user may have the IBM Personal Communicator program available, which is also a 3270 Emulator, to logon to that target. When the user uses the SSO mechanism on the desktop machine, the LC will use telnet3270 as the 3270 Emulator to logon to HOST1; on the laptop, IBM Personal Communicator will be used. These examples, of course, are merely representative of the inventive free seating support concept.
The generic PKM data model described above may be implemented in many ways including, without limitation, DCE client/server, a real smartcard, a soft (disk-based) virtual smartcard, or the like. One advantage of using an implementation-independent PKM API as described herein is that different mechanisms may be pluggable without any modification to other SSO application programs. Moreover, multiple mechanisms can be configured on one machine and a user has the option to choose a specific one.
A representative PKM is implemented in a known DCE Security Registry architecture conforming to The Open Group DCE Standard. Familiarity with DCE security mechanisms is presumed in the following discussion.
FIG. 10 illustrates the basic PKM architecture, which may be distributed across multiple machines in the domain. In particular, it is first assumed that multiple SSO servers 100 a-n are configured and running in the domain. Multiple PKM servers are replicated on different machines, e.g., for performance and scalability. Each server preferably performs the same functions. Thus, preferably there is no master/slave relationship among them. As also seen in FIG. 10, user specific target configuration data and target passwords (together, PKM data) of sso users are stored in a database 102, which may be the DCE extended registry database (ERA). When the PKM server modifies data in the master registry, data consistency between the master and slave registries is achieved automatically by the data duplication mechanism in registries. However, no encryption facilities are usually provided by the registry for data stored in ERA. To avoid target passwords being revealed to DCE administrators (or others), the password field is preferably encrypted with a master key managed by the PKM server, before the whole target is stored in the database. Further, because multiple sso servers can be configured for load balancing, a local copy of this master key preferably exists in each one of sso servers. The master key thus is generated automatically by one server machine and "pulled" as needed by other servers when they are up and running. A simple "group" mechanism provided by DCE (or some other similar mechanism depending on the architecture implementation) is used to tell which servers possess the valid master key.
Further, because multiple sso servers can be configured for load balancing, a local copy of this master key preferably exists in each one of sso servers.
The use of a master key is advantageous even if ERA 100 provides facilities to encrypt data. A main advantage is performance, because only the password field, not all other user configuration fields, in a target actually needs encryption. Using a master key outside of the database mechanism (registry) affords flexibility to protect only the fields that need encryption. Moreover, the protection level used in the existing DCE RPC service 104 to store/retrieve data between ERA and sso servers only needs integrity, rather than privacy, if passwords are already encrypted before they are sent through the RPC service.
The inventive mechanism provides automatic master key distribution from one SSO server to another as described below and as illustrated in the flowchart of FIG. 11. Furthermore, the master key preferably is allowed to change, as initiated by sso administrators who have concerns about possible key exposure. Once a new master key is generated on one server and all the target passwords in ERA are reencrypted, all other sso servers will contain invalid master keys. Therefore, according to the invention, master keys are resynchronized among all existing servers after the master key is modified.
This is achieved as follows. At step 110 in the flowchart, a "group" is defined in the registry to record which sso servers contain valid master keys. The principles of using this group and the action each sso server takes depending on the content of this group (called "keyedservers") are elaborated below.
At step 112 the first server is configured and started to run. At step 114, the first server performs a test to detect where it already has a master key copy locally and whether there exist any members in the keyedservers group. If the answers to both detections are "no", the server assumes it is the first server to be configured. The routine continues at step 116 with the first server generating a master key locally. At step 118, the first server puts itself in the keyedservers group established at step 110. The server then starts to use the master key (at step 120) to encrypt all the target passwords.
The routine then enters a process loop for another server. Thus, for example, a test is done at step 122 to determine whether a second server is configured. If not, the routine cycles. If the outcome of step 122 is positive, the second server performs a similar detection scheme (like the first server) at step 124. Because the first server has a master key, the outcome of the test at step 124 is positive. In other words, this second server finds there already exists a member in the keyedservers group, and it thus knows the master key has already been generated by this member of the group (the first server). The second server then continues at step 126 by sending a request (e.g., through an internally-defined RPC) to that member server to retrieve the master key. At step 128, the master key is returned. The retrieved master key is then stored locally in the second server at step 130. All the other servers configured after the first one perform the same actions. When any server is unconfigured as indicated at step 132, it destroys its own local copy of the master key at step 134 and removes itself from the keyedservers group at step 136.
FIG. 12 is a flowchart illustrating a master key change routine. It begins at step 140 when the master key is to be changed, e.g., due to security concerns. At step 142, all the servers are stopped. At step 144, the server on which the sso administrator operates decrypts all target passwords in ERA 102 with the old master key. A new master key is generated at step 146, and this new master key is then used to reencrypt target passwords at step 148. The server then removes all server members from the keyedservers group at step 150 and, at step 152, puts itself in the group (because it is now the only server with a valid master key). When other servers are restarted, they will not detect themselves in the keyedservers group (as described above) and then know their current local copies of the master key are no longer valid. They then retrieve the new master key from the server member in the group, and use it to replace the old master key as described.
The master key thus is generated automatically by one server machine and "pulled" as needed by other servers when they are up and running. A simple "group" mechanism provided by DCE is used to tell which servers possess the valid master key.
The PKM data model elements were described above. The groups preferably include: target name, target attributes, key information, user configuration and target class. The target name is the identifier used to distinguish a target from other targets. The target attributes include target type, domain/host/application names and target user name. The key information contains the password of the user for the target and the type of the key derived from the password (e.g., a public key, a secret key, or the like). The user configuration is the user's own configuration preference when the user logons to and logoffs from the target. The target class defines whether the target is a password-based target or a passticket-based target. If it is a passticket-based target, a passticket-protected (e.g., RACF) application server's name must usually be specified. The above-described generalized data model enables all kinds of targets to be defined through the PKM API. Thus, in certain circumstances, not all the fields/attributes may have values for each target because only a subset of attributes may be sufficient or meaningful for defining a specific, real target. In addition, because a passticket for a protected server is dynamically-generated on demand, no password is required to be stored with a passticket-based target.
PKM is preferably implemented as a client/server application in a distributed computing environment (e.g., Open Group DCE) as described above. The PKM server preferably implements all PKM functions. In this illustrative DCE implementation, all target data is stored in DCE registry's ERA and the server accesses the data on behalf of each user on a client machine. Therefore, the PKM API is mapped to a set of remote procedure calls (RPCs) on each client machine using the DCE RPC mechanism. RPCs with different protection levels (e.g., privacy or integrity) and different properties are employed to pass data, depending on the API's security and semantic requirements. When the server receives a client's request, a thread is created to access the data in the ERA. If the request is a create, update, or delete operation, a write to the master registry is required. If the request is a query operation, a read from any slave registry is sufficient to carry out the operation. If a password-based target is queried, the password is retrieved from the ERA. Continuing with this DCE example, if a passticket-based ticket is queried, one more RPC is used to retrieve the secret key shared between the PKM server and the passticket server. The server then generates the passticket based on the secret key and other information configured for the target.
One of ordinary skill will appreciate that the above PKM functions may also be implemented in other distributed environments besides Open Group DCE. Thus, the illustrative embodiment should not be construed to limit the present invention.
Summarizing, single sign-on is facilitated by storing all the passwords and keys belonging to a user in secure storage (either in local storage, a centralized password service, or in a smartcard), so that the user needs to remember only one ID and password. The single sign-on ID and password is then used to authenticate the user. Upon authentication, the mechanism securely retrieves all the passwords for a user from the secure storage and automatically (without any additional user intervention) issues sign-ons to each application the user is authorized to access.
The present invention provides an authentication framework that allows the PKM and the CIM implementations to be separable from the rest of the single sign-on code. The functions provided by the aforementioned components are preferably implemented via a high-level API. Thus, a new implementation (such as Lotus Notes) can be added without causing a major redesign. This mechanism provides a logon coordination framework so that each specific target can be easily plugged into the single sign-on logon coordinator framework. This facilitates the support of the vast range of client server targets.
The present invention enables efficient access to heterogeneous networks at reduced costs to thereby increase productivity for end-users and system administrators. These advantages are achieved by enabling users to sign-on once with a single ID and password to access business applications and data. The design goals achieved are ease of use, secure authentication of users, and logon coordination to multiple applications.
The present invention provides numerous other advantages. It is based on an easy to use interface, and provides a consistent look and feel across operating systems. The tool is also advantageous is that it integrates with operating system logons, is based on open standards, supports "one times" passwords, and is capable of leveraging existing security infrastructures.
One of the preferred implementations of the various modules described is as a set of instructions in a code module resident in the random access memory of a computer. Until required by the computer, the set of instructions may be stored in another computer memory, for example, in a hard disk drive, or in a removable memory such as an optical disk (for eventual use in a CD ROM) or floppy disk (for eventual use in a floppy disk drive), or even downloaded via the Internet.
In addition, although the various methods described are conveniently implemented in a general purpose computer selectively activated or reconfigured by software, one of ordinary skill in the art would also recognize that such methods may be carried out in hardware, in firmware, or in more specialized apparatus constructed to perform the required method steps.
Further, although the invention has been described in terms of a preferred embodiment in a specific network environment, those skilled in the art will recognize that the invention can be practiced, with modification, in other and different network architectures with the spirit and scope of the appended claims. Moreover, the inventive diagnostic technique should be useful in any distributed network environment irrespective of whether single sign-on (SSO) is implemented.
Having thus described our invention, what we claim as new and desire to secure by Letters Patent is set forth in the following claims:
|Cited Patent
|Filing date
|Publication date
|Dec 5, 1977
|Dec 9, 1980
|International Business Machines Corporation
|Cryptographic communication security for single domain networks
|Dec 5, 1977
|May 31, 1983
|International Business Machines Corp.
|Cryptographic communication and file security using terminals
|Jul 27, 1988
|Jun 19, 1990
|Gargiulo Joseph L
|Method and apparatus for the generation and synchronization of cryptographic keys
|Oct 6, 1989
|Sep 10, 1991
|International Business Machines Corporation
|Transaction system security method and apparatus
|Oct 12, 1990
|Apr 7, 1992
|International Business Machines Corporation
|Secure management of keys using control vectors with multi-path checking
|Jul 1, 1991
|Sep 15, 1992
|International Business Machines Corporation
|Transaction system security method and apparatus
|Jun 2, 1992
|Aug 31, 1993
|Hughes Aircraft Company
|One-time logon means and methods for distributed computing systems
|Dec 14, 1993
|Jul 18, 1995
|Hughes Aircraft Company
|Method for providing mutual authentication of a user and a server on a network
|May 27, 1993
|Aug 15, 1995
|Hughes Aircraft Company
|Distributed user authentication protocol
|Nov 26, 1993
|Jan 14, 1997
|Ibm Corp.
|Interactive computer network and method of operation
|Oct 3, 1996
|Aug 31, 1999
|Gemplus S.C.A.
|Method of cryptography with public key based on the discrete logarithm
|Jul 8, 1997
|Sep 21, 1999
|Slavin; Keith R.
|Public key cryptographic system having nested security levels
|Feb 19, 1997
|Nov 30, 1999
|Verifone, Inc.
|System, method and article of manufacture for secure digital certification of electronic commerce
|Feb 19, 1997
|Dec 28, 1999
|Certco Llc
|Enhanced cryptographic system and method with key escrow feature
|Dec 20, 1996
|Mar 7, 2000
|Gte Cybertrust Solutions Incorporated
|Virtual certificate authority
|Jun 19, 1998
|Mar 28, 2000
|Intel Corporation
|Secure and convenient information storage and retrieval method and apparatus
|May 24, 1996
|Jan 2, 1997
|International Business Machines Corporation
|Method and apparatus for a system wide logon in a distributed computing environment
|Title not available
|"Temporary Global Passwords", IBM Technical Disclosure Bulletin, v. 36, No. 3, pp. 451-453, Mar. 1993.
|Menezes, "Handbook of Applied Cryptography", 1996, sec. 13.22.*
|Schneier, "Applied Cryptography", 1995, pp. 51, 52.*
|Citing Patent
|Filing date
|Publication date
|Feb 25, 2002
|Sep 2, 2003
|Hitachi, Ltd.
|Smart card managing system
|Oct 2, 1998
|Jan 20, 2004
|International Business Machines Corporation
|Method and system for a heterogeneous computer network system with unobtrusive cross-platform user access
|Jun 15, 2000
|Oct 5, 2004
|International Business Machines Corporation
|Open architecture global sign-on apparatus and method therefor
|Feb 27, 2002
|Jun 13, 2006
|Oracle International Corporation
|Method and system for implementing current user links
|Dec 7, 2001
|Aug 1, 2006
|System and method for secure replacement of high level cryptographic keys in a personal security device
|Aug 29, 2000
|Aug 8, 2006
|Microsoft Corporation
|Method and system for authorizing a client computer to access a server computer
|Jun 29, 2001
|Sep 5, 2006
|International Business Machines Corporation
|User authorization management system using a meta-password and method for same
|Nov 16, 2000
|Oct 10, 2006
|Bellsouth Intellectual Property Corp.
|System and method for integrated processing of information from a plurality of data systems
|Feb 27, 2002
|Jan 30, 2007
|Oracle International Corporation
|Method and system for implementing shared schemas for users in a distributed computing system
|Jan 29, 2002
|Jul 17, 2007
|Bea Systems, Inc.
|Single sign-on over the internet using public-key cryptography
|Feb 5, 2002
|Oct 2, 2007
|Taiwan Semiconductor Manufacturing Co., Ltd.
|Single sign-on system for application program
|Jul 2, 1999
|Jun 3, 2008
|Nokia Corporation
|Secure session set up based on the wireless application protocol
|Feb 6, 2004
|Jul 22, 2008
|Hewlett-Packard Development Company, L.P.
|System and method for authentication via a single sign-on server
|Nov 2, 2001
|Aug 12, 2008
|Bea Systems, Inc.
|Delegated authentication using a generic application-layer network protocol
|Oct 9, 2001
|Oct 21, 2008
|Oracle International Corporation
|Method and system for management of access information
|Nov 22, 2004
|Jan 27, 2009
|Lenovo (Singapore) Pte. Ltd.
|Secure single sign-on to operating system via power-on password
|Apr 29, 2003
|Feb 24, 2009
|International Business Machines Corporation
|Single sign-on method for web-based applications
|Jun 20, 2003
|Mar 10, 2009
|Oracle International Corporation
|Method and apparatus for enabling database privileges
|Jul 9, 2004
|Jun 9, 2009
|Microsoft Corporation
|Secure dynamic credential distribution over a network
|Feb 17, 2004
|Aug 25, 2009
|Hewlett-Packard Development Company, L.P.
|System, method and apparatus for transparently granting access to a selected device using an automatically generated credential
|Jun 30, 2005
|Oct 13, 2009
|Microsoft Corporation
|Providing tokens to access extranet resources
|Apr 1, 2004
|Oct 20, 2009
|Microsoft Corporation
|Authentication broker service
|Oct 7, 2004
|Dec 22, 2009
|Sprint Communications Company L.P.
|Call center dashboard
|Jan 11, 2005
|Feb 2, 2010
|International Business Machines Corporation
|Method of assuring enterprise security standards compliance
|Nov 19, 2004
|Apr 20, 2010
|Microsoft Corporation
|Data transfer using hyper-text transfer protocol (HTTP) query strings
|Mar 3, 2006
|Sep 7, 2010
|Oracle America, Inc.
|Method and system for identity management integration
|Jun 19, 2007
|Jan 4, 2011
|Oracle International Corporation
|Credential vault encryption
|Feb 27, 2002
|Jan 4, 2011
|Oracle International Corporation
|Method and system for management of access information
|Jan 6, 2009
|Jun 7, 2011
|International Business Machines Corporation
|Single sign-on method for web-based applications
|Jul 11, 2006
|Aug 23, 2011
|Sprint Communications Company L.P.
|Fraud detection system and method
|Nov 20, 2007
|Dec 13, 2011
|West Corporation
|Multi-domain login and messaging
|May 12, 2003
|Jan 31, 2012
|Microsoft Corporation
|Passive client single sign-on for web applications
|Nov 2, 2010
|Mar 13, 2012
|Oracle International Corporation
|User role mapping in web applications
|Jul 13, 2009
|Jun 5, 2012
|Sprint Communications Company L.P.
|Application single sign on leveraging virtual local area network identifier
|Dec 18, 2007
|Jun 19, 2012
|Nhn Corporation
|Method and system for managing log information of user using location servers belonging to plurality of groups
|Oct 12, 2006
|Jul 24, 2012
|International Business Machines Corporation
|Method and system for controlling access to a secondary system
|Feb 1, 2012
|Mar 12, 2013
|Oracle International Corporation
|User role mapping in web applications
|May 24, 2010
|May 14, 2013
|Sprint Communications Company L.P.
|Integrated sign on
|May 16, 2012
|Aug 27, 2013
|International Business Machines Corporation
|Control of access to a secondary system
|Nov 21, 2011
|Dec 24, 2013
|West Corporation
|Multi-domain login and messaging
|Nov 26, 2002
|Sep 2, 2014
|F5 Networks, Inc.
|Applications and services supported by a client-server independent intermediary mechanism
|Nov 19, 2013
|Mar 24, 2015
|West Corporation
|Multi-domain login and messaging
|Nov 16, 2009
|Apr 28, 2015
|Vasco Data Security, Inc.
|Strong authentication token usable with a plurality of independent application providers
|Apr 4, 2013
|Jun 16, 2015
|Sprint Communications Company L.P.
|Methods and systems of using single sign-on for identification for a web server not integrated with an enterprise network
|Mar 15, 2013
|Jul 7, 2015
|Apple Inc.
|Conflict resolution for keychain syncing
|Jun 11, 2013
|Jul 21, 2015
|International Business Machines Corporation
|Control of access to a secondary system
|Mar 15, 2013
|Sep 1, 2015
|Apple Inc.
|Data protection for keychain syncing
|Mar 15, 2013
|Nov 24, 2015
|Apple Inc.
|Keychain syncing
|Jun 22, 2015
|Oct 25, 2016
|Apple Inc.
|Conflict resolution for keychain syncing
|Apr 13, 2006
|Jan 31, 2017
|Sprint Communications Company L.P.
|Integrated user profile administration tool
|Apr 13, 2015
|Feb 21, 2017
|International Business Machines Corporation
|Control of access to a secondary system
|Jan 29, 2013
|Jun 13, 2017
|Microsoft Technology Licensing, Llc
|Authorization of device access to network services
|Aug 17, 2015
|Jun 20, 2017
|Apple Inc.
|Data protection for keychain syncing
|Sep 25, 2015
|Jul 11, 2017
|International Business Machines Corporation
|Distributed single sign-on
|Sep 23, 2016
|Jul 18, 2017
|Apple Inc.
|Conflict resolution for keychain syncing
|Aug 15, 2016
|Sep 5, 2017
|Paypal, Inc.
|Password check by decomposing password
|Mar 5, 2015
|Oct 3, 2017
|Ricoh Co., Ltd.
|Broker-based authentication system architecture and design
|Dec 14, 2000
|Aug 22, 2002
|Ibm Corporation
|Method and apparatus for centralized storing and retrieving user password using LDAP
|Jun 29, 2001
|Jan 2, 2003
|International Business Machines Corporation
|User authorization management system using a meta-password and method for same
|Feb 5, 2002
|Apr 24, 2003
|Ching-Chuan Hsieh
|Single sign-on system for application program
|Dec 7, 2001
|Jun 12, 2003
|Yves Audebert
|System and method for secure replacement of high level cryptographic keys in a personal security device
|Nov 26, 2002
|Jul 24, 2003
|Assisto, Inc.
|Applications and services supported by a client-server independent intermediary mechanism
|Jun 20, 2003
|Mar 18, 2004
|Oracle International Corporation
|Method and apparatus for enabling database privileges
|May 12, 2003
|Nov 18, 2004
|Microsoft Corporation
|Passive client single sign-on for Web applications
|Oct 16, 2003
|Apr 21, 2005
|Taiwan Semiconductor Manufacturing Co.
|Integrate PGP and Lotus Notes to encrypt / decrypt email
|Jul 9, 2004
|May 19, 2005
|Microsoft Corporation
|Secure dynamic credential distribution over a network
|Oct 21, 2004
|Jun 23, 2005
|Atsushi Inoue
|Network information setting method, network system and communication device
|Feb 6, 2004
|Aug 11, 2005
|Davenport Christopher J.
|System and method for authentication via a single sign-on server
|Feb 17, 2004
|Aug 18, 2005
|Wagner Matthew J.
|Computer security system and method
|Apr 1, 2004
|Oct 6, 2005
|Microsoft Corporation
|Authentication broker service
|Nov 22, 2004
|May 25, 2006
|International Business Machines Corporation
|Secure single sign-on to operating system via power-on password
|Jun 30, 2005
|Jun 8, 2006
|Microsoft Corporation
|Providing tokens to access extranet resources
|Jun 30, 2005
|Jun 8, 2006
|Microsoft Corporation
|Providing tokens to access federated resources
|Jan 11, 2005
|Jul 13, 2006
|International Business Machines Corporation
|Method of assuring enterprise security standards compliance
|Mar 14, 2005
|Sep 14, 2006
|Agfa Inc.
|Single login systems and methods
|Aug 10, 2005
|Feb 15, 2007
|Microsoft Corporation
|Authorization of device access to network services
|Oct 12, 2006
|Jun 21, 2007
|International Business Machines Corporation
|Method and system for controlling access to a secondary system
|Mar 3, 2006
|Sep 6, 2007
|Neogent, Inc.
|Method and system for identity management integration
|Dec 13, 2006
|Nov 29, 2007
|Barrett Paul D
|System and method for providing user authentication and identity management
|Jun 19, 2007
|Mar 27, 2008
|Bea Systems, Inc.
|Credential Vault Encryption
|Dec 18, 2007
|May 29, 2008
|Nhn Corporation
|Method and system for managing log information of user using location servers belonging to plurality of groups
|Jun 4, 2007
|Dec 4, 2008
|Microsoft Corporation
|Protection of software transmitted over an unprotected interface
|Jan 6, 2009
|May 14, 2009
|Dmitry Andreev
|Single sign-on method for web-based applications
|Dec 10, 2007
|Nov 4, 2010
|Nokia Corporation
|Authentication arrangement
|Nov 2, 2010
|Feb 24, 2011
|Bea Systems, Inc.
|User Role Mapping in Web Applications
|Nov 16, 2009
|Apr 28, 2011
|Vasco Data Security International, Inc.
|Strong authentication token usable with a plurality of independent application providers
|Mar 15, 2013
|Jul 24, 2014
|Apple Inc.
|Conflict resolution for keychain syncing
|Mar 15, 2013
|Sep 18, 2014
|Apple Inc.
|Keychain syncing
|Jul 19, 2015
|Jan 28, 2016
|Microsoft Technology Licensing, Llc
|Managing cross-premises resources through integrated view
|Jun 22, 2015
|Feb 11, 2016
|Apple Inc.
|Conflict resolution for keychain syncing
|Nov 10, 2015
|Mar 3, 2016
|Apple Inc.
|Keychain syncing
|Sep 25, 2015
|Mar 31, 2016
|International Business Machines Corporation
|Distributed Single Sign-On
|Nov 15, 2004
|Apr 28, 2010
|Secure dynamic credential distribution over a network
|Jun 24, 2003
|Jun 15, 2011
|Method and system for user-determined authentication in a federated environment
|Oct 22, 2010
|Aug 22, 2012
|Strong authentication token usable with a plurality of independent application providers
|Oct 22, 2010
|Sep 30, 2015
|Jun 24, 2003
|Jan 8, 2004
|International Business Machines Corporation
|Method and system for user-determined authentication and single-sign-on in a federated environment
|Feb 3, 2016
|Aug 11, 2016
|Alibaba Group Holding Limited
|System, method and database proxy server for separating operations of read and write
|Dec 24, 2015
|Jun 29, 2017
|Intel Corporation
|Facilitating efficient communication and data processing across clusters of computing machines in heterogeneous computing environment
|U.S. Classification
|713/150, 380/255, 713/155, 713/168
|International Classification
|Cooperative Classification
|European Classification
|Apr 30, 1998
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:FANG, YI;KAO, I-LUNG;WILSON, GEORGE CONERLY;REEL/FRAME:009139/0664;SIGNING DATES FROM 19980415 TO 19980416
|Dec 18, 2001
|Certificate of correction
|Sep 22, 2004
|Fee payment
Year of fee payment: 4
|Dec 8, 2008
|Maintenance fee reminder mailed
|May 29, 2009
|Lapse for failure to pay maintenance fees
|Jul 21, 2009
|Expired due to failure to pay maintenance fee
Effective date: 20090529


text:
Summer Weddings
March 6, 2012 | By Boyd | Impressions: 327 |
More from Boyd
There's so much to explore! Food growing, forest skills, habitats & green school enterprise Our qualied education team personalise programmes depending upon your schools requirements. We work independently or with Teachers to deliver memorable and diverse activities that compliment learning inside the classroom . Working within the Sustainable Schools framework our programmes are built upon the principles of care of ones self, of others and the environment. There are 8 doorways in our framework which are approached through a range of activities that include & promote outdoor activities such as food growing, forest skills, wildlife activities, school enterprise, curriculum and commu- nity work, health & wellbeing and global dimension. Gro-organic is commied to ensuring that schools develop the condence and skills to continue their outdoor education independently. To support this we have added some key workshops to our programme which include: TRAINING & CAPACITY BUILDING Providing Teachers, TA's, SENCO teams and parents with a series of hands on CPD and progressive learning opportunities enabling them to go on to deliver a range of experiences independently. COMMUNITY ENGAGEMENT Providing ideas and support to develop long term opportunities within the local community. SCHOOL ENTERPRISE Enabling primary school children to develop skills in presentations, negotiation and ensuring that the school garden becomes "nancially sustainable" FREE FUND WRITING & BID SUPPORT Our feedback shows that schools can have diculty nding the physical resource and experience that is required to successfully win funding for outdoor education. The good news is, there are lots available so sit back and relax whilst we do the hard work for you.
All prices include our travel costs to any location within a 10 mile radius of B45 8NL. Additional miles travelled outside of this will be charged at just £1.25 a mile. All prices include our travel costs to any location


text:
Technical Shell Jackets - Women'sSave on Women's Technical Shell Jackets at Proboardshop.com! Great selection of street gear at unbelievably low prices. Proboardshop has been selling Technical Shell Jackets and outdoor gear for over 30 years and we're proud of it.
Please refine here More in the Outlet Shop.
- Color: Grey
- Price: 140.00 - 169.99
Technical Shell Jackets More in the Outlet Shop.
Oakley Wazoo Biozone Insulated Snowboard Jacket - Women'sReg: $240.00 On Sale: $167.95
Size: X-Small, Small, Medium, Large, X-Large
Volcom Ship Stretch Pullover Anorak Snowboard Jacket - Women's
Size: X-SmallReg: $210.00 On Sale: $146.95


text:
Emporio Armani Stretch Cotton for Italy Brief 110814D
This product was discontinued August, 2012 and is no longer available. Please consider one of the Customer-Recommended Replacements above, or try a new search.
This low-rise Stretch Cotton collection brief from Emporio Armani celebrates Italy and the finest in Italian design. Viva l'Italia! Made of a lightweight and soft 95% Cotton, 5% Spandex fabric blend.
Try these keyword searches with similar features:


text:
RICHMOND, Va., Jan. 12 (UPI) -- DNA tests indicate that Roger Keith Coleman, put to death in 1992 in Virginia for a killing he said he didn't commit, was guilty of rape and murder.
Virginia Gov. Mark Warner ordered the DNA tests in one of his last acts as governor. He announced the results Thursday, the Richmond (Va.) Times-Dispatch reported.
"The confirmation that Roger Coleman's DNA was present reaffirms the verdict and the sanction," Warner said in a release. "Again, my prayers are with the family of Wanda McCoy at this time."
McCoy was raped and killed on March 10, 1981. Coleman, McCoy's brother-in-law, was tried and sentenced to death in 1982.
He claimed his innocence even as he was put into the state's electric chair and executed on May 20, 1992.
Warner, who leaves office Saturday, said he ordered the DNA testing to put to rest doubts in the case.