text:
|Publication number
|Publication type
|Application number
|Publication date
|Sep 5, 2002
|Filing date
|Aug 20, 2001
|Priority date
|Aug 18, 2000
|Publication number
|Skye Poier, Gresham Meharg, Alexandre Pankratov
|Original Assignee
|Poier Skye M., Gresham Meharg, Alexandre Pankratov
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (5), Referenced by (73), Classifications (11), Legal Events (2)
|External Links: USPTO, USPTO Assignment, Espacenet
[0001] This application is a continuation-in-part of U.S. application Ser. No. 09/640,795 filed on Aug. 18, 2000, which is hereby incorporated by reference.
[0002] The present invention relates to a system and method of providing secure communications over an open network, and more specifically to establishing a virtual private network (VPN), which runs across a diverse set of operating systems and hardware platforms and facilitates ease of use.
[0003] Workgroup computing involves, by definition, the exchange of data between the nodes of the workgroup, a node being a computer connected to a network which can be identified with an individual, a set of resources (files, services, devices, etc), or a gateway. Often, the tasks of a workgroup are of a sensitive nature containing, for instance, confidential data on finances, business development plans, or private email. The Internet (and its native IP protocol) has become ubiquitous as a means of connecting nodes in a workgroup computing environment. However, with the adoption of the Internet and its public networking infrastructure comes the risk that an unauthorised 3 rd party with access to the data route between two nodes may intercept and reconstruct data transferred between them. To prevent interception, a mechanism is required to modify the transmission of data such that only the intended receiver may interpret it and the receiver can be guaranteed of the data origin and integrity.
[0004] A virtual private network is a logical entity consisting of multiple nodes having a secure communications over an open and typically insecure network such as the Internet. Data security is commonly achieved through the use of cryptography, which requires the data traffic to be encrypted at the sender's end and then decrypted at the receiver's end so that other users of the public network can intercept the data traffic, but cannot read it due to the encryption. Data encryption also allows the receiver to verify the integrity of the data received and therefore detect 3 rd party data tampering.
[0005] A typical VPN connects one or more private networks together through the Internet. Generally, the network on either side of the Internet has a gateway and a single-access connection to the Internet. To create the VPN, a secure communications path between the two gateways is formed such that the two private networks may communicate with one another.
[0006] In order to establish secure communication between any two nodes on a VPN, each node obtains by some means information ("configuration") including but not limited to:
[0007] The identity and state of the remote nodes within the VPN
[0008] The relationships between nodes (VPN topology)
[0009] Cryptography for authentication and data communications encryption between nodes, for example the key for a VPN based on shared secrets or certified public key for VPN utilizing Public Key Infrastructure (PKI).
[0010] Secured communication between two nodes is commonly called a 'tunnel', while nodes themselves are often referred to as 'tunnel terminators'. Traditional VPN solutions are comprised of a number of tunnel termination devices, which provide a central "hub" for VPN communication. Software is then deployed to nodes that wish to participate in a VPN, and the software is configured manually with the address of the VPN device(s). The software is then executed in order to participate in the VPN. However, there are several disadvantages with respect to this technology. In general, a VPN does not allow for automatic configuration of nodes for VPN participation as nodes change their network addresses on being dynamically added/removed to/from a VPN. In addition, each of the nodes may only be a member of one VPN at a time in the majority of implementations, which limits the ultimate efficiency of the user at each node
[0011] The use of VPN's is well known in the computer world each using different mechanisms to provide a means of secure data transmission. U.S. Pat. No. 6,061,796 entitled "Multi-Access" Virtual Private Network describes system and method for allowing private communication over an open network. This system however, specifies what mechanism protocol level the Agent (VPN provisioning application) uses to intercept incoming and outgoing data from a node and is not designed to work with IP networks. In addition, it would be difficult to scale this particular system for large-scale use. In U.S. Pat. Nos. 5,884,035 and 6,026,430 data transmission is only through the domain hierarchy and not on a data to client application basis. In the VPN system described in U.S. Pat. No. 6,055,575 it notes that the "host computer establishes a secure communications path, referred to as a tunnel, through the public network with the remote client". This has firewall implications in that a remote node can rarely accept incoming connections.
[0012] Another very common limitation of traditional VPNs is their inability to cross boundaries of private networks linked to each other through one or more Network Address Translation (NAT) devices. In addition, existing VPN do not facilitate the use of end-to-end security in the presence of firewalls, gateways, and proxy servers. NAT devices, both regular and PAT are very widely deployed to allow for better security by hiding details of private network from the outside world and to facilitate conservative use of public IP addresses by mapping multiple private addresses onto single public one. With the growth of the Internet and delayed introduction of version 6 of IP protocol (Ipv6), more and more companies will be forced to use NAT devices as IP address space available for general public becomes increasingly exhausted. The above-mentioned limitation arises because a NAT device modifies the data packet to allow for proper routing both inside a private LAN and in the outside world. However, any change to the packet is treated by tunnel terminators as a tampering, thus packets undergoing NAT processing are discarded as damaged.
[0013] As it follows from known PAT functioning principles, the presence of post-IP header is a necessary condition for the packet to be translated by the PAT. Also, since a PAT device maps all internal nodes onto a single IP address, it creates and maintains internal associations between IP address and post-IP header of the internal node and its translated post-IP header. This means that traffic traversing PAT device and destined for an internal node requires a proper association to be in place to facilitate the reverse mapping. In other words, any post-IP session between PAT'ed and external node may only be initiated by the external node.
[0014] It is an object of the present invention to obviate and mitigate at least some the aforementioned disadvantages of the prior art.
[0015] Accordingly one aspect of the present invention provides a system for facilitating the secure communication between nodes in a workgroup by the creation of an "n"-tiered virtual private network (VPN). Each node preferably has the ability to transmit and receive secured data over a public network such as the Internet. The system comprises at least a pair of nodes, a server, a datastore linked to the server (where the datastore may be in the form of memory, a disk, a database etc), and a client application capable of communicating with the VPN server and securing IP-level connections towards other VPN nodes by utilizing a suite of protocols, for example and IPSec protocol, in particular an ESP protocol. The datastore further includes information pertaining to the configuration of VPNs, VPN relationships (e.g. client computer membership to VPN's), settings and options (e.g. IPSec ciphers to use), authentication information, and objects and attributes (e.g. status—online/offline, human-readable node description, node IP). The system further includes a means to intercept both incoming and outgoing data from a node so as to create a secure tunnel between an open network and a node by encrypting and decrypting data. In addition, the system includes a means for verification of node credentials against authentication servers. The tunnel enables data to be securely shared to VPN(s).
[0016] The present invention is designed to facilitate the aspects of VPN functionality including but not limited to: securing communication within the VPN and VPN configuration for the exchange of secure information between VPN nodes.
[0017] In another embodiment, on start up of a node within the system, the client forms a connection with the VPN server. Authentication credentials are transmitted to the VPN server, where they are validated and a connection is established. Following the creation of a secure connection between the VPN server and a node, the client application is synchronized with the VPN server by receiving and processing initial configuration information. This information includes a list of VPN's of which this particular node is a member, their respective attributes, a listing of other nodes which are members of the same VPNs as the client computer, the current status of each node in each respective VPN, and other related details. Once a node is logged onto and synchronized with the VPN server its client application sits in the loop so as to maintain the node in sync with the rest of the VPN by sending and receiving status and configuration updates to/from VPN server. The central management of the system enables the server to be informed of any changes to a VPN e.g. a node logging off, and is informed of these changes in a timely manner, where the time frame is elected by the node. The VPN server then relays this information to each node within the VPN, which in turn is putting its self, the VPN server, in sync with the system.
[0018] This system is global by the nature of the server such that it facilitates the central management of any VPN. The server facilitates the ability to make changes to a VPN without having to effect changes manually at each node of a virtual private network. A change made to the datastore linked to the server is transmitted in a timely manner to all client computers effected by the change. For example, to change the password of a VPN for each node in a network requires making that change to the datastore and, in turn, that change is transmitted to each node on the virtual private network. While changing a password is a relatively simple task, the ability to effect more detailed changes to a VPN requires updating only a single point in a VPN and then transmitting that data to the remaining nodes in the workgroup via the secure connection. In use, the network includes the ability to automatically and securely provision security associations between nodes.
[0019] The control of the VPN created using the VPN server may be in house in the sense that, at a particular company subscribing to this service, an IP manager would administer and maintain the VPN and have rights to modify information on the server and datastore as it pertains to their VPN. Generally, IP traffic between two nodes on a VPN is encrypted and decrypted regardless of the type of information being sent. The decision as to secure the channel between two nodes or not is made by VPN server based on the topology configuration of the VPN. The server itself however, does not participate in node-to-node data transfer.
[0020] This invention further provides a system to enable secure communication between nodes over the Internet and have the benefit of end to end security. This system enables a node, which may operate behind generic NAT box and/or a firewall, to establish and use secure communication over the Internet with another node. In general, there are two different types of Network Address Translation (NAT) devices—regular NAT and Network Port Address Translation. The difference between these two types is that a regular NAT device uses IP header information to relay packets to and from members of a private group. Network Address Port Translation uses an IP and transport layer protocol (TCP/UDP/ICMP) header. This is also referred to as PAT.
[0021] The system comprises at least a pair of nodes belonging to the same virtual private network, a packet interception mechanism, a secure line for communication to the VPN server, and a client application located at each node. The client application located at each node includes a mechanism to encrypt, decrypt or process data exchanged within the virtual private network, and a software module responsible for maintaining configuration information including VPN relationships, authentication information, and settings and options. In addition, the configuration information indicates the presence of a NAT device, firewall, gateway, and proxy server in front of particular nodes in a VPN. The system further comprises a mechanism for verification of node credentials against authentication servers, which enables data to be securely shared amongst members of a private group. The packet interception mechanism is generic and known to one skilled in the art.
[0022] Once nodes are logged onto a VPN, they may exchange information. Outgoing data packets are intercepted and then those destined to a specific VPN node are selected for further processing. When ongoing data packets are intercepted, the VPN indicates the presence of a NAT or PAT device, a firewall, gateway, and proxy server in front of the intended receiving node. In order to facilitate data exchange to nodes located behind one of the above-mentioned devices, the data packet header is modified. The data packet itself is encrypted as a whole and a new header is prepended to the now encrypted data packet. Source and destination node information is added to the prepended header and is determined by the VPN. The new header is referred to as an "external header" and the original packet header is referred to as the "internal header". The external header contains a masquerade bit which allows the receiving node to recognize the modified data packet as having a prepended external header. Once the data packet traverses the device, the external header is removed and the packet is processed according to the specifics indicated by the original IP header.
[0023] These and other features of the preferred embodiments of the invention will become more apparent in the following detailed description in which reference is made to the appended drawings wherein:
[0024]FIG. 1: is a schematic diagram of an overview of a computer system;
[0025]FIG. 2: is a functional block diagram detailing the method for establishing secure communication between nodes, in the computer system of FIG. 1;
[0026]FIG. 3: is a schematic of the computer system incorporating a plurality of types of nodes;
[0027]FIG. 4: is a schematic diagram of an overview of a computer system incorporating LAN's, a gateway, and a firewall;
[0028]FIG. 5: is a functional block diagram detailing the method for sending data over a VPN having secure communication in the computer system of FIG. 1;
[0029]FIG. 6: is a functional block diagram detailing the method for receiving data over a VPN having secure communication in the computer system of FIG. 1;
[0030]FIG. 7: is a schematic of the data packets transferred between a plurality of types of nodes on a VPN; and
[0031]FIG. 8: is a schematic diagram of an overview of another embodiment of the computer system of FIG. 1.
[0032] To facilitate the understanding of the preferred embodiments described below, the following terminology will be used, it being understood that this is for illustrative purposes only and is not limiting:
[0033] Client Application—the software that acts as a slave to a server and is present on each node within a work group;
[0034] VPN—a virtual private network that is constructed over a public network to connect nodes within a work group such that:
[0035] a) data transferred between those nodes is secure and cannot be intercepted, modified, or replaced on route; and
[0036] b) it contains mechanisms to ensure that only authorized users may access the network.
[0037] Node—a computer connected to a network which maybe identified with an individual, a set of resources, or gateway;
[0038] Work Group—a group of two or more individual nodes working collaboratively on a group of tasks;
[0039] Gateway—a special node that provides secure communication to a specific network of nodes located behind the gateway; and
[0040] Network Address Translation—(NAT) an Internet Standard that enables a LAN to use one set of IP addresses for internal traffic and a second set of addresses for external traffic.
[0041] A system and method for establishing a secure connection for the transfer of data between nodes in a work group over a public network is illustrated in FIGS. 1 through 8. The computer system is generally designated by reference numeral 10. The system 10 may be configured in a number of different ways including those utilizing individual users as shown in FIG. 1, those utilizing individuals and intranet as shown in FIG. 3, and those utilizing a gateway as shown in FIG. 4. Initially it is necessary to establish communication between members of virtual private network (VPN) and this procedure will be described in respect of each configuration.
[0042] As shown in FIG. 1, a computer system 10 comprises a plurality of nodes 12 (client computers), server 18, and a datastore 20 whose contents may be updated or changed periodically by external intervention. Server 18 is also referred to as the VPN server however, it is understood that the VPN server is capable of performing typical server functions known in the art in addition to the provisioning of a VPN as is described below. Each of the nodes 12 includes a client application 14 capable of communicating with server 18. The system 10 is arranged to enable the establishment of a secure path for communication between nodes 12 over a public network such as the Internet 22. The server 18 collects and distributes data collected by the client application 14 at each node 12, so as to maintain state information for each node 12. The server 18 tracks changes made to the datastore 20 and subsequently updates each of the nodes 12. The client application 14 is responsible for transmitting information to and receiving information from a second client application 14 of a node 12 and server 18. The server 18 also serves to generate specific node cues based on those events, such as the availability of upgrades for client application. The datastore 20 is linked to the server 18, and is managed so as to enable the automatic provisioning of security relationships with nodes 12 in a network. A network having secure communication between these nodes 12 is typically known as and from herein referred to "a virtual private network" (VPN). The centrally managed system 10 allows for arbitrary additions, modifications, and alterations to the datastore 20 and, in turn, deploys that information through the server 18, to nodes 12 located within a virtual private network.
[0043] The method of establishing secure communication between nodes in a work group is detailed in FIG. 2. On startup of a node within a work group, the client application 14 instructs the node 12 to form a connection with the server 18. Once the instructions have been received, as indicated at 102, a socket connection is formed between that same node 12 and server 18 (generally using secure socket links such as SSL/3DES socket security). Once the connection, 104, is formed between the server and the node, the authentication phase, 106, begins. The client application transmits credentials to the server 18. The server 18 then authenticates the validity of these credentials and returns data stating the success 108 or failure 109 of the logon to the server. If the credentials are found to be invalid the process fails and ends. Once the node is logged onto the server 18 and a secure connection is formed, the synchronization phase 110 begins. The server 18 delivers a packet of configurational information to the client application 14 of a node 12 via the secure socket connection so as to establish a virtual private network. The configurational information includes, but is not limited to, a list of virtual private networks to which that node is a member, their related attributes, the state of other nodes located within a VPN of which the node or client computer is a member, and their related details such as IP address. Once this transfer of information 112 has occurred, the server 18 and node 12 are successfully linked as indicated at 114, and the ability to transfer data over a secure line of communication is enabled. Once a node is logged onto the server 18, data is transferred between a pair of nodes 12 by invoking procedures on remotely hosted applications on the node 12 and determining the type and target of the change or data to be distributed.
[0044] The system 10 is global by nature such that it facilitates the central management of the VPN. The system 10 enables each node 12 and server 18 to be informed of any change to the VPN by updating a single point within the VPN and transmitting that data to all affected members of the VPN. Once a node is logged on to a VPN, thereafter, any change to the datastore 20 that affects a work group of which the node 12 is a member will be forwarded from the server 18 to that node. The server is able to determine the relevant nodes 12 from the contents of the data product received during the information transfer phase 112. There are two types of changes that affect the datastore 20. A node generated change e.g./going offline, invokes an application located on the server 18 to change the attribute of "itself". The server 18 examines the type of change, in this case—going offline, and determines all online nodes in the VPN's that the node is a member of which require notification. The server 18 retrieves a list of those nodes from the datastore 20, and notifies each interested node. The notification is either synchronous or asynchronous.
[0045] A management interface change e.g./altering VPN membership for example, through a web-based configuration tool, invokes a procedure on the server 18 notifying the server 18 of the change to the datastore 20. The server 18 examines the type of change and distributes the notification as described above. Accordingly, a VPN is established to allow communication between each of the nodes. A similar procedure may be utilized in the configuration of FIG. 3.
[0046]FIG. 3 illustrates a plurality of nodes 12A through 12E, where at nodes 12C through 12E there are a plurality of client computers. The computer system 10 detailed in FIG. 3 is a multi-tiered client/server system in which every node 12 acts as both a client and server. A node either pulls update from the server, and in such a case in synchronous or acts as a client, or the server pushes updates to a node by invoking a method on an object which resides on the node, hence is asynchronous and acts as a server. The server 18 operates over an existing network connection to the Internet 22 that each node 12 possesses. The computer system 10 allows arbitrary grouping of nodes 12 on the Internet 22 into VPNs across, for instance, network, organisational and geographical boundaries.
[0047] The computer system 10 enables an extranet connection for example between two offices of a company 12D and 12E, each of which includes its own Intranet, to be included in a work group. In this situation a corporation typically will have at least one localized server 17B, 19B, which will act as server for that Intranet. Each node 12 within that corporation will be connected to that localized server. The localized server 17B, 19B exists within a hierarchy within the computer system such that if a node/client computer within the corporation queries the localized server, and that server does not contain the information queried for, that server climbs the hierarchy chain to a higher up server and queries for the information. This process continues until the information is returned to the localized server where it can be distributed to the appropriate client computers within that network. Alternatively, a node within the corporate network is capable of communicating with, for example a traveling user 12B located outside the office.
[0048] When each node 12A through 12E logs onto the server 18, such that each node in the network exists in a parallel relationship with another node. In one embodiment, each pair of nodes is typically setup with a set of keys and a unique identity such that they may transmit secure messages that have been encrypted and decrypted using this set of pair based keys. Preferably, the system 10 employs an existing peer-to-peer key exchange mechanism e.g. Internet Key Exchange (IKE), to negotiate session keys with each peer for data exchange. However, in the event that IKE is inaccessible, a pair of nodes 12 may negotiate and transmit keys via server 18. In the alternative, the server 18 may generate and distribute to keys and node pairs 12. It will be appreciated that when transmitting data between two nodes logged on to a virtual private network, that data is not transmitted through the server 18. The server 18 is used for the initial provisioning of the virtual private network and to transfer information to the client application 14 of each node 12 with configuration information for the provisioning of that virtual private network. Again a VPN is established between a set of nodes interconnected by the Internet 22.
[0049]FIG. 4 again shows computer system 10, and in this embodiment, involves the use of a gateway 24 that includes a library portion containing attributes of the servers connected to the gateway 24. Although the gateway 24 controls access to several nodes, each indicated as a server 25, the gateway 24 is considered a node by other users within the VPN and typically includes a key pair associating it with each of the other nodes in the system 10. During the logon process detailed in FIG. 2, the server 18 will detect the presence of the gateway 24 and, during the synchronization phase, the datastore 20 will provide information to the gateway 24 as to the range of IP addresses that are assigned to nodes behind the gateway. In an alternative embodiment, the server will also detect the presence of a firewall 23 (shown in FIG. 4), NAT box, or PAT box (not shown) as above. The gateway 24 includes a set of rules called security associations that are designed to control access to the VPN such that the gateway protects a plurality of nodes. Conventionally, when a node in front of the gateway, such as 12A wishes to communicate with a node behind the gateway such as 12G, the node 12A selects the key pair associated with the gateway 24 to provide encryption and decryption of the data. The decryption then occurs at the gateway as opposed to at the node to which the message is directed. The same is true of a NAT device where decryption traditionally occurs at the device. When a user who is typically a member of the plurality of nodes located behind the gateway, such as a company network 12G, is working from home 12A, the IP address of the home computer 12A is not in the range of IP addresses specified by the gateway 24. When an IP address falls outside the range of addresses known to the gateway 24 access may be denied to the company network. In such a situation, a virtual IP (VIP) address is typically assigned to the home user 12A. When a VIP is assigned to the node of the home user 12A, data sent from node 12A to the company network 12G, located behind the gateway 24, the gateway will route this data through a virtual interface. In the case where a node is a intranet, as in FIG. 3 node 12C, and that node 12C wants to send data to 19B, the server 18 will have a plurality of rules known as an access control list (ACL), stating which client computers located within 12C may access data on the servers. Security measures in each of the above cases conventionally are employed at the gateway 24.
[0050] In order to employ end to end security in the presence of firewalls, gateways, NAT/PAT boxes, and proxy servers or when connections are slow and unreliable, a preferred procedure is set forth in FIG. 5 is utilized. On startup of a node 12 within a work group (as shown in FIGS. 3 and 4), that node forms a secure connection with server 18, as described in FIG. 2. Once connected to the server, 202, on synchronization a mechanism assesses connectivity between nodes and determines the presence of NAT devices, firewalls, gateways and proxy servers in front of particular nodes within the VPN. On assessing connectivity, 204, where a node is located behind for example, a NAT or PAT box, that configurational information is conveyed to the client application of each member within the VPN. Provided a node is not located behind a gateway, NAT/PAT box, firewall, or proxy server, a data packet, originating from independent applications, is sent securely from one node 12 to another typically employing conventional methods of end-to-end security. Such packets typically comprise an IP header 72, a TCP header 74, and data 76 as shown in FIG. 7a. The IP header communicates the data endpoint, the TCP header specifies the transport protocol, and the data portion is the bit stream which comprises the message being sent. The actual processing of the information contained within the data packets, as well as the decryption, is known in the art and falls outside the scope of this invention.
[0051] In the event that a device is detected in front of a particular node, the system 10 employs a modified method of communication that facilitates end-to-end security and is described below. The detection of a NAT device, firewall, gateway, and proxy server, 206, indicates to the system 10 to invoke a modification to the data packet in order to facilitate traversing of the device. Data packets, originating from a node within the VPN are intercepted, 207 and those packets destined to a specific VPN node located behind a device are selected for further processing. The selection for further processing informs the system 10 that these data packets that have been intercepted require modification in order to enable their sending. Thus, the data packets are examined and packet headers are modified 208 (as shown in FIG. 7) as will be described below. This masques the data packets such that, to the device they appear to be unmodified and traverse the device as secure encrypted data packets. The masqueraded data packets preserve the original data packet and header information as an encapsulated secure payload and appends a new external header. The external header includes a data bit from herein referred to as a "masquerade bit" which acts as a "flag" or "indicator" that the packet header has been modified, 210. To the device, such as those shown in FIGS. 3 and 4, the data packet appears to be an unmodified protocol session and passes through the device unread. In the case of a firewall, (shown in FIG. 4) upon receipt at the firewall, the external header is identified as an SSL and is directed to dedicated port 443 in the wall and passes through that port without further examination to the intended receiver.
[0052] In the preferred embodiment, the system nodes are restricted to use Encapsulated Security Payload (ESP) protocol in tunneling for securing data being exchanged by VPN nodes. This is a protocol that resides on top of the IP layer in network stack and thus allows for securing any IP traffic. A data packet secured by Tunneled ESP is encrypted as a whole, and is prepended with an ESP header and another copy of IP header which comprises a new external header. Source/destination node information in the new IP header within the external header may differ from the IP header in original data packet. The ESP processing setup determines any change to the IP header information. Original IP header is further referred as 'internal' and newly prepended one—as 'external'.
[0053] Typically, when an encrypted packet traverses a NAT device, for example, its external IP header is modified to contain proper addressing information. Upon arrival at the destination node the external IP header is stripped off during data processing and the external IP addressing information is irrevocably lost. Therefore, the receiving node is not able to process the decrypted packet properly. In the present invention, the data packet memorizing the external IP header prior to its stripping, and then adjusts internal IP header based on the network setup. For example, a data packet when traversing a NAT device, arrives at the NAT device and at this point prompts the system to copy the destination IP address from the external header. If, in addition, the data packet arrives from a NAT'ed node (a node having a NAT device in front), then the system is further prompted to update the source IP address from the external header. The IP/TCP/UDP checksums of the adjusted packet are recalculated or turned off such that the packet integrity is guaranteed by successful decryption. The centralized nature of the VPN supplies nodes with information about their peers that allows for each node to decide if a particular peer or node is NAT'ed. This effectively eliminates the 'detection' (or 'negotiation') step known by those skilled in the art and typically employed by other NAT-traversal methods to determine the presence of the NAT between two nodes. The process described above of changing the IP header before submitting a data packet to the IP processing is further referred to as 'RNAT transformation'.
[0054] A data packet traversing a PAT has both its IP header modified as well as its transport layer header translated. Commonly supported transport protocols are TCP and UDP. ICMP, while not being true transport protocol, is also generally provided a limited support for its ECHO messages. Note that these three protocols are referred as 'post-IP protocols' below.
[0055] In the case where a data packet traverses a PAT device, the system employs the following approach. Assume node A being PAT'ed node (a node having a PAT device located in front) and node B its peer residing outside the PAT device. In this case, node B may be located behind NAT, but not PAT device. A packet sent by node A is processed as described and above and then in turn, receives a UDP header and a masquerade bit inserted between IP and ESP headers of the encrypted packet as was described above. This extra step of outbound processing, including the UDP header, is further referred as 'UDP-masquerading' or 'masquerading'. The masquerade allows recipient to differentiate between masqueraded and 'true' UDP packets with a high degree of accuracy. Upon arrival of a data packet at node B having traversed a PAT device, the data packet UDP header is associated with the tunnel through which it arrived. In other words, it associates the node from which the data packet originated. Then packet is then stripped of the UDP masquerade header to reveal the original header and inbound ESP processing and RNAT transformation is performed as previously outlined. The ESP code links plain text post-IP information to the tunnel through which it was delivered.
[0056] A data packet leaving node B destined for node A is first subject to a regular ESP processing with compulsory Tunnel selection based on its IP and post-IP information stored during inbound processing. Once encryption of the data packet is completed, the data packet is masqueraded based on masquerading information also stored during inbound processing. Upon arrival at node A, the data packet is subject to demasquerading, regular ESP processing and RNAT transformation.
[0057] In a further embodiment, the system facilitates a means to potential post-IP information ambiguity developing on node B after packet decryption. For example, two nodes (A1, A2) may reside behind the same PAT device and use the same source port to access the same node B port. It this case, after RNAT is applied, data packets originating from nodes A1 and A2 are indistinguishable and a reply from node B could not be routed back to the appropriate node. The system in this case applies a post-IP layer overloading (similar to the PAT) to each data packet traversing the same PAT device arriving through different tunnels. A PAT transformation is applied to all inbound data packets to resolve ambiguities and the reverse mapping to the originating node is performed on the outbound data packet in order to restore the post-IP headers to peer's expectations.
[0058] When a node is the intended recipient and that node logs on to the VPN, the node receives a data packet 252 as shown in FIG. 6. When a data packet arrives, the interception mechanism (253) analyses the packet header 254 for the presence of a masquerade bit. If a masquerade bit is not detected, the data packet is received by the intended node 262 and is processed. When a masquerade bit is detected 256, it indicates to the system that further processing is required. When the received node is located behind a NAT/PAT box, it is the box that receives the data packet, analyzes the header, and detects the presence of a masquerade bit. In the case where there is no NAT/PAT box, the node performs the analysis and detects the masquerade bit. Once the masquerade bit is found, the external header is removed 258 to reveal to original header. This original header is examined and the packet is routed to the intended-receiving node and allows for return data to be sent.
[0059] If, in the above circumstance, the node is not logged on to a VPN, the packet is sent and once the peer or intended receiving node logs on to a VPN the packet is received by the peer following the procedure outlined in FIG. 6.
[0060]FIG. 7 shows the transformation of a regular data packet 70 illustrated in FIG. 7a to a modified data packet 90 illustrated in FIG. 7b that was described in FIG. 7. The originating data packet 70 includes an IP header 72, a TCP header 74, and a data portion 76. In order to facilitate end-to-end security in the presence of a firewall, NAT/PAT box or gateway etc, the data packet is modified/re-written, as described in FIGS. 5 and 6. The modified data packet 90 comprises a new header 91 and a data payload 96. The header 91 of the modified packet 90 comprises an IP header 72 b, and ESP header 93 and a masquerade bit 94. The data payload 96 of the modified pack 90 encapsulates the original data packet 70. On receiving a modified packet, as detailed in FIG. 6, the new header 91 is removed and the packet is processed to reveal the original data packet 70.
[0061] On securing a communications path over a public network between two nodes in a computer work group, a typical encryption technique used to transfer data between these nodes includes: generating a data packet to be transmitted over the secured communications path where the data packet includes routing information; encrypting that data packet using an encryption technique known to one skilled in the art; encapsulating the encrypted data packet into a secondary data packet compatible with public network protocols; transmitting the encapsulated data packet over the public network; the data packet arriving at the receiving node; and that receiving node unpacking the encrypted data packet using a set of authentication keys, stripping the second data packet from the original data packet, and decrypting that data packet received from the originating node.
[0062] In the preferred embodiment, secure IP communication using end-to-end security between any two nodes 12 over the Internet 22 is established with only minimal assumptions about any particular node's connectivity privileges. This is accomplished by applying IPSec transformations to incoming and outgoing IP packets at the transport layer and then transforming these processed packets so they appear to be an SSL protocol session until received by the destination node.
[0063] For operation within the system, the node (base configuration) preferably includes:
[0064] An IP address and a connection to the Internet (may be non-unique); and
[0065] Ability to send and receive TCP data on port 443 in SSL format (on some servers may also require the ability to send and receive TCP data in SSL format on a port specified by the server).
[0066] The optimal configuration for a node (recommended configuration) is defined as follows:
[0067] Those abilities defined in the base configuration; and
[0068] A globally routable IP address or 1:1 static NAT.
[0069] At least one node in each pair supports at least the recommended configuration, and the other node supports at least the minimum configuration. The system requires that only one of a pair of nodes may be located behind a firewall. The recommended encryption level for data in transit is 3DES. The system, in the preferred embodiment, accesses both:
[0070] configuration data (IP addresses, etc) provided by server, client application, and library aforementioned; and
[0071] a packet interception and injection mechanism partially provided by Trilogy AdmitOne
[0072] The computer system 10 may be run on a diverse set of operating systems and hardware platforms such as open BSD, UNIX, Windows NT, Windows 95/98, Linux, and Solaris.
[0073] In another embodiment, as shown in FIG. 8, a system 50 comprises VPN servers 44, which function as central policy management for establishing and facilitating VPN operation. The system 50 further comprises at least a pair of database servers 40 and a Round-Robin Domain Name Server (DNS) 42 in a distributed, fully integrated environment. The DNS server 42 assures homogenous distribution of the data load across the VPN servers 44. Connectivity between VPN servers 44 and the database servers 40 is implemented so as to support several modes of communication including but not limited to open database connectivity (ODBC), Java Database Connectivity (JDBC) or any other database connectivity interface. The database servers 40 are mutually synchronized to keep the data contents current and up-to-date. The content of each database server 40 is identical such that, should one database server 40 crash, each of the VPN servers 44 connected to that failed database server 40 may automatically reconnect to another available non-failed database server.
[0074] The VPN server 44 may operate in either a standalone or a distributed environment. The nodes 12 participating in a VPN may be connected to the same VPN server 44, as the VPN servers 44 are synchronized such that a node may log onto any VPN server 44 and participate in a VPN of which they are a member. As the system 50 is fully synchronized, forwarding from one VPN server 44 to another is not necessary. Each event or revised attribute of a node 12 or server 44 is distributed to the entire system 50 directly by the original sender. Synchronization enables VPN nodes to see one another as if they were physically connected to the same VPN server 44.
[0075] The system 50 employs a variety of communication protocols utilized within the VPN environment so as to facilitate communication of the VPN server 44 and its node 12 across the open network environment. In the preferred embodiment, communication within the system 50 occurs at a "secure sockets layer" (SSL) underneath any security attributes. The system however, further enables communication, in one embodiment at the application layer. Such communication may be in the form of the following:
[0076] a) Authentication of users
[0077] When a VPN node 12 is going online, the node 12 submits its authentication credentials, which are validated on the server side. The node 12 may enter another state of communication once the authentication credentials have been approved. The system 50 supports two ways of authentication, either using a user name and password or client side certificates however, authentication is not limited to these two types.
[0078] b) Proxy authentication of users
[0079] On authenticating the credentials of a node 12, the credential(s) is validated against an external data repository, for example Lightweight Directory Access Protocol (LDAPO, Radius, or Windows NT/2000 domain.
[0080] c) Distribution of user state updates
[0081] When a VPN node 12 goes online/offline, other nodes within the VPN are notified of this update such that the related security associations are also updated. Any further communication between VPN nodes is utilized through an IPSec protocol and does not flow through the VPN server 44.
[0082] d) Providing a way to establish common secret
[0083] Each VPN node 12 generally possesses a common secret such as a private key which is passed to the IPSec layer and is used to protect the respective data traffic. This secret may be created by the VPN server 44 and distributed to the appropriate VPN node or the secret may be created locally at the node 12 and submitted to a second node in a secure and private manner through the VPN server 44. The common secret for example may be a symmetric key, "Internet key exchange" (IKE) so as to allow secured node-to-node communication.
[0084] e) Password exchange protocol
[0085] The system 50 encapsulates a secure-transaction mechanism to allow VPN nodes 12 to update their VPN passwords. After a node is successfully authenticated, the node is allowed to submit a password change request, followed by the approval/confirmation of both communication parties (VPN node and VPN server 44).
[0086] Although the invention has been described with reference to certain specific embodiments, various modifications thereof will be apparent to those skilled in the art without departing from the spirit and scope of the invention as outlined in the claims appended hereto.
|Cited Patent
|Filing date
|Publication date
|May 4, 1936
|Mar 28, 1939
|American Box Board Co
|Title not available
|Title not available
|Title not available
|Title not available
|Citing Patent
|Filing date
|Publication date
|Apr 11, 2001
|Oct 7, 2003
|Openreach Inc.
|Methods and systems for enabling a tunnel between two computers on a network
|Apr 11, 2001
|Feb 7, 2006
|Corente, Inc.
|Methods and systems for managing virtual addresses for virtual networks
|Apr 11, 2001
|Apr 11, 2006
|Corente, Inc.
|Methods and systems for partners in virtual networks
|Apr 11, 2001
|Apr 11, 2006
|Corente, Inc.
|Methods and systems for using names in virtual networks
|Apr 11, 2001
|May 16, 2006
|Corente, Inc.
|Methods and systems for hairpins in virtual networks
|Apr 11, 2002
|Jul 4, 2006
|Ntt Docomo, Inc.
|Method and associated apparatus for pre-authentication, preestablished virtual private network in heterogeneous access networks
|Apr 11, 2001
|Aug 1, 2006
|Corente, Inc.
|Methods and systems for enabling communication between a processor and a network operations center
|Mar 22, 2001
|Feb 20, 2007
|Corente, Inc.
|Method and system for managing and configuring virtual private networks
|Apr 11, 2001
|Feb 20, 2007
|Corente, Inc.
|Methods and system for providing network services using at least one processor interfacing a base network
|Jan 31, 2002
|Nov 20, 2007
|Microsoft Corporation
|Secure end-to-end notification
|Feb 21, 2002
|Jul 1, 2008
|Corente, Inc.
|Methods and systems for resolving addressing conflicts based on tunnel information
|Dec 29, 2005
|Sep 2, 2008
|Nokia, Inc.
|Automated bulk configuration of network devices
|Jul 2, 2002
|Sep 2, 2008
|Lucent Technologies Inc.
|Method and apparatus for enabling peer-to-peer virtual private network (P2P-VPN) services in VPN-enabled network
|Jun 30, 2003
|Oct 28, 2008
|Nokia Corporation
|Method of implementing secure access
|Jun 30, 2003
|Nov 4, 2008
|Nokia, Inc.
|Method for implementing secure corporate communication
|Nov 30, 2001
|Apr 21, 2009
|Netapp, Inc.
|Decentralized virus scanning for stored data
|Jan 16, 2003
|May 12, 2009
|Corente, Inc.
|Methods and systems for firewalling virtual private networks
|Jul 2, 2004
|Feb 16, 2010
|Nippon Telegraph And Telephone Corporation
|Remote access VPN mediation method and mediation device
|Oct 7, 2002
|Mar 30, 2010
|Cisco Technology, Inc.
|Methods and apparatus for virtual private network fault tolerance
|Apr 27, 2006
|Apr 13, 2010
|Nokia Corporation
|Address translation in a communication system
|Dec 9, 2004
|Jun 1, 2010
|International Business Machines Corporation
|Authenticating a node requesting another node to perform work on behalf of yet another node
|Feb 11, 2004
|Aug 17, 2010
|Netapp, Inc.
|Policy engine to control the servicing of requests received by a storage server
|Sep 26, 2007
|Aug 24, 2010
|Netapp, Inc.
|Controlling access to storage resources by using access pattern based quotas
|Jun 10, 2003
|Oct 19, 2010
|Quest Software, Inc.
|Systems and methods for implementing protocol enforcement rules
|Oct 9, 2007
|Feb 1, 2011
|Quest Software, Inc.
|Systems and methods for managing messages in an enterprise network
|Mar 1, 2007
|May 10, 2011
|Kirchhoff Debra C
|Firewall-tolerant voice-over-internet-protocol (VoIP) emulating SSL or HTTP sessions embedding voice data in cookies
|Jan 18, 2008
|May 31, 2011
|Novell, Inc.
|Dynamically configuring a client for virtual private network (VPN) access
|Apr 12, 2004
|Jul 19, 2011
|Avaya, Inc.
|System and method for increasing call capacity for a wireless local area network
|Dec 10, 2007
|Aug 30, 2011
|Murata Machinery, Ltd.
|Relay server and relay communication system arranged to share resources between networks
|Jul 29, 2009
|Sep 13, 2011
|Stonesoft Corporation
|Virtual private network management
|Nov 22, 2002
|Jan 17, 2012
|Stonesoft Corporation
|Personalized firewall
|May 22, 2008
|Mar 20, 2012
|International Business Machines Corporation
|Network traffic control in peer-to-peer environments
|Jan 28, 2011
|Jun 5, 2012
|Quest Software, Inc.
|Systems and methods for managing messages in an enterprise network
|May 27, 2011
|Jan 8, 2013
|Oracle International Corporation
|Method and system for dynamically establishing a virtual private network (VPN) session
|Nov 14, 2007
|Apr 9, 2013
|Broadcom Corporation
|Method and system for traffic engineering in secured networks
|Oct 24, 2005
|Sep 10, 2013
|Crimson Corporation
|Systems and methods for distributed node detection and management
|Aug 29, 2008
|Sep 17, 2013
|Telefonaktiebolaget L M Ericsson (Publ)
|Prefix delegation in a communication network
|Sep 30, 2009
|Oct 22, 2013
|Inside Secure
|Application gateway system and method for maintaining security in a packet-switched information network
|Feb 2, 2012
|Dec 3, 2013
|Calix, Inc.
|Protecting optical transports from consecutive identical digits in optical computer networks
|Nov 1, 2006
|Feb 18, 2014
|Kabushiki Kaisha Toshiba
|Device and method for communicating with another communication device via network forwarding device
|Jul 26, 2002
|Apr 22, 2014
|Sierra Wireless, Inc.
|Always-on virtual private network access
|Feb 2, 2012
|May 20, 2014
|Calix, Inc.
|Protecting optical transports from consecutive identical digits in optical computer networks
|Aug 4, 2006
|Sep 9, 2014
|Ianywhere Solutions, Inc.
|Method, system, and computer program product for a relay server
|Oct 13, 2011
|Dec 23, 2014
|Phoenix Contact Gmbh & Co. Kg
|Process for establishing a VPN connection between two networks
|Jun 30, 2010
|Feb 10, 2015
|Alcatel Lucent
|Method and apparatus for reducing application update traffic in cellular networks
|Mar 22, 2001
|Feb 21, 2002
|Mark Tuomenoksa
|Method and system for managing and configuring virtual private networks
|Apr 11, 2001
|May 2, 2002
|Samuel Bendinelli
|Methods and systems for hairpins in virtual networks
|Apr 11, 2001
|May 9, 2002
|John Keane
|Methods and systems for managing virtual addresses for virtual networks
|Dec 15, 2000
|Jun 20, 2002
|Nanjundiah Viswanath
|Method of selectively compressing data packets
|Apr 11, 2001
|Jul 11, 2002
|Mark Tuomenoksa
|Methods and systems for partners in virtual networks
|Jul 26, 2002
|Apr 8, 2004
|Sierra Wireless, Inc. A Canadian Corp.
|Always-on virtual private network access
|Jun 10, 2003
|May 27, 2004
|Akonix Systems, Inc.
|Systems and methods for implementing protocol enforcement rules
|Mar 17, 2003
|Sep 23, 2004
|Inventec Appliances Corp.
|Method for accessing data from a company over the internet by cellular phone
|Apr 11, 2002
|Sep 30, 2004
|Docomo Communications Laboratories Usa, Inc.
|Method and associated apparatus for pre-authentication, preestablished virtual private network in heterogeneous access networks
|Feb 11, 2004
|Nov 18, 2004
|Armitano Robert M.
|Policy engine to control the servicing of requests received by a storage server
|Jun 30, 2003
|Dec 30, 2004
|Nokia, Inc.
|Method of implementing secure access
|Jun 30, 2003
|Dec 30, 2004
|Nokia, Inc.
|Method for implementing secure corporate Communication
|Apr 12, 2004
|Oct 13, 2005
|Liam Casey
|System and method for increasing call capacity for a wireless local area network
|Sep 1, 2004
|Mar 2, 2006
|Shuping Li
|Method, apparatus and system for remotely and dynamically configuring network elements in a network
|Aug 22, 2005
|May 4, 2006
|Peak B D
|Information relaying method, apparatus and/or computer program product
|Dec 9, 2004
|Jun 15, 2006
|Edwards Robert C Jr
|Authenticating a node requesting another node to perform work on behalf of yet another node
|Jul 2, 2004
|Jun 29, 2006
|Nippon Telegraph And Telephone Corporation
|Remote access vpn mediation method and mediation device
|Dec 29, 2005
|Jul 27, 2006
|Nokia Inc.
|Automated bulk configuration of network devices
|Jun 23, 2005
|Nov 2, 2006
|Nokia Corporation
|Establishment of a secure communication
|Nov 1, 2006
|May 17, 2007
|Kabushiki Kaisha Toshiba
|Device and method for communicating with another communication device via network forwarding device
|Aug 22, 2006
|Mar 13, 2008
|Annie Wong
|Secure call analysis and screening of a secure connection
|Aug 29, 2008
|Jun 16, 2011
|Anders Eriksson
|Prefix delegation in a communication network
|Jan 5, 2012
|Guo Katherine H
|Method and apparatus for reducing application update traffic in cellular networks
|Apr 19, 2012
|Phoenix Contact Gmbh & Co. Kg
|Process for establishing a vpn connection between two networks
|May 26, 2004
|Jan 5, 2005
|Nokia Corporation
|Method for implementing secure corporate communication
|Oct 24, 2008
|Apr 30, 2009
|Jonathan Peter Deutsch
|Various methods and apparatuses for a central station to allocate virtual ip addresses
|Dec 13, 2008
|Jul 23, 2009
|Microsoft Corp
|Untrusted gaming system access to online gaming service
|Dec 19, 2013
|Jun 25, 2015
|Empire Technology Development, Llc
|Peer-to-peer (p2p) code exchange facilitation in centrally managed online service
|U.S. Classification
|709/228, 709/229
|International Classification
|Cooperative Classification
|European Classification
|Oct 27, 2003
Owner name: GREENSTONE VENTURE PARTNERS, L.P., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ETUNNELS INC.;REEL/FRAME:014617/0601
Effective date: 20030918
|Jun 23, 2004
Owner name: GREENSTONE VENTURES, L.P., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ETUNNELS, INC.;REEL/FRAME:014771/0318
Effective date: 20030918
Owner name: GREENSTONE VENTURE PARTNERS, L.P., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ETUNNELS, INC.;REEL/FRAME:014771/0318
Effective date: 20030918
Owner name: GREENSTONE ASSOCIATES, L.P., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ETUNNELS, INC.;REEL/FRAME:014771/0318
Effective date: 20030918
Owner name: GREENSTONE VENTURE ASSOCIATES, L.P., CANADA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:ETUNNELS, INC.;REEL/FRAME:014771/0318
Effective date: 20030918


text:
Update Required To play the media you will need to either update your browser to a recent version or update your Flash plugin.
"The issues of the day, particularly energy, are centered here. What's happening in Houston and what we study in Houston are going to have implications nationally," he said. ξξ
The Center for Public Policy currently is compiling information for a Houston real estate database.ξ Researchers also have examined the Houston economy, politics and elections, the efficiency of Conducted Energy Devices and, for the state, demographics of lottery players.
"The biggest selling point this center has is how we study something," Granato said.ξ "We want to bring a combination of case study, statistical analysis, mathematical modeling and visualization."ξ
In addition, through partnerships with state and federal elected officials, more than 225 students have interned in government offices through the successful Mickey Leland Congressional Internships — a program that has produced a new generation of public servants.ξ
The Center for Public Policy is part of what's happening at the University of Houston. I'm Marisa Ramirez.ξ
Telling the stories of the University of Houston, this UH Moment is brought to you by KUHF, listener supported radio from the University of Houston.

subset: commoncrawl


text:
Request a quote
Allows growers to move their lamp up and down to keep light close to the canopy and move the light upwards as the plants grow. This sturdy unit comes with a pull-string for quick and easy adjustment of lamp height. Ready to install with headrail, two 3.5" screws and two washers.


text:
|Company Name
|Years of Experience
academic evaluation, copywriting, fact checking, fiction-all, fiction-genre, research
Recent Global Posts
Susan Spann wrote a new post, Seventeen factors to prohibit glyphosate, on the site Susan Spann 19 hours, 6 minutes ago
When you head to take the test, make sure you wear comfy garments.Edit Article Howto Write a Resume Cover Letter A solid employment cover letter advances the possibility when applying for a management place of […]
Janice Campbell wrote a new post, Member April Michelle Davis on IndieGoGo, on the site NAIWE NewsWire 1 day, 10 hours ago
NAIWE member April Michelle Davis has opened a crowdfunding campaign to support the publishing costs of her latest book, A Princess in Disguise. Originally written almost 20 years ago, A Princess in Disguise is a […]
Lisa Hutchins wrote a new post, Where We Come From, on the site Lisa Hutchins 4 days, 7 hours ago
Whitney Hopler wrote a new post, Renewing Your Mind: Mansions in Your Mind, on the site Whitney Hopler 6 days, 18 hours ago
Every thought you think helps shape your mind, wiring your brain's neurons into patterns that affect how healthy your mind becomes. I've learned through my recent work on articles about near-death experiences […]
Lisa Hutchins wrote a new post, Crows, Death and Memory, on the site Lisa Hutchins 1 week, 2 days ago
Whitney Hopler wrote a new post, Renewing Your Mind: Music a Primal Force, on the site Whitney Hopler 1 week, 6 days ago
Has a song made you laugh or cry lately? Music powerfully affects our emotions — and when we want to express something that we can't find the words to articulate, music can communicate the essence of what we're […]
Claudia Suzanne wrote a new post, Don't Forget to Line Edit!, on the site Claudia Suzanne 2 weeks ago
Lisa Hutchins wrote a new post, Blood Moon, Elk Moon, on the site Lisa Hutchins 2 weeks, 2 days ago
Lisa Hutchins wrote a new post, Trashcans and Playfulness, on the site Lisa Hutchins 2 weeks, 4 days ago
Can't stop talking about bears! According to the Denver Post, the Colorado bear situation has gone crazy this year. Hubby and I are in the midst of trying to find a bear-proof trashcan, now […]
Lisa Hutchins wrote a new post, The New Year of Autumn, on the site Lisa Hutchins 2 weeks, 6 days ago


text:
- Visit
- Explore
- Get Involved
- Connect
- Educators
- Kids
- Researchers
- Newsroom
Skip navigation
April 30, 1999 – January 2, 2000
Museum: Natural History Museum
Location: 1st Floor, Center, Hall 10
An in-depth look at the 10,000-year-old culture of the Ainu, the indigenous people of Japan, is revealed through some 200 objects and artworks. The exhibition considers the effects of environmental, historical, and social forces on this culture through the following themes: spirituality, trade, cultural identity, contemporary vitality, and fine art.
The Ainu historical experience mirrors the experience of indigenous peoples in many parts of the world, including Native Americans in the United States. Highlights include a depiction of the iyomante ceremony in which a bear is ritually slain to send its spirit back to its divine origins, a full-scale model of a chise, the home and center of Ainu life, and a large model of a sea-going canoe carved for the exhibition by an Ainu craftsman. Also on view are contemporary sculpture, textile art, painting, and jewelry.
2 videos
Related publication


text:
- Subscribe now!... Get rid of ADs!Support Power Line...VIP MembershipPresentsPower Line
Most Read on Power Line
Our Favorites
- American Thinker
- Andrew Malcolm
- Armavirumque
- Belmont Club
- Big Government
- Big Hollywood
- Big Journalism
- Big Lizards
- Big Peace
- Breitbart
- Claremont Institute
- Dartblog
- Gateway Pundit
- Hot Air
- Hugh Hewitt
- InstaPundit
- Iowahawk
- Legal Insurrection
- Library of Law and Liberty
- Lileks
- Lucianne
- Michelle Malkin
- Real Clear Politics
- Ricochet
- Roger L. Simon
- Tim Blair
- Urgent Agenda
Subscribe to Power Line by Email
Find us on Facebook
"Arise and take our stand for freedom as in the olden time." Winston Churchill
"Proclaim Liberty throughout All the land unto All the Inhabitants Thereof." Inscription on the Liberty Bell
Fake Indian takes real scalp
Senator Elizabeth Warren is a blatantly fake Indian, but late last month she took a real (if metaphorical) scalp. Warren prompted the Brookings Institution to force the resignation of the Brookings-affiliated scholar Robert Litan. Litan had been affiliated with Brookings off and on for some 40 years. Once Warren complained about him to Brookings President Strobe Talbott, however, Brookings snapped to attention. Litan promptly resigned his unpaid position with Brookings. »
Bipartisan sentencing reform introduced; career prosecutors denounce it
Today, as expected, a bipartisan collection of Senators introduced sentencing reform legislation. The nine Senators sponsoring the legislation are: Grassley, Graham, Cornyn, and Lee on the Republican side and a rogue's gallery of Democrats — Leahy, Durbin, Schumer, Whitehouse, and Booker. The last of these Democrats, a teller of tale tales, is credited with much of the work. The legislation could have been worse, but it isn't worthy of passage »
Can "Liberalism" Be Reclaimed from the Left?
Harvey Mansfield remarked a while back that "the job of conservatism is to save liberalism from liberals." The left may be giving us an unintended assist with this project. One of the best things to happen to political discourse in recent years is that many leftists stopped calling themselves "liberal," and adopted "progressive" instead. Even Hillary Clinton for a time, back around 2007, said "I'm not a liberal—I'm a progressive." »
Vox: The Web Site For Dummies
This is hilarious: Vox.com, the web site into which NBC is about to pour $200 million, tweeted this earlier today. It's a screen shot because Vox deleted the tweet in response to intense ridicule: I guess this is what happens when you get your news from uneducated 20-somethings with little or no experience, employment or otherwise. Hey, NBC: if you want to reconsider, you can buy our whole site for »
Obama: Look How Crazy the Republicans Are!
Barack Obama returned from his latest vacation yesterday, and promptly announced that Republicans are "crazies." The Democrats continued the theme with a fundraising email they sent out earlier this afternoon, ostensibly from the President: John — A few days ago, the leading candidate to be the other side's presidential nominee claimed that the 14th Amendment to the Constitution was — somehow — unconstitutional. He is referring to Donald Trump. This »
You Can Live Like Michael Moore!—For $5.2 Million
Michael Moore's humble lakeside house in the shores of Central Lake, Michigan, is for sale. Even the Hollywood industry tabloid Variety is properly snarky about the abode of this tribune of the oppressed working class: The estate, which the Detroit News once described as "two large houses joined at the hip, bordered by a third house," includes an 11,058-square-foot main residence — a rustic-luxe, modern-minded play on a lodge-like log »
Bob Reich, Down and Dirty on Iran
Robert Reich, former Secretary of Labor, has become a darling of the far left. MoveOn.org's emails sometimes feature his laughably old-school-left videos. But he is still viewed as an important and mainstream supporter of the Obama administration. Yesterday, Reich went on Facebook to join in the administration's campaign of vilification against those who oppose its deal with Iran's mullahs. He started on a conciliatory note: Although there are important arguments »
Scenes from the Reich
Last week we featured observations from Angelo Codevilla, author of The Ruling Class, on the deeper sources of Trump's appeal, namely, that Trump is talking back to the ruling class in a way no other candidate can or will. Yesterday Robert Reich came in on the same theme from the left in the Christian Science Monitor, examining the appeal of Trump and Bernie Sanders: Yet as enthusiasm for the bombastic »
Hillary's Supporters Want to Repeal the Bill of Rights
This is a man in the street video filmed by Mark Dice in San Diego. I don't know anything about Dice, but these Hillary supporters have got to go: if you tell them that Hillary wants to repeal the Bill of Rights, they are on board. No one ever said democracy would work if people are stupid. Still, no matter how low your expectations are, this is painful: »
To Honor Cecil the Lion, a $36,000 Smart Phone
The most overblown news story of modern times shows no sign of going away. If you are still brokenhearted over the cruel fate of Cecil the lion, how can you assuage your pain? With a $36,000 smart phone dedicated to his memory: The Telegraph reports: [G]old plating company Goldgenie has provided a unique way of remembering the mighty lion – by committing Cecil's image to a gold HTC One M9 »
Civil War on the Left, Part 20
Bezerkeley, I tell ya. You may wish to hesitate before clicking through on this link, because of contains disturbing photos of naked people protesting against the removal of eucalyptus trees in that fair city, because trees are people too. Or something. Put it this way: if these folks went to a Woodstock reunion, they'd probably use LSD suppositories. Here's the relevant part of the news story, so as to spare »
Can A Nobel Prize Be Far Behind?
You know it's a bad deal when within hours, there is talk of a Nobel Peace Prize in the air. Carl Bildt, Sweden's former Prime Minister, tweeted: I think the work of the Nobel Committee of the Norwegian Parliament this year just got much easier. — Carl Bildt (@carlbildt) July 14, 2015 Bildt echoes an email that MoveOn.org sent out today: We've all seen presidents drag us into war. It's »
A Bonehead Move by Republicans on the Confederate Flag [Updated]
Today's Minneapolis Star Tribune features this headline: Rep. McCollum: "Hell no" to GOP backing of Confederate flag at national parks. No, I thought, that can't possibly be right. But it was: Republicans on Thursday yanked an Interior Department spending bill off the floor after last-minute Confederate flag amendments threatened to blow it up — to the outrage of Rep. Betty McCollum, the highest-ranking Democrat on the committee. McCollum, who represents »
New York Times: The Ultimate in Hypocrisy
This is from yesterday's Twitchy, but, assuming that most of our readers don't haunt Twitter, it bears repeating here. Following the Charlie Hebdo murders, the New York Times covered the terrorist attack, but declined to print any of Charlie Hebdo's mocking images of Muhammad. The paper self-righteously declared a policy against showing religious images that may be deemed offensive: "Out of respect to our readers we have avoided those we »
The quest for ideological purity in Supreme Court Justices
In our podcast last week, we tried to explain why Democratic-appointed Supreme Court Justices march in lockstep in the big, closely divided Supreme Court cases, while one Republican-appointed Justice (Anthony Kennedy) cannot be counted on at all to vote with his more reliably conservative brethren and a second (John Roberts) has parted company in two of most important cases decided in his tenure. I offered one possible explanation. Liberalism, I »
The Democrats Get Their Crazy On
The floodgates are open, and craziness is pouring out. The Democrats' Confederate flag victory has them lusting for more. Hillary Clinton says South Carolina is only the beginning: "It shouldn't fly there. It shouldn't fly anywhere," Mrs. Clinton said of South Carolina…. In her discussion Tuesday with community leaders at Christ the King United Church of Christ in Florissant, Mo., Mrs. Clinton said the flag's removal would be "just the »


text:
The HPD Helicopter Patrol, known as FOX units could arrive on the scene in a matter of minutes. But operations are being drastically reduced from about 20-plus hours in the air to about 3 total hours each day.
Houston City Councilmember Brad Bradford spent 24 years with HPD, including seven years as police chief. He says no city department is immune from budget constraints:
"That is correct and to say that we have to tighten our belt in the city of Houston that is the proper thing to do. But we should not be reducing safety services, to the extent that grounding HPD helicopters will bring about."
The cutbacks mean that a dozen helicopters — worth a million dollars apiece — will sit idle in the HPD hangar at Hobby Airport. Bradford says routine patrols that have been a department standard for years are out.
"I know the value of having a tool like having police helicopters are in the sky. It enhances officers' safety and citizens on the ground as well."
Retired Houston Police Officer and councilmember Ed Gonzalez agrees with Bradford:
"I know first hand how critical these helicopters and their pilots can be in assisting ground troops. They can help sometimes with car chases. It's a lot easier or more safe for a helicopter to be able to gain control of that chase, for example, by being the eyes that hover above, or sometimes if they're pursuing a suspect on foot as well."
He says a city as big as Houston cannot exist without police presence in the air.
"If we want to put a high value on that in terms of public safety, which already expends a high percentage of our general fund, then I think we also need to be pro-active as councilmembers, and see if we can help identify area that we do want to cut."
The changes mean that HPD choppers will only be sent on:
- "Assist the officer" calls — the highest priority call when an officer is in trouble.
- When a child is missing
- To assist in an "Active manhunt" when a perimeter has been established by ground units
- During a vehicle chase.
Like Bradford and Gonzalez, Councilmember James Rodriguez calls the situation a priority:
"I'm trying to contact Police Chief McClelland to set up a meeting, to see what we can do. I believe our public safety chairwoman, Councilmember Noriega will probably be bringing this to committee as well, so we can flush this out and study it a little bit more closely."
He agrees with Councilmember Bradford who said resources must be found to return the HPD Fox Unit to the air.


text:
Vimes's ReportThis quest was marked obsolete by Blizzard and cannot be obtained or completed. Bring Vimes's Report to Lady Jaina Proudmoore in Theramore.
|Vimes' Report (Provided)
DescriptionYou've done some good work, <name>, best I've seen from an amateur.
Lady Proudmoore asked that I keep her apprised of this delicate situation, and I haven't spoken to her for some time now.
I was going to deliver my report to her later, but it seems more fitting that you should be the one to speak with her about it. You can probably answer her questions better than I could.
GainsUpon completion of this quest you will gain:
- 390 experience


text:
Leave the beach for a few hours to discover Oujda's marvellous heritage. Culture, crafts, monuments, enjoy this quiet town.
Go and discover Oujda, 60 km to the south of Saida. An intact and picturesque medina with its souks overflowing with local craft productions and the towering fortifications of its kasbah. It is an entire world that opens its arms to you.
To enter the old medina, on the eastern side, you must go through the impressive Bab Sidi Abdel Wahab gothic-style gate. It is said that the severed heads of the rebels were exhibited here. Bab El Gharbi, one of the three main gates to the medina on its west side, which takes on red hues at sunset, is of a smaller size but is quite charming. Take in the tumultuous history of this ancestral town.
The great mosque was built at the end of the 13th century and is the oldest of the medina's monuments. The three fountains set against its walls contribute to the serenity conducive to faith. To the right of the mosque's main entrance, a street leads to a masterpiece of 14th century architecture, the merinide medersa. This venerable Koranic school is considered to be the jewel of Oujda.
In 1938, a rich trader built a superb palace, Dar Sebti, that can be visited. It now hosts a cultural centre dedicated to Arabo-Andalusian music, referred to here as Gharnatian music. With a little luck, you may see traditional Laalaoui dances and singing...
Saidia is the ideal departure point to visit Oujda. A walled town with majestic gates, with its souks and local dance and music to discover.
Need vacation ideas?


text:
Internet Banking
Mobile Banking
Withdraw cash without an ATM card, discover privileges on your phone, bank on the go, and much more.
Available for Android and iOS.
Available for Android and iOS.
More than 1200 ATMs island-wide offering cash withdrawal, balance enquiry, Cash Card Top-up and NETS Flashpay Top-up.
UOB eNets
With UOB eNets, you can pay for your online transactions by debiting from your UOB Savings or Current account.
Phone Banking
Dial UOB's banking services anytime and anywhere with our quick and convenient phone banking services.
- You can now access your Supplementary Retirement Scheme (SRS) portfolio and make contribution online to enjoy tax savings. Simply log in to UOB Personal Internet Banking and select EPS/Securities/CPFIS/SRS > Make SRS Contribution.
- Bank at one go with fewer steps. Smart Click lets you pay your bills, transfer funds and send mobile cash from your previously saved transactions.
Learn more >


text:
The agreement reached between the city and PNC Multifamily Capital, a national bank and investor, ends any conflict regarding the Metropolitan, Glendale and Vassar City Lights housing projects, which it controlled, City Atty. Mike Garcia said.
The $3.5 million will be used by the Housing Authority, but Garcia declined to comment on what project.
The city had issued a $13.9-million loan for the Vassar project, an affordable housing complex on San Fernando Road.
Once PNC completed the project, it applied to the state to receive tax credits. But it didn't need to use all of the proceeds, so company officials agreed to return the funds to the Housing Authority.
"As we entered the litigation, we were trying to recoup as much of the funds that we believed had been fraudulently obtained once we learned about it," Garcia said. "These funds are used to provide affordable housing throughout our community."
The city filed a lawsuit in April 2011 against ADI for allegedly inflating costs for construction work, falsifying accounting records and engaging in other fraudulent activities.
While the city has reached one settlement in the case, litigation is still ongoing with ADI and its principals, which include its former president Salim Karimi and company founder Ajit Mithaiwala.
Glendale has paid ADI roughly $34 million since 2005 for four projects, which include Metro Loma in south Glendale.
A court-appointed receiver, David Pasternak, alleged in court documents that ADI reported $24.7 million in construction costs for Vassar City Lights, but about $6.5 million was fraudulent.
Follow Veronica Rocha on Google+ and on Twitter: @VeronicaRochaLA.
New restaurants getting ready to open in Montrose
Glendale police sergeant makes lieutenant
Longtime Montrose search team member steps down


text:
It's D-Day for 'The Missile' with James Magnussen stepping out to the pool to compete for the first time since the disastrous 4 x 100m men's relay final.
Critics have launched into the reigning 100m freestyle world champion after his swim in the opening leg of the relay was almost a second outside his personal best.
He and relay teammate James Roberts, the fastest two men in the world this year in this event, will be out to prove the critics wrong by securing inside lanes for the semi-finals with good times in the heat.
Alicia Coutts and Stephanie Rice will be out to topple Chinese sensation Ye Shiwen in the 200m individual medley final after qualifying second and fifth fastest respectively.
The men's 200m freestyle relay team will be out to secure a medal after Australia won bronze in Beijing. The Americans will be favourites with the new-look Aussie team to be spearheaded by Kenrick Monk and Thomas Fraser-Holmes.
Rachel Bugg and four-time Olympian Loudy Wiggins will be in action as the medals are decided in the women's synchronised diving.
The Sharks will be back in the pool for their second match against Kazakhstan.
The Boomers will be underdogs in their second match against basketball powerhouse Spain.
There's also the second match of the Hockeyroos' campaign after their shock loss to New Zealand in the opening match.
The Australian men's volleyball team will go in as favourites against Great Britain in their second match.
There are two Aussies in action at ExCel Arena in the boxing, with Jeff Horn and Billy Ward in action in the light flyweight and the welterweight division respectively.
The eventing medals will be decided with the Australians out of contention after a disastrous day in the cross country.
It's a full day in the rowing at Eton Dorney with Australia's Olympic champions Scott Brennan and David Crawshay in action in the semi-finals of the men's double sculls.
Australia's lightweight men's four will follow Brennan and Crawshay.


text:
The Rundown: Are the Heavens Opening?
Yesterday Rex Ryan confessed that there's a little bit of schadenfeude that comes with this time of the season, especially when your team is 6-6 and scratching for the playoffs is just focusing on the game ahead, not what other teams are doing.
Sure, a few teams in the AFC playoff mix lost and helped improve the Jets' chances, but Ryan isn't concerned about all that, right?
"All I'm worried about is this next game that we play," Ryan said Monday. "That's where the entire focus is – as far as anybody knows."
Then came a laugh and an admission.
"It was like, "Whoa!' " Ryan said, his true feelings bursting out. "To think that I wasn't cheering for the Oakland Raiders against Pittsburgh, OK, I'll admit it, I was cheering for Oakland. Tonight, as much as I love the Ravens and all the people there, I'll be cheering for Green Bay. It's that time of year."
Yep, when every loss counts and your playoff status can improve while you're sitting home watching games on TV.
"I was watching games yesterday and I saw that New England lost," right tackle Damien Woody said. "Pittsburgh lost and hopefully Baltimore loses. Things are really falling our way for us, but first and foremost, we've got to handle our business and keep winning ballgames. If we do that, I think good things will happen for us."
After last night, the door opened a little wider for the Jets on account of the Ravens loss on Monday Night.
Green Bay won for the fourth time in a row and improved to 8-4 after Monday night's game, matching Philadelphia for the last two National Conference playoff berths with the New York Giants one game behind.
Baltimore fell to 6-6, dropping level with Pittsburgh, Miami and the New York Jets with all of them one game behind Jacksonville for the last American Conference playoff spot.
In a mess of a game played in cold conditions, the teams combined for 310 yards in penalties whistled, matching the second-largest total in any game in NFL history.
Now, there's a number of teams at 6-6 (Baltimore, Miami, NY Jets, Pittsburgh) with just two teams above them for Wildcard spots, Denver at 8-4, while Jacksonville sits at 7-5. The Jets will still need to win out to have a chance, but this was a good weekend to at least keep the games for the Jets competitive for the coming weeks.


text:
Q: For six years I've had a pair of hydrangea bushes that hardly bloom. When I bought them, they had gorgeous globes of blue flowers. I prune them by about a third every year in late summer. Once I tried a special fertilizer recommended by my nursery, and I didn't get any flowers the following year. Is there some trick? — Esther Kitchen, Millersburg, Pa.
A: You are pruning them back way too much. You have the old-fashioned Hydrangea macrophylla, whose flowers come from buds along stems that developed the previous summer, and you are cutting them off. The simplest rule for pruning hydrangeas is: Don't. Most hydrangeas grow well with no pruning at all, and basically you should cut only enough stem to use the flowers in arrangements. The plants will grow a little bigger each season, so if you need to keep your hydrangeas in bounds, you will need to prune them a bit each year. But that doesn't mean a radical haircut with hedge clippers. The best way to prune hydrangeas and still get flowers is to cut some of the oldest stems at ground level — about a quarter of them — during the dormant season. (Later is better because sometimes extreme cold or ice will damage some of the stems, and those you should cut out first.) Then shorten remaining stems by just a few inches, cutting back two or three leaf nodes because the flowers form on new growth that comes from year-old wood. You will end up with a natural-looking plant about 4 to 6 feet tall. If that is still too tall, consider a variety that is naturally shorter. There are hundreds of varieties of H. macrophylla. Most grow in the 4- to 6-foot range, but there are a few that are typically 3 to 4 feet. Shortest of all is 'Pia,' which matures at just 2 to 3 feet. It's surprising that the nursery recommended fertilizer, which encourages foliage at the expense of flowers. Generally all hydrangeas need is a mulch of shredded leaves or well-composted bark, which also conserves soil moisture. Give them that, prune judiciously late in the dormant season, and you should soon have a fine crop of flowers.


text:
Points of Pride Research Day
Wednesday, October 7
- Poster session and reception: 1:30 p.m.
- Seminars and awards ceremony: 3:00 p.m.
Pomeroy Student-Alumni Learning Center
Scholars Reception
Wednesday, October 28
Pomeroy Student-Alumni Learning Center
By invitation only
2016 White Coat Ceremony
Saturday, April 16
2016 Commencement
Saturday, May 7
More events
For more calendar items, see CVM NewsCalendar.
CALLM (Companion Animal Love, Loss, and Memories) Group
Second and fourth Wednesday of each month
6:30-8 p.m.
St. Paul Campus
This biweekly bereavement group directed toward supporting the grief process of veterinary patients' families. Whether you are facing overwhelming treatment decisions, end-of-life issues, or the recent death of your companion animal, the CALLM Group will provide you with a supportive and confidential environment in which to share your experiences and feelings. CALLM sessions are facilitated by Veterinary Medical Center Social Work Services staff.
Cost: Sessions are free and open to the public. Space is limited! For more information and to reserve your seat, please contact VMC Social Work Services at 612-624-9372.


text: Close Tweet0 Share0 Comment0 Share0 Share0 Stumble It0 Print0 More Campus Union BYU, Bronco Mendenhall agree to contract extension through 2016 by Zac Ellis Twitter Email Posted: Wed Jun. 26, 2013 Bronco Mendenhall has led BYU to eight consecutive bowl games, including four straight wins. (Ray Carlin/Icon SMI)By Zac EllisBYU and head coach Bronco Mendenhall have agreed to a contract extension that will keep the coach in Provo through 2016, the school announced Wednesday."BYU is a special place and this is a special time," Mendenhall said. "I'm excited to build on the success of our program over past eight years, and I think there's much more that we can accomplish at BYU."Mendenhall's previous deal was set to expire before this coming season, but the school was expected to extend the coach's contract."I am thrilled to have Bronco signed as our head football coach through the 2016 season," said BYU director of athletics Tom Holmoe. "Over the past eight seasons, his leadership has guided our football program back to national prominence through top-25 rankings, bowl victories, All-American athletes and overall excitement at LaVell Edwards Stadium. I look forward to what the next four years will bring with the new era of BYU football."The Cougars went 14-21 without a bowl appearance in the three seasons before Mendenhall took over as head coach in 2005. Since then, BYU ranks 12th nationally in total wins and has managed eight consecutive bowl appearances. The Cougars have earned a Top 25 ranking in all but one of the past eight seasons, including five times at season's end. In 2012, BYU capped an 8-5 season with a 23-6 win over San Diego State in the Poinsettia Bowl. The Cougars kick off the 2013 season on Aug. 31 against Virginia. Promoted Stories Comments


text:
Lessons from a FinTech CEO
For some people, fear and money go hand in hand
Join the NASDAQ Community today and get free, instant access to portfolios, stock ratings, real-time alerts, and more!
Pretium Resources Inc. (
) reported drilling results at its high-grade gold Brucejack
Project in northern British Columbia. Drilling results from the
ongoing program at the Valley of the Kings, showed a number of
assays with more than 1,000 grams per tonne gold.
A total of 26,230 meters of drilling in 60 holes has been
completed in this first phase of the 2012 Brucejack Exploration
Program, which has now concluded, an updated resource estimate for
Brucejack is expected in the third quarter and will be used in the
feasibility study currently underway.
Phase two of the 2012 Brucejack Exploration Program is now
underway and focused on high-grade definition drilling of the
shallow high-grade resources at the Valley of the Kings and testing
extensions of the Valley of the Kings and other high-grade
PVG is now higher by about 6%, cutting earlier gains, at $15.42.
Volume traded is over 1 million.
Enter up to 25 symbols separated by commas or spaces in the text box below. These symbols will be available during your session for use on applicable pages.
You have selected to change your default setting for the Quote Search. This will now be your default target page;
unless you change your configuration again, or you delete your
cookies. Are you sure you want to change your settings?


text:
We're kicking off National Coffee Week with some of our favorite iced coffee recipes. Great iced coffee is a must in the summer months, but many people enjoy iced coffee year round, especially in warmer climates. It's still very temperate in September, so try some of these recipes and let us know what you think.
If you have made extra coffee, don't let it sit on the warming plate. Just remove the coffee and let it cool to room temperature before pouring into ice cube trays and freezing. Add the frozen cubes to your favorite iced coffee recipe so the flavor doesn't get diluted.
If you have leftover iced coffee from one of the recipes below, pour the mix into ice pop molds and freeze. These make a great treat on a hot day or to use as a handy snack to pull out of the freezer for unexpected guests.
To learn more about Hamilton Beach coffee products, click here.
TAGS: coffee, coffeemaker
CATEGORIES: drinks, Everyday Recipes


text:
Old World Mortar Installations For Over 30 Years
We specialize in residential remodels and new home installations. No shortcuts, just the time-tested, old world, mortar methods are good enough for us and our customers.
This is an example of a widget area that you can place text to describe a product or service. You can also use other WordPress widgets such as recent posts, recent comments, a tag cloud or more.
Copyright © 2015 · Website by Dustin Ward · Log in


text:
Kiva U's New Online Game - Global Impact!
- Try your hand at 'Global Impact' by making loans, helping borrowers around the world get their businesses going and keeping yourself healthy and strong along the way! See how high you can score and how many borrowers lives you can change! **NEW** Check out Volume 1 of our Global Impact Game Guide to help you and your kids/students dig deeper and learn more using this cool, interactive game and guide!
Make Your Own Eternal Impact
- Check out this short video about one classroom's experience changing lives with Kiva U!
- And this video celebrating Kiva U's first year accomplishments!
These resources contain everything you need to set up a team, motivate members, and spread the word to others about microfinance and Kiva.
Take Action
- Bringing Kiva to Your School: A Step by Step Guide!
- Speaker Resource Center: Timeline & Tools
- Starting & Growing Your Kiva U Club
- Utilizing Social Media & Blogging
- Hosting an Event
- Mastering Photo & Film
- Action Planning
- Resource Reviews (Books, Films, and More!)
- "What is Kiva" Presentation Slides for External Use
Event-Prints Kiva U Popcorn Holder
Learn More
Poverty, Financial Inclusion & Kiva
- Social Justice vs. Charity: Discussion Guide
- What are Catalytic Loans?
- Who Are the Newest Kiva Partners?
- Innovations: Kiva and the Birth of Person-to-Person Microfinance
- Innovations: Kiva at Four
- VIDEO Eternal Impact: The Million Dollar Kiva U Team
Building Financial Literacy
- Financial Literacy 101
- Needs vs. Wants Activity
- Understanding Loans & Credit
- Budgeting: How-to Guide
- Goal Setting: How-to Guide
Additional Resources
One Hen: One Hen is a fantastic book that serves as a beautiful, true, and inspiring introduction to microfinance through the story of a boy in Ghana and his hen. The book and the extensive resources hosted on the website are highly recommended for parents and educators hoping to build a better understanding of live in Ghana, poverty, and how microfinance works with children.
William Ferriter: A Kiva-savvy educator and published author who has created a plethora of incredible resources using Kiva in the classroom. Check out this excellent blog and these fantastic and comprehensive resources to use or get inspired!
Lend for America: This is a non-profit organization that supports university students in facilitating microfinance to entrepreneurs in their own communities. Check out their website and their excellent Campus Microfinance Starter-Kit.
+Acumen: Our friends at +Acumen are also working to help support the newest generation of leaders in social innovation. Check out their free courses online. There's an exciting one on financial sustainability coming up.
Ashoka: The team at Ashoka has created a course in empathy. By completing this free course, you will gain tips and ideas from schools, entrepreneurs, and experts on how to instill empathy in children and prepare them for the road ahead.
Girl Rising: Educating girls can change the world, but there are still millions of girls who never get that opportunity. Girl Rising is a film and a movement, and also features fantastic educator resources, available here.
BYU: A group of university students from Brigham Young University in Provo, Utah surveyed and experimented with coordinating a Kiva U event on their campus. They collected their learnings and tips for success in this helpful video guide and slideshow.
Bill & Melinda Gates Foundation: In their 2014 annual letter, the Gates cover 3 myths that block progress for the poor.
What works in ending poverty? Here is an article from BRAC with a new apporach to help the ultra-poor move to a place of sustainable livelihoods in 24 months.


text:
From our Chicago office:
For as low as £59 (US$94) per night including tax, Chicago's top sights and shopping are just outside the doors of a AAA 4-Diamond hotel, ideally placed between Michigan Avenue and Millennium Park.
This deal, saving 35% on current prices at the Hyatt Regency Chicago, is available over the following dates, including Thanksgiving, Christmas and weekends:
Surrounding dates are also discounted.
After a $168 million renovation last spring, the riverfront hotel features an updated lobby, restaurant, bar and guest rooms. It also holds the title as the largest hotel in Chicago and offers guests a 24-hour fitness center and five restaurants, including a steakhouse and an Irish pub.
Travelzoo Tip: No need to leave the hotel for dinner. A steak dinner for two with wine at Stetsons is half off.
Please go to your email and confirm your subscription.


text:
Berg- Richard W. Attorney
P.O. Box 222
Fanwood, New Jersey 07023
United States
Click Here For More Information
- When to File for a Divorce
- Accidents in Construction Sites
- The Essentials of a Last Will and Testament
- Let a DUI Lawyer Handle Your Case
- A Need for An Accident Lawyer
- Hire a Lawyer for Truck Driving Related Accidents
- California car accident attorneys
- Injuries during plane travel can be confusing & complicated
- California summers mean a spike in outdoor activities & accidents
- Slips, bumps, stubs, breaks, falls, cuncussions. Even little injuries can have big consequence
- Read more stories >>


text:
Strawberry Recipes
Strawberries and Vodka Frozen Cocktail
For best flavor, head to the farmers' market for peak-season fruit. Freeze in a single layer on a parchment-lined rimmed baking sheet until solid.
Strawberry-Graham Scones
Using a cookie cutter as a guide to shape and form the scones instead of rolling and cutting them out ensures tenderness.
Chouquettes with Warm Berries
The dough for these airy desserts is also the foundation for éclairs, cream puffs, and pâte à choux. Minus the ice cream and berries, they make a sweet little breakfast pastry.
Strawberry-Basil Shortcakes
We love the combination of gently cooked and raw strawberries in this not-too-sweet version of the classic dessert.
Strawberry-Rhubarb Salad with Mint and Hazelnuts
Strawberries and rhubarb are a power duo in pie; here raw rhubarb plays a tart counter to sweet strawberries.
Strawberry-Elderflower Cake
It's airy, light, and sweet, but this delicate cake gets pucker and punch from vinegar in both the icing and the filling.
Strawberry-Pineapple Hotness
A perfect use for that leftover can of chipotles in adobo hiding in the fridge.
Strawberry Sufganiyot
The best thing about Hanukkah? Pillowy, deep-fried sufganiyot filled with strawberry jelly.
Roasted Strawberry-Buttermilk Sherbet
For the record: Sherbets may contain some dairy, unlike sorbets, which do not.


text:
The Better Business Bureau is warning consumers to beware of a scam using the name of the Publishers Clearing House Sweepstakes.
The BBB says someone is sending official-looking letters to people's homes, claiming that the recipients have won $1 million from the Publishers Clearing House.
There are several ways to recognize the scam offer:
The BBB says the checks are fraudulent and any money wired to the scammers cannot be recovered.


text:
The Style Gallery is a great new way for you to view, love, and share outfit photos. It's meant to showcase
all the expressive, creative, and inspirational personalities of our community!
Love you too!
Your email has been sent!
If laid-back looks make you bat your lashes, then this teal T-shirt will send your heart aflutter! From its cap sleeves and V-neck down to its tunic-length shark tail hem, this breezy tee adds an easygoing twinkle to your eye.
All measurements in inches.
Sorry this item isn't available anymore
Remarkable fashion & decor, inspired by our community, & delivered with uncommon care.
Copyright ©2002-2015 ModCloth.com. All Rights Reserved.
Site Map
CA Notice
Privacy & Security
Terms of Use