text:
Patent application title: Method and Apparatus for Trust-Based, Fine-Grained Rate Limiting of Network Requests
Christopher Newell Toomey (Cupertino, CA, US)
IPC8 Class: AG06F2120FI
USPC Class:
726 9
Class name: Network credential tokens (e.g., smartcards or dongles, etc.)
Publication date: 2013-03-14
Patent application number: 20130067555
Sign up to receive free email alerts when patent applications with chosen keywords are published SIGN UP
A method and apparatus for fine-grained, trust-based rate limiting of
network requests distinguishes trusted network traffic from untrusted
network traffic at the granularity of an individual user/machine
combination, so that network traffic policing measures are readily
implemented against untrusted and potentially hostile traffic without
compromising service to trusted users. A server establishes a user/client
pair as trusted by issuing a trust token to the client when successfully
authenticating to the server for the first time. Subsequently, the client
provides the trust token at login. At the server, rate policies apportion
bandwidth according to type of traffic: network requests that include a
valid trust token are granted highest priority. Rate policies further
specify bandwidth restrictions imposed for untrusted network traffic.
This scheme enables the server to throttle untrusted password-guessing
requests from crackers without penalizing most friendly logins and only
slightly penalizing the relatively few untrusted friendly logins.
1. A method of limiting unauthorized network requests, comprising the
steps of: issuing a trust token to each unique user ID-client machine
combination successfully authenticating to a network service to establish
said each unique user ID-client machine combination as a trusted entity,
said trust token comprising at least one client-originated item of data
that uniquely identifies said client machine; responsive to a
determination that a network request received from a user ID-client
machine combination is unaccompanied by a valid trust token, adding a
specified amount of incremental response latency when processing said
network request that is unaccompanied by said valid trust token.
2-24. (canceled)
[0001] The present application is a continuation of U.S. application Ser. No. 12/705,365 filed on Feb. 12, 2010, which is continuation of U.S. application Ser. No. 10/759,596 filed on Jan. 15, 2004, which is now issued as U.S. Pat. No. 7,721,329, which claims the benefit of and priority to U.S. provisional application No. 60/523,427 filed on Nov. 18, 2003. Each of the aforementioned paten (s), and application(s) are hereby incorporated by reference in their entirety.
[0002] 1. Field of the Invention
[0003] The invention relates generally to network security. More particularly, the invention relates to a method and system for trust-based, fine-grained rate limiting of network requests.
[0004] 2. Description of Related Technology
[0005] A fundamental feature of current network technologies is the provision of network services to individual users by furnishing each user an account. Users then request services through their accounts by logging into a server using a client. In current usage, the term `client` may refer either to the software application by which a user accesses the network resources provided from the server, or the machine that is running the client software. To guarantee that the party attempting to gain access to an account is actually the rightful accountholder, access is controlled through an authentication process, in which the account holder is required to provide one or more pieces of information, known only to the account holder, before he is granted access to network services. Typically, authentication requires provision of a user ID and a password. User accounts are seen in most network environments, e.g. local area networks limited to a small company, as well as in ISP's (Internet service provider) having tens of millions of subscribers. Unfortunately, individuals wishing to make unauthorized use of another's user account are common, and thus password theft has become widespread.
[0006] Password theft is a serious problem, frustrating users' expectations of trust, safety, security, and privacy, and interfering with the efforts of ISP's to meet those expectations. While password theft is often involved in particularly serious crimes, such as computer vandalism or identity theft, one of the main motives for password theft is to co-opt user accounts for the sending of `spam,` i.e. unsolicited e-messages that are sent to many recipients at one time, usually to promote a product or service.
[0007] Most users find spam annoying and intrusive, but it can also be highly offensive, as when one receives spam that advertises web sites that distribute pornography. Furthermore, large volumes of spam severely burden network infrastructures. Thus, control of password theft constitutes an important measure in reducing the volume of spam. A large ISP may have to reset thousands of accounts per week because of stolen passwords, at a cost of several million dollars per year.
[0008] Passwords can be compromised in a number of ways. Users often keep their passwords written on easily found POST-IT NOTES (3M Corporation, St. Paul Minn.) or scraps of paper, instead of committing them to memory; or they may disclose their passwords to friends and co-workers. Often, users are enticed into revealing their user names and passwords via email, instant messaging or by visiting spurious web sites. Additionally, users may be tricked into downloading and installing Trojan horse programs, i.e. keystroke monitoring software that sniffs for typed passwords and subsequently sends them to a hacker. Finally, cracking, guessing a user's password through repeated login attempts, is very common. Generally, cracking is done by means of a software program that iteratively tries one alphanumeric combination after another, until it guesses a user's password.
[0009] Crackers generally launch either brute force or dictionary attacks. During a brute force attack, in which the attacker has no previous knowledge of what a password is likely to be, the cracker iteratively tries all possible alphanumeric combinations, starting with one character, and then proceeding to combinations of two characters and so on. A brute force attack typically requires large amounts of computing power.
[0010] For example, if an attacker were going to attempt cracking all possible six-character passwords composed of the upper-case letters, the lower-case letters and the digits 0-9, there would be about 56,800,000,000 possibilities. Even a powerful computer would require at least several weeks of continuous operation to complete the task. For this reason, brute force attacks are relatively uncommon.
[0011] Much more efficient, and more common, are dictionary attacks, in which only words from the dictionary, for example, are tested as passwords. While the total number of words in the English language numbers a few million, there are no more than two hundred thousand words in common use. Thus, a computer capable of trying five thousand passwords per second could try the entire two hundred thousand words in less than a minute. Similarly, the cracker could make guesses based on names, slang, science fiction shows and books, technical jargon and so forth. It is much easier to take a limited set of words and try combinations based on the known set than it is to crack by brute force.
[0012] Most efficient is a rule-based attack, in which the attacker has some knowledge of one or more rules used to generated passwords. For example, a password may consist of a word followed by a one or two digit number, e.g. user1, mind67. The cracker then generates passwords according to the rule.
[0013] In actuality, most crackers seek to crack the password for a large set of user ID's, for example the passwords of any of the millions of AOL (TIME-WARNER, INCORPORATED) user IDs, rather than try to crack a particular user ID's password. Because many users use one of several simple, common passwords, "abc" or "password," for example, the usual cracking technique is to select such a common password and then iterate through a list of known or generated user IDs, trying each user ID against the common password until a user ID is found that uses the common password. Thus, it is more typical for crackers to guess a user ID matching a chosen password than to guess the password matching a chosen user ID.
[0014] For the cracker to target a given service, such as AOL's login servers, the targeted service must offer a higher return, in terms of number of cracked accounts times the value of each cracked account to the cracker, than another service would. This is because a cracker's resources are limited. By reducing the rate at which a cracker is able to crack user accounts, a service can reduce the cracker's return. Any reduction in cracked accounts provides a number of benefits to the service operator, among them reducing the cost of recovering compromised accounts and the cost of handling spam emails sent from them. Additionally, if the service operator can sufficiently reduce the rate at which accounts are cracked, it should be possible to get the cracker to shift his cracking resources to other, easier targets, and thereby achieve a savings in number of cracked accounts far beyond that achievable through rate limiting alone.
[0015] The cracker typically needs to guess possible user ID/password pairs at a very high rate to crack enough accounts to support his spamming or other account-abusing activities. On the other hand, server technology has evolved to help meet threats of this type. Servers and routers have the ability to monitor inbound and outbound traffic flows. A server monitors inbound traffic, for example, by tracking the number of packets per second or bytes per second received, perhaps at a selected port, or from a selected network address. As the number of packets or bits per second in a stream increases, the stream consumes more of the server's bandwidth. To apportion bandwidth appropriately, servers and routers have traffic management capabilities, commonly called rate limiting, which include traffic policing measures.
[0016] Using rate limiting measures, a server manages inbound and outbound traffic according to preconfigured rate policies that enforce bandwidth limits. Rate policies can be configured for various interfaces such as individual ports or trunk groups. Additionally, rate policies can be configured for various types of traffic, for example a specific MAC (media access control) address, or specific TCP (transmission control protocol), or UDP (user datagram protocol) ports.
[0017] At its finest granularity, rate limiting is applied to specific source IP (internet protocol) addresses. In this way, a server can detect traffic coming from a particular IP address that exceeds the bandwidth allocated by the rate policy. Thus, servers recognize atypical traffic and apply rate limiting countermeasures immediately. For example, a cracker may mount an attack from behind a particular IP address, perhaps behind a proxy server or a firewall, directing requests to the server at a rate that exceeds the allocated bandwidth. The server then limits the rate at which requests are processed from the particular IP address by limiting the bandwidth to that allocated by the rate policy. Additionally, if the traffic exceeds a certain pre-configured rate, the server may drop the traffic entirely. Thus, by imposing rate limiting countermeasures, a server can fend off, or at least, badly frustrate attacks by crackers.
[0018] However, a fundamental limitation of IP-address based rate limiting is that a peer IP address is a very weak proxy for a particular user using a particular PC, and hence IP-address based rate limiting is a very blunt and imprecise tool. A counter measure applied to a suspicious IP address can be a draconian measure. Even though each client machine has it's own local IP address, in many cases the internet traffic from these client machines is routed through an intermediary device, such as a firewall or a web proxy server, and it is the IP address of this intermediary device, rather than that of the individual client machine, that is seen as the requesting IP address by the destination network server. Thus, rate limiting traffic from the IP address of the intermediary device effectively denies or limits service to all users whose requests originate from the suspicious IP address, even though the actual target may be a single cracker among them. Thus, by using the peer (requestor's) IP address alone, the network server has no ability to discern which particular client machine made a given request when it is routed through a shared intermediary device. Further, a given user's peer IP address may change from session to session or even from network request to network request. In this case, applying rate limiting to a peer IP address may have no effect on the targeted user.
[0019] It would be a great advance in the art to provide a method of fine-grained rate limiting, in which individual user ID/machine combinations could be distinguished and separately rate-limited even when sharing the same peer IP address.
[0020] K. Shin, K. Kobayashi, T. Aratani, Device and method for authenticating access rights to resources, U.S. Pat. No. 5,987,134 (Nov. 16, 1999) provides an approach that requires several different components including challenging data, user identifying information, and an access ticket. Shin, et al. are primarily concerned with authenticating a user, rather than establishing a particular piece of hardware as trusted.
[0021] M. Ensor, T. Kowalski, A. Primatic, User-transparent Security method and apparatus for authenticating user terminal access to a network, U.S. Pat. No. 5,721,780 (Feb. 24, 1998) describe a method and apparatus for implementing security in data and telecommunications networks that is independent of and transparent to users. When a user terminal connects to a network control center, the network control center generates an encrypted password based on the user terminal's network coupling identifier. The password is downloaded to the terminal and simultaneously saved by the network control center. Subsequently, when a user attempts to access the network, the network control center retrieves the password from the terminal and compares it with the stored copy. If there is a match, network access is granted. With each logon from the terminal, a new password is generated and downloaded to the user terminal. The exchange of passwords described by Ensor, et al. allows a user terminal to be established as trusted on a session-by-session basis. However, the trust is only machine-specific; it is not specific to the user as well. Furthermore, Ensor, et al. fail to contemplate fine-grained rate limiting based on designating a machine as trusted by issuing a trust token.
[0022] K. Seamons, W. Winsborough, Trust negotiation in a client/server data processing network using automatic incremental credential disclosure, U.S. Pat. No. 6,349,338 (Feb. 19, 2002) describe a system in which trust is negotiated between two unfamiliar data processing apparatus by incrementally exchanging credentials. Providing multiple opportunities for exchange of credentials makes it possible to negotiate a higher level of trust between two machines previously unfamiliar with each other than a single exchange of credentials. The approach provided by Seamons, et al. involves the iterative exchange of credentials and credential access policies, wherein the credentials are primarily issued by various third parties and describe the holder of the credential.
[0023] Siebel 7 Integration with Baltimore SelectAccess 5.0: Technical information brief describes the use of a trust token to provide SSO (single sign-on) functionality across several applications in different domains. Similarly, R. Zuccherato, Authentication token (Nov. 6, 2002) describes an authentication token that is issued by an authentication server for later use in authenticating to a different application server. There is no teaching in either source of the use of a trust token to designate a particular machine/user combination as trusted, or differentially applying rate limiting countermeasures based on the presence or absence of a trust token.
[0024] It would be highly advantageous to be able to distinguish friendly network traffic from hostile network traffic at the granularity of a single user ID/machine combination. It would be further advantageous to reduce the rate at which legitimate users are denied service from a server while thwarting attackers operating from behind the same IP address as legitimate users. It would be a still further advantage to improve server defenses and reduce the volume of spam sent and received by network subscribers by implementing a method of fine-grained, trust-based rate limiting.
[0025] The invention provides a method and apparatus for fine-grained, trust-based rate limiting of network requests. Legitimate network traffic is distinguished from untrusted, and potentially hostile, network traffic at the granularity of an individual user/machine combination. Thus, network traffic policing measures such as rate limiting are readily implemented against the hostile or untrusted traffic without compromising service to trusted user/machines legitimately requesting network services ("friendlies").
[0026] In one embodiment of the invention, a client successfully authenticating to a server for the first time is issued a trust token by the server. The trust token is typically a cryptographically secure object, such as a certificate, that is both user and machine-specific. Issuance of the trust token, which is stored by the client, establishes the particular user ID/machine pair as trusted. In subsequent logins, the trust token is provided by the client along with the customary authentication information, such as user ID and password. At the server, a rate limiting component applies traffic policing measures, such as adding response latency, according to rate policies that give highest priority to network requests that are designated trusted, based on the availability of a valid trust token. Thus trusted requests are promptly granted. Rate policies may further specify bandwidth restrictions to be imposed for untrusted network traffic, such as adding a configurable degree of response latency to untrusted traffic. Furthermore, the rate policy can be configured to drop untrusted traffic entirely.
[0027] An additional embodiment of the invention is described, wherein trust tokens are stored in a server side database, rather than being stored by the client, allowing the invention to be implemented with clients that lack the capability of storing a trust token. In a further embodiment, a single database provides service to a number of different servers. In a still further embodiment, a single rate limiting component polices traffic for a plurality of servers, while each of the servers manages trust tokens independently of each other.
[0028] FIG. 1 provides a schematic diagram of a direct network connection between client and server, without interposition of an intermediary;
[0029] FIG. 2 provides a schematic diagram of a network connection between client and server wherein the client is behind a firewall or proxy server;
[0030] FIG. 3 provides a schematic diagram of a process of establishing a client as trusted in a system for trust-based fine-grained rate limiting of network requests according to the invention;
[0031] FIG. 4 provides a schematic diagram of a process of updating a trust token in the system of FIG. 2 according to the invention;
[0032] FIG. 5 shows provides a diagram of an exemplary trust token from the system of FIG. 2 according to the invention;
[0033] FIG. 6 provides a block diagram of a server architecture from the system of FIG. 3 according to the invention;
[0034] FIG. 7 provides a flow diagram of an authentication process according to the invention;
[0035] FIG. 8 provides a schematic diagram of a process of establishing a client as trusted, wherein an issued trust token is stored in a server-side database according to the invention;
[0036] FIG. 9 depicts an enhanced rate limiting approach that may be applied to untrusted requests;
[0037] FIG. 10 provides a schematic diagram of a centralized system for trust-based fine-grained rate limiting of network requests according to the invention; and
[0038] FIG. 11 provides a schematic diagram of a system trust-based fine-grained rate limiting of network requests wherein untrusted logins are routed to a central rate limiting server according to the invention.
[0039] As shown in FIGS. 1 and 2, a user of a client machine 101 requests network access or services from a server 102. It will be appreciated that each client 101 has a distinct IP address, denoted by IP1-IPn. When a client directs a request to a server directly, without the interposition of any intermediary devices, as in FIG. 1, the server 102 is readily able to discern the source IP address. Often, however, the client 101 sends its request to the server 102 from behind a proxy server or firewall 103, wherein the proxy/firewall 103 has a distinct IP address, for example "184.108.40.206." There may be many users and many machines behind the proxy/firewall 103, all directing requests to the server 102. The fact that all of this traffic originates from behind the proxy firewall 103 has the effect that all of the traffic, even though it originates from many different users and many different machines, is seen by the server 102 to originate from the same source IP address, that of the proxy/firewall 103, i.e. 126.96.36.199. The server cannot distinguish traffic originating from one machine behind the proxy/firewall 103 from traffic originating from another machine; it all looks the same to the server.
[0040] One assumes that the majority of users behind the proxy/firewall 103 are "friendlies," users having legitimate user accounts on the server 102 and having benign intentions. It is also possible, however, that hostile traffic can originate from behind the proxy/firewall 103, for example an attacker trying to crack passwords to user accounts on the server 102. As previously described, an attack by a cracker can consume enough of the server's bandwidth so that the attack is readily detected, and the server can implement countermeasures to defend against the attack, such as rate limiting.
[0041] Rate limiting is a traffic management tool that allows a server or router to control the amount of bandwidth specific traffic uses on specific interfaces. While the specific implementation of rate limiting varies according to the manufacturer of the server or router, some general principles of rate limiting are described herein below.
[0042] Many network devices implement rate limiting using a token bucket model, in which arriving packets are admitted to a port by removing admission tokens from a bucket. It will be appreciated that larger packets or a greater number of packets per second require more tokens. Tokens are added to the bucket at a rate set by the configured rate limit. As long as the bucket is full, no additional tokens can be added. Traffic arriving at the port can only be accepted if there are sufficient tokens in the bucket. Thus, a rapid burst of traffic causes rapid depletion of the bucket. If the bucket is emptied, traffic cannot be granted ingress to the server. In some cases, incoming traffic is simply dropped until the bucket is replenished. In other cases, incoming traffic is queued until the bucket contains sufficient tokens to admit a portion of the queued traffic. It will be appreciated that queuing incoming traffic and replenishing the bucket with tokens at a configured rate has the effect of imposing latency on the rate at which the incoming traffic is processed. Thus, the latency is configurable by configuring the rate at which the bucket is replenished.
[0043] The above scheme for implementing rate limiting is provided for the sake of description only. Other methods of rate limiting are commonly known by those having an ordinary level of skill in the art and are consistent with the spirit and scope of the invention.
[0044] Network devices such as servers generally have capabilities for both fixed and adaptive rate limiting. Fixed rate limiting enforces a strict bandwidth limit. The device forwards traffic that remains within the limit, but either queues or drops all traffic that exceeds the limit. Adaptive rate limiting enforces a flexible bandwidth limit that allows for bursts above the limit.
[0045] Fixed Rate Limiting
[0046] Fixed rate limiting allows one to specify the maximum number of bytes a given port on a network device, such as a server, can send or receive. The port drops or queues bytes that exceed the amount specified. Additionally, rate limiting can be configured for both inbound and outbound traffic. A rate limit is usually expressed in bits per second. The fixed rate limiting policy generally applies to one-second intervals and allows the port to send or receive the number of bytes specified by the rate policy.
[0047] Fixed rate limiting counts the number of bytes that a port either sends or receives within the configured time interval. If the number of bytes exceeds the maximum number specified, the port drops all further packets for the rate-limited direction for the duration of the specified interval. At the end of the interval, the port clears the counter and re-enables traffic.
[0048] Generally, rate policies are configured on a port-by-port basis. Each port is configured by means of an editable configuration file. Rate policies are typically configured by entering scripted commands in the port's configuration file that specify the direction of traffic flow and the maximum number of bits per second.
[0049] Adaptive Rate Limiting
[0050] Adaptive rate limiting rate allows configuration of the amount of traffic of a given type a specific port can send or receive. It also allows changing the IP precedence of traffic before forwarding it. Rate policies can be configured for specific types of traffic, for example: layer 3 IP traffic, specific source or destination IP addresses or networks, specific source or destination TDP or UDP ports, specific MAC (media access control) addresses, specific IP precedence values, or Diffsery (differentiated service) control points.
[0051] Configuration of adaptive rate limiting policies is similar to that for fixed rate limiting, except that rate policies are specified for each type of traffic. In the event that a rate policy is not specified for a particular traffic type, that type of traffic is sent and received without rate limiting.
[0052] Rate limiting should ideally be applied at as fine a granularity as possible, so that those actually doing the cracking are strongly limited without limiting, i.e. inflicting "collateral damage" upon, friendlies in the virtual neighborhood. Unfortunately, this is the biggest limitation of IP address-based rate limiting schemes, because IP addresses are not fine-grained when it comes to network login requests, as previously described.
[0053] In practice, this means that it is necessary to identify proxy/firewall IP addresses. This is accomplished by monitoring logs and user feedback for selected network services, and attempting to tune their rate limits such that they are loose enough to account for an average number of users behind such a proxy IP address, yet tight enough to still have some effect on crackers from behind those IP addresses. This is a challenging, ongoing, error-prone exercise that results in too many friendlies being denied service and too many crackers not being adequately rate limited. This scheme also provides an opportunity for malicious hackers to effect a denial of service (DOS) attack on users behind the same proxy IP address.
[0054] Differentiating Bad From Good Traffic
[0055] IP-address-based rate limiting entails identifying the "bad" IP addresses and then enacting rate limiting countermeasures upon them. Crackers know about this and thus use various means, for example, rotating among proxies or using many different IP addresses, to avoid sending network requests from "bad" IP addresses. Fundamentally, identifying and tagging the "bad" is much more challenging than identifying and tagging the "good," because the bad can and do apply their resourcefulness to escape the tagging. Conversely, in an alternative approach where only the "known good" users are tagged in a cryptographically secure way and are rewarded for being good, there is nothing that the bad users can do, because there is no bad tag to avoid.
[0056] Transitoriness
[0057] IP addresses typically cannot adequately represent the entities to which it would be ideal to apply trust-based rate limiting to: specific users on specific computers. Many users are assigned different IP addresses each time they start new sessions, for example dialup users; or each time they restart their computers, for example consumer broadband users. Other users randomly come from 1 of n IP addresses corresponding to the machines in the proxy or firewall farm through which their requests originate. Thus, IP address-based countermeasures are only good for as long as the IP/user binding persists. After that, an attacker gets a fresh start and suffers no penalty for past transgressions.
[0058] A New Approach
[0059] The invention recognizes the following:
[0060] Cracker login attempts are distinguishable from typical friendly login attempts:
[0061] All cracker login attempts originate from a computer from which a to-be-cracked user ID has not previously logged in successfully;
[0062] Conversely, most friendly login attempts come from a computer from which the user ID has previously logged in successfully.
[0063] Incremental login response latency is very harmful to crackers, but minimally harmful to friendlies:
[0064] Crackers' success rates are directly proportional to number of guesses they can make in a given unit of time;
[0065] Crackers need to make a lot of rapid guesses in order to cost-effectively crack accounts;
[0066] Slowing down cracker guessing proportionally reduces their success rate; and
[0067] At some point, it is more cost-effective for crackers to move to easier targets.
[0068] As shown in FIG. 3, the inventive approach is to tag each user ID/ computer pair that successfully logs in, such that future login attempts by that user ID on that computer are treated as trusted and thus incur no additional login response latency, and to add a configurable amount of incremental latency to all untrusted, i.e. untagged, login attempts. In other words, cracker logins are slowed down without affecting most friendly logins from trusted computers, and only slightly penalizing the relatively few untrusted friendly logins.
[0069] Preferably, incremental latency is added to both successful and unsuccessful login attempts from untrusted clients. If it is only added to unsuccessful ones, the crackers quickly realize that if a response is not received within a successful response time, the response can be assumed to be unsuccessful. Thus, the cracker need not continue waiting the extra time for the actual response. In one embodiment of the invention, latency is added only to a configurable percentage of successful logins. Thus, attempting not to miss an opportunity for a correct guess, a cracker is forced to wait for responses for wrong guesses, while latency is attached only to some percentage of friendlies that login successfully. In an alternate embodiment, latency is added only to requests from IP addresses that have exceed a configurable, "add-latency" login rate, as described below.
[0070] Referring now to FIG. 3, a process is shown for:
[0071] identifying entities legitimately entitled to service; and
[0072] establishing those identified entities as trusted.
[0073] By way of a client 101, a sever requests access or services from a network device, such as a server 102. The request takes the form of a login request 103. In an exemplary embodiment, the login request includes a user ID, a password, and a client ID. A client may include a desktop or notebook computer, a handheld device such as a palmtop computer or a personal organizer, or a wireless telephone. For purposes of the invention, a client is taken to mean any device or software application through which a user requests services from the network device 102. A network device, in addition to being a server, could also include a router or a switch. The client ID constitutes one or more items of data that can be used to uniquely or semi-uniquely identify the client. Thus, a user ID/client pair represents a unique or nearly unique entity. The request is received at the network device 1-2 at time T1. Successfully logging in to the network device 102 identifies the particular user ID/client pair as being entitled legitimate access to the network device 102. Instead of the client providing a password as part of the login credentials, a derivative of the password may be supplied, such as a cryptographic hash of the password.
[0074] Following the successful login, the network device issues a user-specific, machine-specific trust token 104. At time T2, the trust token 104 is stored on the client, thus establishing the particular user ID/client pair as trusted.
[0075] Referring now to FIG. 4, a schematic of a trusted login is shown. As in FIG. 3, the user requests service from the network device 102. The login request 103, however, is accompanied by the previously stored trust token 104. By evaluating the trust token 104, the network device is signaled that the login request originates from a trusted entity, a user ID/client pair legitimately entitled to service from the network device 102. Following successful login, an updated trust token 105 is transmitted to and stored on the client 101.
[0076] Referring now to FIG. 5, an exemplary embodiment of a trust token 500 is shown. The exemplary trust token constitutes an object, such as a certificate or a statement. As shown, the data included in the trust token includes:
[0077] user ID;
[0078] timestamp of first login;
[0079] client ID; and
[0080] timestamp of most recent login.
[0081] The foregoing description of the trust token is intended only to be descriptive. Other types of data could be included in the trust token and are well within the spirit and scope of the invention.
[0082] FIG. 6 provides a block diagram of an exemplary functional architecture for a network device 102. In an exemplary embodiment, the network device includes:
[0083] a trust assessor 601;
[0084] a rate limiter 602;
[0085] an authenticator 603; and
[0086] a trust grantor 604.
[0087] FIG. 7 illustrates a typical request processing flow as performed by these components, but it should be appreciated that many alternative processing flows are possible and are consistent with the spirit and scope of the invention. For example, FIG. 7 shows a process flow involving a client that is capable of storing and transmitting a trust token. An embodiment of the invention is described further below wherein the trust token is stored in a server-side database, indexed according to client ID and user ID. In such case, the trust assessor 601 retrieves the corresponding trust token from the database, based on the user ID and client ID stored in the database. The token grantor 604 stores an issued token in the database, indexing it according to client ID and user ID.
[0088] The trust assessor 601 attempts to obtain the requesting entity's trust token, if any, from either the request-or from the server's database (if stored server-side). If it finds a trust token, it proceeds to validate the token's cryptographic integrity and authenticity; for example, by attempting to decrypt it with the secret key with which it was encrypted. If cryptographic validation succeeds, the trust assessor 604 then proceeds to perform other validation checks defined by the server, such as checking that the client ID contained in the token matches that provided on the request, and checking that the token's first-used and last-used timestamps are no earlier than the server's configured minimum timestamps.
[0089] The rate limiter 602 prioritizes authentication requests to be processed by the authenticator 603, based on the client ID, the presence and assessed validity of the associated trust token, and any defined rate limiting policies, to determine if and how to rate-limit the requests. A request accompanied by a valid token is passed immediately to the authenticator 603, with little or no rate limiting being imposed. A request lacking a valid token is given a lower priority. As denoted by the arrow 703, the rate limiter may completely reject a request, as determined by the rate policies configured for the server.
[0090] The authenticator 603 is responsible for verifying authenticity of the login credentials, typically user ID and password, presented by the client. The authentication element 503 consults either an internal or external data store containing the authorized user ID and password and determines whether the credentials supplied match those stored in the data store. If the login credentials are invalid, the request is rejected, as denoted by the arrow 702
[0091] The trust grantor 604 generates a fresh trust token for the authenticated entity. The trust grantor 604 initially collects the contents of the token supplied by the authenticated entity during authentication, including any of user ID, client ID, first-used timestamp from the old trust token and the current time, i.e. the last-used time to put into the token, and then optionally encrypts the contents using a cryptographically secure encryption algorithm and encryption key. Preferably, the generated trust token includes both the above mentioned encrypted data as well as unencrypted plain-text that denotes at least the identifier of the encryption key used. Additionally, the token issuer generates trust tokens for successful, but previously untrusted logins. In either case, the generated trust token is either transmitted to the client, as denoted by the arrows 701 and 704, or stored in the server-side database, indexed as previously described.
[0092] While FIG. 6 depicts the server-side as including a single unit having a number of functional components, in actuality the server, or network device could also include a number of different units, in which the various server side functions are distributed across units. Examples of distributed server-side architecture are described further below.
[0093] There follow herein below descriptions of a number of embodiments of the invention involving different server architectures and different client types.
[0094] Token-Capable Client
[0095] A token-capable client, as shown in FIGS. 3 and 4, is any client capable of storing and transmitting a cryptographically secure trust token, such as a web browser. In a preferred embodiment of the invention, after a client logs into the login server successfully, the login server generates a cryptographically secure trust token, for example triple DES encrypted (data encryption standard). The trust token, shown in FIG. 5, typically contains at least the user ID and the timestamps of first and last logins by the user ID on the client. Additionally the token contains some type of unique, non-spoofable client ID, such as the MAC (media access control) address or the disk drive serial number, such that replay of the token from a machine other than the client the token was issued to is discernable to the server. However, as long as the tokens are sufficiently difficult to capture, as is the case when the transmission occurs over an encrypted communication channel, it is not absolutely necessary that the data be non-spoofable.
[0096] FIG. 8 illustrates another embodiment of the invention, wherein the server stores the trust tokens in a server-side repository 801, such as a database, instead of sending them down to the client for storage on the client. In this case the server indexes stored tokens by the associated entity ID, preferably the user ID+client ID. Further, the client ID may be client-specific data originated by the client, e.g. the MAC address of the client computer, or may be a unique client ID 802 assigned by the server and sent down to the client for storage and return to the server on subsequent authentication requests.
[0097] Anonymous Client
[0098] In the case of logins from clients that provide no uniquely or semi-uniquely identifying client data, and which are not capable of storing and replaying server-generated trust tokens, the following IP-based trust scheme is provided:
[0099] Following each successful authentication, the network service adds or updates a database record containing the following information:
[0100] user ID;
[0101] client IP address;
[0102] timestamp of first successful login by user from this client IP address; and
[0103] timestamp of last successful login by user from this client IP address.
[0104] A record is added if it's the first time user has successfully authenticated from the client IP address. Otherwise, the record having matching user ID and client IP address is updated.
[0105] Each new authentication request contains the user ID and the client IP address. The network service extends trust to a new request according to one of the following alternate schemes:
[0106] Exact client IP match. If the user ID and client IP address of the request match exactly those of an existing database record, and if the timestamps from the database record pass the configurable timestamp bounds checks, the request is trusted; otherwise, it is not.
[0107] Trusted IP address range match:
[0108] Step 1: determine trusted IP addresses ranges for the user ID. Network service computes one or more trusted IP address ranges for the user ID from the set of successful authentication records stored for that user ID.
[0109] Step 2: check client IP address. If the client IP address of the current request is in one of the trusted IP ranges, the request is trusted, subject to step 3, otherwise it is not.
[0110] Step 3: check timestamps. Compute the earliest authentication timestamp for the matching trusted IP address range as the minimum of the earliest authentication timestamps of the matching records, and likewise for the latest authentication timestamp. If the timestamps pass the configurable timestamp bounds checks, the request is trusted, otherwise, it is not.
[0111] The process flow for establishing an anonymous client as trusted is analogous to that shown in FIG. 7. Instead of attempting to obtain a trust token for the entity attempting to authenticate, the trust assessor 601 checks the database for a record of a previous successful authentication from the entity. The remaining steps proceed as previously described; however the role of the trust grantor 604 is creation or updating of a database record, rather than issuance of a trust token.
[0112] FIG. 9 depicts an enhanced rate limiting approach that may be applied to untrusted requests. The arrow 901 is included to indicate an increasing volume of network requests.
[0113] Below a configurable login threshold `A,` no latency is applied. Traffic below the first threshold is assumed to be trusted, based on the low request rate per unit of time. The assumption tends to be valid because user ID/client pairs legitimately entitled to request service would successfully be able to login on the first attempt. Thus, the traffic volume tends to be low.
[0114] Above a second configurable threshold `B,` traffic is dropped altogether, on the assumption that the traffic is hostile. The assumption tends to be valid because the rate specified by threshold `B` is one achievable only by automatically generated network traffic, such as would result during an attack by a cracker or during a denial of service attack.
[0115] Above threshold `A` and below threshold `B,` latency is applied to untrusted login requests. Network traffic within this range is not of a high-enough volume to justify the extreme measure of completely blocking it, but is high enough to justify in increased index of suspicion. As previously described, imposing login latency frustrates a cracker's efforts sufficiently to give them a strong incentive to seek out weaker targets.
[0116] Identifiable Client
[0117] While the previous embodiments of the invention are applicable to the majority of clients, a third embodiment shown in FIG. 8, is applicable to clients that are not token-capable, but that do provide uniquely or semi-uniquely identifying data about the client making the login request. Examples of uniquely identifying data include:
[0118] Disk drive serial number;
[0119] MAC address.
[0120] In the case of semi-uniquely identifying data, different items of data can be concatenated to form an identifier. For example, the client build number, the PC RAM (random access memory) and the phone number dialed are concatenated to produce a unique or semi-unique identifier. As shown, the client 101 directs a login request 103 to the network device 102. As previously described, the network device issues a trust token. However, as indicated by the arrow 802, the trust token is stored in a server side database. In this case, the login server uses the user id plus client data as a key into a database 601 of trust tokens stored server-side, instead of the token being stored on the client. During subsequent logins, as indicated by the arrow 803, the trust token is retrieved from the database 601 and evaluated. Following validation, the trust token is updated as previously indicated, and access is granted to the client 101. As shown in FIG. 10, an embodiment of the invention is possible in which a single centralized database 1001 serves a number of network devices, denoted here by servers 1002a-1002c.
[0121] While the incremental latency penalty is the currently preferred embodiment of the invention due to its ease of implementation and its user-friendliness, it should also be appreciated that it is possible to impose other penalties upon an untrusted login attempt. One such penalty is a requirement that the client successfully complete a Turing test. A Turing test typically constitutes a question or a task that can be readily solved by a live human, but that could be solved only imperfectly, if at all, by a machine. Thus, by requiring successful completion of a Turing test prior to login, one is readily able to distinguish a human user that is more likely to be entitled access to the server from a cracker launching an attack using cracking software. For example, a Turing test might be to correctly recognize characters embedded in an image containing distorted text characters to obtain permission to attempt a login.
[0122] Enhancements and Extensions
[0123] FIG. 11 shows an alternate embodiment of the invention in which all business logic and code involved with processing untrusted logins is centralized to a rate limiting server 1101. Thus, the servers 1102a-1102c handle trusted logins, and all untrusted logins are directed to the central server 1101.
[0124] It will be appreciated that transmission of sensitive data such as authentication credentials most appropriately occurs over a secure network connection. Thus, all embodiments of the invention rely on protocol that ensures security and privacy in network communications. The invention preferably employs the SSL (secure sockets layer) protocol.
[0125] Although the invention has been described herein with reference to certain preferred embodiments, one skilled in the art will readily appreciate that other applications may be substituted for those set forth herein without departing from the spirit and scope of the present invention. Accordingly, the invention should only be limited by the Claims included below.
Patent applications by Christopher Newell Toomey, Cupertino, CA US
Patent applications in class Tokens (e.g., smartcards or dongles, etc.)
Patent applications in all subclasses Tokens (e.g., smartcards or dongles, etc.)
User Contributions:
Comment about this patent or add new information about this topic:


text:
New College has a new president
Donal O'Shea has just been selected as the new president of New College of Florida, replacing Gordon E. "Mike" Michalson, Jr., effective July 1.
O'Shea hails from Mount Holyoke College in South Hadley, Massachusetts, where he was dean of faculty and vice president for academic affairs. His selection was unanimous by New College's presidential search committee. It must be confirmed by the Florida Board of Governors, which meets in Jacksonville next week.
"Donal O'Shea's intellectual abilities, his personal values and his visionary determination to make New College a national leader in the liberal arts really stood out from the other candidates we interviewed for the presidency and made him a natural fit to lead New College," said board chair Bob Johnson.
More from a New College press release:
Dr. Donal O'Shea has been Dean of Faculty and Vice President for Academic Affairs at Mount Holyoke College, a top 25 ranked private liberal arts women's college, since 1998. During his 14-year tenure as dean, he has diversified the faculty, increased external funding, introduced post-tenure review, improved leave policies, made teaching load equitable, established professional programs and shepherded creation of a fiber optic network linking the Five Colleges Consortium in western Massachusetts. He has also introduced a first-year program to support new students in their transition to college, internationalized the curriculum, formed a group of presidents and deans of women's universities around the world, started collaborative programs among northeast liberal arts colleges for department chair development, overseen four building projects (including a $32 million science construction and renovation project) and consolidated science and arts programming and planning.
A Harvard-trained mathematician and an avowed advocate of liberal arts education, O'Shea has been at Mount Holyoke since 1980. He previously headed sponsored research and chaired the college's mathematics department. O'Shea earned his undergraduate degree in mathematics from Harvard University and his master's and doctorate from Queens College, Ontario, a prominent Canadian Research I university. He has been a visiting professor in major universities in the U.S. and abroad (U. of Cambridge, UK; U. of Miami; U. of Hawaii; Universität Kaiserlautern, Germany; U. of Massachusetts, Amherst; Institut des Hautes Etudes Scientifiques, Bures-sur-Yvette, France). He has six monographs to his credit and numerous research articles.
New College's Presidential Search Committee members included Susan Burns (alumna), Charlene Callahan (former provost), Kathy Coffey, Audrey Coleman (trustee), Aron Edidin (faculty), Cindy Hill Ford (alumna), Renee Hamad, R.V. Heiser, Michael Long (student), Bob Johnson (trustee and chair), William Johnston (trustee), Pat McDonald (faculty), Felice Schulaner (alumna and trustee), Stewart Stearns, Tom Towler and Alex Wylie (student).
The longest-serving president in the history of New College, Mike Michalson has served as president of the College since July of 2001. At his retirement, he will have served as chief administrative officer of New College for 16 of the past 20 years, including five years as Dean and Warden (1992-1997) while the College was still part of the University of South Florida (USF). Following a one-year sabbatical, Michalson plans to rejoin the New College faculty as a professor of religion in the fall of 2013.

subset: commoncrawl


text:
At My Daughter's Baptism
First Place All-Church Poetry Contest
And Eve … was glad, saying: Were it not for our transgression, we never should have had seed, and never should have known … the joy of our redemption (Moses 5:11).
Child, see the fawn high-bounding,
vaulting the road, tracing the leaping doe
to the spring spurting around the pipe wounding
the soft earth. You know
the water, the toes gripping the wet stones,
the cupped hand running over, the slow
drinking, the glad moans.
Now hear the dawn's great trumpet blasting
gold fanfare over the ridge: green
aspens shiver in the rushing sound, a casting
of bright echoes between
the summit and the far mountains. The peacock may
proceed to spread his burning eyes, to preen,
to strut across the day.
Tonight, beyond the dusty hours, when the coals
lie like hot-bellied clouds within
the glowing pit and the night like airy stoles
upon our shoulders, the thin
veils that keep us from the stars will fly
loose in the night wind, and we will spin
glass cartwheels in the sky.
Pale Woman, Lean Woman
Third Place Eliza R. Snow Poetry Contest
In the husk of bodies
Hunched in the heat
A pale woman, lean woman
Falls by his feet.
The Nazarene passes
Day-weary, drawn,
Flanked by a multitude,
Sandaled and robed;
Her hand reaches out,
Blood-pumping thin,
Pale woman, lean woman
Touches his hem,
Brushes his garment
Skimming the stones,
And his spirit quickens
Her leadlike bones.
Pale woman, lean woman,
Her faith is her plea
As he asks by the roadside
"Who touched me?"
Second Place Eliza R. Snow Poetry Contest
"California? But there's gold here!"
With baffled eyes you searched the sand and sage,
You planted the seeds I brought from home.
There was little hope that they would grow,
But you put them in the ground.
Six feet-three inches, dressed in field dust
Stooping over a tiny flower bed
And watering it with your faith.
Ten days brought them green against the cabin gray.
Then came the morning
I turned from dumping dish water to see them.
Open—bright and flooding golden summer on our step.
You were gone that morning, Andrew,
When Nathan first did the milking
All by himself.
Our ten-year-old, fair-haired boy
Came up from the barn
Pulling at the bucket almost bigger than himself
A smile spread clear across his freckles
With the early sun glistening through his hair.
There was that September Brother Schultz got typhus
And we took Nate and John and everybody came—
Brown farmers and bare-foot children
Taking fruit from trees that bore them.
I sat tired and sticky by the wagon.
Baskets, boxes smelling sweet
Piled with peaches
Yellow-orange and glowing—fairly glowing.
Arthur said that it was yellow money.
Sister Anna said that friends were "Good as …"
Andrew, you should see the sun now.
It's a huge circle of molten lava
Slipping—heavy—into Johnston's Valley.
The fire has splashed into the sky
And all the clouds are blazing—white, amber, crimson.
Rays have reached across the valley
Painting the mountains rich yellow-gold,
Changing the rock to glowing magnificence.
Well, here's a drop of that luster.
They're butter-cups—early ones.
My fingers aren't so stiff
That I couldn't pick them for you.
Lovely, aren't they? Simple, pure and hardy
Like the land they grew from.
I hope that they will grow here
When I join you.
It's only right
Their gold will be the monument to show
We found our treasure here.


text:
Here's a post from the Yahoo! Movies board where the screenwriter of The Core (or someone purporting to be the screenwriter of the Core--the name is right at least..and why would you falsely associate yourself with The Core??) defends the science in the movie, but disses Armageddon. His post is in response to someone saying that the movie teaches children bad science.
http://messages.yahoo.com/bbs?.mm=FN...2172484&mid=35Hey there. John Rogers, screenwriter for The Core. Stumbled across your post.
I'm with you that movies like Armageddon taught crap science to kids, AND was just lazy writing. That's why I want to assure you, as someone who holds a degree in physics (granted, one I don't use much anymore...), most of the science in the movie is DEAD ON. The fluid core of the earth not only rotates, but spins faster than the earth itself. The change in this rotation is generally what's given credit for the pole shift every half-million years. It's also the engine which drives the EM field of the earth, having most of the effects described in the movie (although unfortunately not in the trailer). Most of the fluid dynamics work I did as background didn't make into the film, but the idea is that the core is at an unstable "tipping point" of stasis, and the big bang is wat we need to knock it off that point. You know, like the old "ball on a hill" example of potential energy we all learned in high school.
The ship itself, of course, couldn't exist. That's the science "fiction" part of the movie. All the elements of the ship DO however exist. The cockpit's a modified shuttle cockpit, the molecule forming the ship's skin is based on a real molecule, the video/MRI panels are based on the work of a guy I actually went to school with. The device Zimsky builds is based on research from the '40's, and even the hacker character's stunts are drawn from tales of the web underground.
Yes, some dramatic liberties are taken, and some of the disasters are a little bigger than what might happen. But that's the entertainment part of the equation. I hope you'll go and enjoy yourself when the movie opens. Even if you don't like the story, I assure you your intelligence won't be insulted.


text:
- Diego Boneta, Kirk Sullivan
- The Dead Men
- The Dead Men
- The Dead Men
- Jackson Rathbone
After his success in "Rock of Ages," Diego Boneta is back and has already started shooting his new movie "The Dead Men" in Medellín, Colombia and he said he's ready to take on this new challenge. "I've always loved challenges and to be able to be part of a thriller is a great opportunity for me as an actor. I'm ready for whatever comes my way."
Diego took it to social media to announce the big news of his leading role in this film, in which he will play a boy named Michael, and posted photos with director Kirk Sullivan and some of his costars.
"I have great news. I landed the leading role in an action thriller that we're starting to shoot in Colombia right now. The best thing is that we will be in Medellín most of the time so I'll be able to feel even closer to my Colombian fans. Thank you for all your support, I'll keep you posted."
For the Mexican actor, this film brings a new opportunity to be closer to his South American fans, crowd that has always been very supportive of Boneta's career.
"To me it's very important to be close to the people who've followed my career and growth in this business. People in Colombia are very nice. My fans have always been very supportive," added the actor.
The film tells the story of an American running from his past who is brought into a group of young underground radicals called The Dead Men, only to discover a centuries-old spiritual battle.
"Twilight" hottie Jackson Rathbone also stars in this project as Jacob, "a bad man" as he told his fans on his Twitter account. Since the end of "Twilight," Rathbone has continued his work on the webseries "Aim High" and has completed work on both the Michael Kristoff-directed drama "Live at the Foxes Den" and Pece Dingo's romantic comedy "The Concerto."
"The Dead Men," as the movie is called for now, marks Kirk Sullivan's directorial debut in a feature film, as he rose to the coveted director's chair after being assistant to producer Joel Silver. The film is based on a script by fellow newcomer Andrew Poston.


text:
Ronaldo admits desire to play in La Liga
Cristiano Ronaldo has hinted he will consider his Manchester United future after the Champions League final and would be tempted by a move to Real Madrid.
The Portuguese winger has become one of the hottest properties in world football after scoring 41 goals this season to help United retain their Premier League title and reach the Champions League showpiece.
Madrid have consistently voiced their interest in the 23-year-old and reports have suggested they would be prepared to part with around £100million.
Ahead of next Wednesday's meeting with Chelsea in Moscow, Ronaldo told Spanish TV network Antena 3: 'I am happy here but let's see what happens after the Champions League final.
'I am feeling calm here. I'm happy but in the future I don't know. I know Real Madrid like how I play and I know that other teams in Spain like my game as well, so that's good.
'It is good to know that other clubs are interested in you. I have said millions of times that I would love to play in Spain.'
• Meanwhile, the Footballer of the Year insists he will not rest on his laurels after picking up another prestigious award following his memorable season.
The Manchester United winger, 23, collected the award voted for by the Football Writers' Association at a gala dinner in London on Friday night.
The Portugal international - who was also named the Professional Footballers' Association Player of the Year - topped the poll of journalists ahead of Liverpool striker Fernando Torres and Portsmouth goalkeeper David James.
Ronaldo, who also won the accolade last season, netted an outstanding 41 goals during the regular season, including 31 in the Premier League as United beat Chelsea to the title.
The two clubs go head to head in the Champions League final in Moscow next week, and both managers Sir Alex Ferguson and Avram Grant were at the Royal Lancaster Hotel to see the brilliant winger presented with his trophy.
Ronaldo maintained he had every intention of bettering his performance next season.
Following a tribute from former Manchester United and England midfielder Bobby Charlton, Ronaldo said: 'I am very happy to win this award. It is very important for me to win again, but most important is the collective awards (of the team).
'I am still going to want to win more, to carry on like this, I will not stop because I have these two awards.
'Next season I will try to do my best again.
'I have improved every season and will try to improve next season.
'I am enjoying my football, and want to carry on.'
Use a Facebook account to add a comment, subject to Facebook's Terms of Service and Privacy Policy. Your Facebook name, photo & other personal information you make public on Facebook will appear with your comment, and may be used on ESPN's media platforms. Learn more.


text: White Flint's Technically Kensington Post Office In Need Of New Location From Bethesda Now – By Aaron Kraut Published: 2013.06.28 03:10 United States Postal Service officials will come to White Flint/North Bethesda on July 10 to discuss finding a new location for the White Flint Mall post office, which according to the agency is technically in Kensington. For a redeveloping area trying to create a name for itself, getting "White Flint" recognized as an official mailing address might be an important step. Developers and residents aren't fully agreed on the North Bethesda vs. White Flint debate. The USPS started recognizing North Bethesda as an official mailing address in the 1990′s, according to a Friends of White Flint post that looks into the origin of the White Flint name. Rockville remains in the minds of some, despite the southern border for the actual City of Rockville coming no closer than Twinbrook Parkway. But Kensington? The post office must move to make way for the redevelopment of the mall into a collection of mixed-use commercial and residential buildings situated around a town square. Stakeholders in various community meetings over the last few months have discussed asking that wherever the new post office goes, it no longer be known as Kensington. Ken Hartman, Montgomery County's point person for the Bethesda and North Bethesda area, told The Gazette this week that it's his understanding the USPS is looking for a new post office location in the same White Flint Mall zip code -- 20895, which would mean it would remain on the east side of Rockville Pike. In 2011, Fairfax County got approval from the USPS for the use of Tysons Corner or Tysons as an official address in two zip codes of McLean and Vienna. Like the White Flint area, Tysons Corner is undergoing a massive redevelopment process. The meeting on the future of the White Flint Mall post office is set for Monday, July 10 at the Shriver Aquatic Center (5900 Executive Blvd.), which officially has a North Bethesda address, according to the county. The meeting will start at 4:30 p.m.


text:
Founded in 1962 by five visionary community leaders—N.B. Giustina, Foster Anderson, Harry Rubenstein, Sister Bernadine and Sister Theodore Marie—Sacred Heart Medical Center Foundation has since contributed more than $91 million to improve health care for patients in Eugene, Springfield and surrounding areas.
Throughout its history, the Foundation—through the generosity of donors—has stepped forward to help Sacred Heart Medical Center stay on the forefront of advanced medicine and provide healing care to thousands of patients in our community.
The Foundation has played a key role in funding every major expansion at Sacred Heart Medical Center.
These include:
- A new five-story hospital wing in the 1960s
- New hospital buildings in the 1970s and 1980s, including the current six-story patient tower at Sacred Heart Medical Center, University District
- Campaigns to vastly expand key services, including the hospital's cardiac program
- Sacred Heart Medical Center at RiverBend, which opened in 2008 as one of the most technologically-advanced hospitals in the nation; $40 million of its cost was offset by donations from our community
The Sacred Heart Hospital Guild, founded in 1950 and made up entirely of volunteers, has donated more than $2.87 million over the years. These donations have purchased the latest in medical equipment in almost every area of patient care.
Within the Foundation, Children's Miracle Network has raised almost $17 million since 1987 to fund education and equipment for the caregivers that treat our smallest and most vulnerable patients—infants and children treated in our Pediatric and Neonatal Intensive Care units. The Foundation also helps Sacred Heart fulfill its role as a citizen of Lane County, funding other organizations that partner with the hospital to improve community health.
At the core of the Foundation are its donors and volunteer board of directors, who work side-by-side with staff, raising the funds that have helped make Sacred Heart one of the largest and most respected medical centers on the west coast.
"We have always operated Sacred Heart under the philosophy that it is a community hospital, and this campaign has shown that the community regards it as theirs."
The quote above could have been said by PeaceHealth President Alan Yordy at the opening of Sacred Heart Medical Center at RiverBend—but it wasn't. It was Administrator Sister Theodore Marie in 1963, celebrating the Foundation's first big success: exceeding its goal of raising $834,000 to support construction of a new south wing with 133 additional beds. That project made Sacred Heart the state's largest hospital outside of Portland.


text:
Artist of the day: The Villanz
Tampa rappers Divine and Main make up The Villanz, a longtime tag team on the local hip-hop scene. Their sound is uniquely polished with smooth, smart lyrics and a sleek vintage vibe (they compare their sound to early Jay-Z, Nas and Notorious B.I.G.). You may recall single U Know What I Want, which got some local radio airplay a few years back, and they recently appeared on the WMNF-88.5 program The Damn Jams.


text: "These are absolutely terrific performances from all concerned. They receive first rate recordings from Andrew Keener made at the Concert Hall, Wyastone Leys, Monmouth, UK and Henry Wood Hall, Southwark, London, UK. The booklet notes are confined to a personal view from Natalia Lomeiko… this is a most beautiful new release that is available from Amazon for the price of one CD." theclassicalreviewer.blogspot.co.uk


text:
Credits & Info
- Uploaded
- Sep 22, 2010 | 10:37 AM EDT
- Frontpaged September 22, 2010
If you liked this, check these out!
Plenty more like this here!
Author Comments
Rated 5 / 5 stars
._. awsomeness
quite awsome notice in your previe it a sequal that you for page and all
Rated 5 / 5 stars
noone kills the clown the clown kills you :P i lvoe the clown probbly cuz he kills everyone, everything and he is the color dark green....:P i like dark green xD
10/10 5/5
Rated 5 / 5 stars
stop sign
stop sign for the win
Rated 4.5 / 5 stars
I really liked your style, and the action. The way the one grunt reacted to is dead friend was really well done. I have one problem though, you basically replaced what could have been an extremely epic fight scene, with a black screen with white marks on it and some slow mows of enemies flying around in the air.
Other than you totally avoiding what could have been an amazing fight scene, I really enjoyed it.
Rated 5 / 5 stars
Very nice.
Trully Madness.


text:
Stocking-Stuffer Software
Family and friends can make the holidays the most joyful time of the year, in all ways but one: shopping. No matter how intimately you know everyone on your gift-giving list, finding the perfect present can sometimes be more maddening than finding the single tiny dead bulb that's preventing the rest of the string from lighting.
Luckily, if the people you care most about are computer ownersor are about to become computer ownersthe task is a lot easier. Some excellent software was released in 2009, and finding the ideal app for that special someone in your life is just a matter of matching it to his or her personality.
Whether you're shopping for a devoted Mac or Windows fan, someone who always keeps an iron grip on the nearest digital camera or camcorder, or is it just determined to keep all the household PCs safe and secure, you can find them the proper program. Best of all, none of the ones we've rounded up here cost more than $100but they all deliver functionality that will remain priceless all through 2010.
For the Casual Gamer:
Plants vs. Zombies
$19.99 list
The Sims 3 World Adventures
$39.95 list (requires The Sims 3)
Racing games, shooters, and strategy titles may be super-popular this year (as most), but if you know someone who likes things a lot more low-key, these are two fantastic recreational choices. The Sims 3 World Adventures sets its digital charges on globe-trotting tours to Egypt, France, and China. Plants vs. Zombies documents the fighting off of undead infestations using just the whimsical magic of botany. In either case, your laid-back gamer will have hours of fun. And hopefully, since it's the season of giving, you'll get a chance to play, too!
For the Mac Owner:
Bento 3
$49 direct
We're not even going to pretend that the Apple fanatic in your life didn't have Snow Leopard long before the Thanksgiving turkey started cuddling the cranberry sauce. But a nice addition to the latest OS is this new and powerful version of Filemaker's personal database system, which simplifies sharing the data that fills your life with other people, programs, and even your iPhone.
For the Moviemaker:
Adobe Premiere Elements 8
$99.99 direct
Okay, so maybe you won't be making the next Avatar with it. But Premiere Elements 8 is the most user-friendly and feature-rich home video-editing software on the market, with plenty of features like motion tracking, stabilization, clip trimming, and soundtrack mixing that will make even the greenest novice feel like a budding James Cameron.
For the Paranoiac:
Norton Internet Security 2010
$69.99 direct (for 3 PCs)
Whether you're getting a new computer this holiday season or hanging onto the trusty PC you've had for a while, Norton Internet Security 2010 is one of the best ways out there to keep it safe. It's loaded with innovative detection and removal technologies that will protect every system in your home, but not slow them down. That's worth raising a glass of eggnog to any day.
For the Shutterbug:
Adobe Photoshop Elements 8
$99.99 direct
For someone who's new to the worlds of digital photography and image manipulation, Adobe's everyday package offers a robust collection of features and extras at an attractive price. Version 8 doesn't represent many major changes from its predecessor, but it's a must-have complement for anyone who's going to find their first digital camera under the tree this year.
For the Windows XP Addict:
Laplink PCmover
$19.95-$59.95 list
Your loved one needs help. Yes, we all adored Windows XP for a long time, but its time is past. It just is. Windows 7 has been out for two months now and proven itself as solid and speedy, and it's time your friend or family member dumped the 2001 OS for a dash of computing modernity. PCmover transfers settings, accounts, documents, and even applications, so leaving XP won't feel like that much of a loss.
Find more great high-tech holiday gift


text:
A 20-year-old man fell to his death from the sixth floor of a Bingley tower block.
Police were called to Adelaide House on Crosley Wood Road just after 4am on Saturday, where the body of a man was discovered lying on the ground outside.
Det Insp Ryan Bragg of Bradford CID said police were investigating the circumstances of his death, but did not believe there was any "third party involvement".
He said: "We were called shortly after 4am on Saturday January 18 to a report that a man had fallen from the sixth floor of a property at Crosley Wood Road, Bingley.
"The man is believed to be 20 years old and to have lived locally.
"He was treated by paramedics, but died at the scene.
"Inquiries are ongoing, but at this stage there is nothing to suggest any third party involvement in the death."
The man's identity has not yet been released, but floral tributes left at the scene read "RIP Moz".
A second bunch of flowers, tied to a post at the back of the building, was signed by a number of people and said: "RIP Moz. You will be missed."
Residents at the complex, which is one of a number of tower blocks on Crosley Wood Road, spoke of their shock about what had happened.
One, who did not want to be named, said: "It's just so sad. Twenty-years-old is no age at all. I've seen people stop and look at the flowers. I didn't know the man myself, but it affects you when something like this happens.
"It's a tragic thing to happen to someone so young." Another added: "I heard about what happened when I woke up on Saturday and I couldn't believe it.
"My thoughts and prayers go to the man's family. It's such a shocking thing to happen."


text:
lever action rifles?
Ok, I know I'm asking a ton of question, but I'm hoping some people, much smart er than me about guns/rifles can enlightened me a tad.
So, what is the advantage/disadvantage about a lever action vs a bolt action.
I know what they do, but why would a choose one over the other?
What is the difference?
Lever action rifles are usually more compact and able to be carried in high brush country. They will probably never be as accurate as a bolt action, but are often lighter in weight also. They are usually used for larger game such as deer, coyotes, etc. They are usually good "pie pan" size shooters out to 100-150 yards but anything past that is very iffy.
Bolt actions are more accurate, usually heavier, any caliber type guns. They are usually longer, but are good for longer distance shooting.
For long shots out west, you use a bolt action. For deer hunting in the deep brush of the Ozarks, the lever action is the way to go.
;) Ron
If you're looking for a sort of compare and contrast "argument" in favor of one action type or another, I'll argue in favor of a bolt action, for these reasons: bolt guns have inherently better triggers, and most bolt guns have triggers that can be substantially improved by tuning or replacing the factory trigger with an aftermarket --- better trigger = better accuracy. Lever gun triggers can't be made as good. Bolt guns have essentialy two components, barreled action, and one piece stock, inherently more sturdy, rigid, and as a result, again, more accurate. You can get a bolt gun in virtually any chambering you want, whereas lever guns offer a limited selection (may be what you want or need, but it' still limited). Stock shape on bolt guns is designed for scope sights, lever gun stocks are designed for iron sights and most do not adapt well to scope sighting (not to mention ejection interference on top ejectors like Winchester 94s and clones). Bolt guns can be built in ultra light weights, by slimming stocks and using synthetics vs. wood, and paring away excess, non-structural metal (or even, as Remington has done, replacing steel components with titanium alloy). Lever guns are pretty much stuck at original design weight. The most sophisticated modern lever gun designs are simply attempts to achieve bolt gun standards of performance with a much more complex mechanism --- a worthy but unachievable goal. You really need to first define the gun's mission, then set a budget, then see what falls within those brackets. If you're planning to hunt whitetails in the swamp from a blind, with 50 yards a long shot, it's a moot point, you'd do all right with a bow. If you expect to make 400 yard shots on big mule deer, you'll want a rig that's ballistically, optically, and accurately up to job, and if you're gonna lug it over ridge and peak on your shoulder sling, you probably want it to weigh as little as possible, and now you're talking bolt gun.
The lever action came first into the world. Then, as is usual with mechanical design, the concept of the repeater was greatly simplified and parts were integrated, resulting in the bolt action. (there-- decades of history in two sentances)
There are several good reasons to own a lever gun: 1. They're cool. 2. they're handy and fun. 3. You want one. 4. Someone gave you one. And mostly, 5. They're really cool. Then there's 6. They look great on the wall, and 7. You look great carying one, and 8. They look really sharp in the gun rack in the back window of your old rusty pickup.
(Now I wonder why I have only one lever gun)
And 10. They are really, really cool ;)
There is just something about holding up a Winchester 94 and feeling the way it points and feels.
Glad I decided to buy my 94 when I did. Now that production has stopped.
I own both designs, bolt and lever, and both are good shooters. Just depends on how you want to use the rifle and how much you want to spend.
See ya,
I think someone is out of the loop when it comes to leveraction rifles;
#1 , The Marlin lever guns often very accurate, some will do moa and better.
#2 The point about lever gun triggers being beyond help, I dont know about Winchester, but Wild West triggers are available from Midway USA and they will give the average Marlin a great chrisp 3lb or less trigger.
#3 I do agree that the Win 94 is much less accurate than most bolt guns, as I've had two and my daughter has one now and they tend to pattern moreso than group.
when is the last time you looked at a bolt gun, and thought about history? Nice thing about shooting sports...... everyone can favor what they like.
The lever action of the marlin 25-36 and peep sight
1 Attachment(s)
Do you think this trigger action can be modified?
|All times are GMT. The time now is 12:09 PM.
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.


text:
Bhale Manchi Roju Team at Radio Mirchi Fundraising Event
Sat, Dec 26, 2015, 07:58 PM
Bhale Manchi Roju is a latest film of Sudheer Babu and it is directed by Sriram Adittya T while it is produced by Vijay Kumar Reddy and Shashidhar Reddy under 70MM entertainments. The film features Sudheer Babu, Wamiqa Gabbi, Dhanya Balakrishna, Saikumar. Sunny MR has composed the music for this film and watch the video for a glimpse at the fundraising event at Radio Mirchi.


text:
Please wait...
THE ONE: Skrillex Growls FREE
THE ONE proudly presents 'THE ONE: Skrillex Growls FREE' featuring 50 bass loops and free tutorial PDF for NI Massive! The loops in this download consist of growl sounds that involve some of the most advanced sound design techniques out there - now you can find out these secrets for yourself!
The sounds of legendary producer Skrillex have blown minds all over the world, and many producers looking to emulate these complex bass textures struggle to achieve his signature growl sound. They may succeed in creating a haunting and dirty growl sound, but they never reach the solid, dense and clean sound that Skrillex has successfully developed. This loop pack and tutorial will show you how!
In this loop set we do not only give you 50 Skrillex style growl loops completely free of charge, we've also included a PDF tutorial showing you the sound design techniques used to achieve these growl sounds. Give your tracks the edge with this pro level synth programming tutorial from The ONE-Series!
Check out the demo and hear how balanced and professional the growls sound. The demo track really showcases the potential these loops have for use in your productions.
Full Specifications: 20 bass loops at 1 bar-length, 140 BPM, 30 bass loops at 1/2 bar-length, 140 BPM, Sound design tutorial + extra Massive preset for the tutorial, the demo track as an MP3.
Grab your copy now - it's free!
Please Note: These samples were not created by Sonny Moore a.k.a Skrillex, the loops have been programmed to sound as close to Skrillex's growls as possible, hence the name.
Royalty-Free: All of the content in this download is 100% royalty-free. Once purchased, you can use these sounds in your own commercial music releases with no restrictions.
Quick Links: Browse By Genre | WAV Sample Packs | MIDI Packs | Construction Kits | REX Loops | Combi Packs | Reason Refills | Apple Loops
• Format: Free WAV Sample Pack
• Sounds & Categories:
• 50 Bass Loops
• 1 NI Massive Preset
• Tutorial PDF
• 44.1 kHz 24 Bit
• 100% Royalty Free
• Instant Download
• Download Size: 16 MB
Works with All DAW Software including Cubase, Logic, Ableton Live, Pro Tools, Reason, Traktor (WAV), Reaper, Sonar, Studio One, Mixcraft, FL Studio, Garageband, Samplitude and many more...
PC & Mac Compatible


text:
Fatal Impaired Collision
File # 2016-325 Mission
Police are requesting assistance from witnesses regarding a collision which killed an Abbotsford man on Saturday morning.
At around 9:00am on Saturday, January 9, 2016, Mission RCMP responded to a call of a collision on Lougheed Highway. The collision occurred several kilometres west of the Silver Creek industrial park, between Chester Street and Nelson Street.
A black 2015 Dodge Ram Crew Cab pickup with two occupants was travelling eastbound towards Mission when it suddenly crossed the centreline and struck an white 2012 Chevrolet van in the oncoming lane. The lone occupant of the van, an Abbotsford man in his 60's was killed.
It is believed that marijuana use was a contributing factor to this incident. The driver of the Dodge truck, a 25 year old Abbotsford resident, was arrested. The investigation is continuing and a charge of impaired driving causing death will be recommended by police.
Police are asking anyone who may have been in the area and observed the driving behaviour of either vehicle involved prior to the collision to contact them at 604-820-3540.
Released by
Sgt. Shaun WrightMedia Relations Officer
Mission Detachment
7171 Oliver St, Mission, BC, V2V 6H2
Office: 604-316-7106
Fax: 604-820-3548
Email: firstname.lastname@example.com
Follow Us:
- Date modified:


text:
By NICOLE VALICEK
PROVIDORABLE fine food and gifts in Williamstown was announced as one of five Hobsons Bay's Food Safety Award winners.
Shop owner Kelly Lewis said she was proud to receive the award last week.
"It makes me want to strive harder to keep the business becoming more successful and make it grow every year," she said.
"Hygiene and food safety is very important to me in every restaurant. To have a shop win an award in this category makes everything you do and all the hard work you put in everyday worthwhile."
Other award winners included:
* Baby Bells Child Care Centre, Altona Meadows – Day Care Centre.
* UCAN Cafe Altona North, Altona North – Cafe.
* Zero Lam, Altona Meadows – Domestic Kitchen/Mobile Food.
* Williamstown Primary School Canteen, Williamstown – School Canteen.
Hobsons Bay City Council mayor Sandra Wilson congratulated all five winners and the 238 recipients of In the Running certificates.
"Food Safety is taken seriously at Hobsons Bay and we think it is important to reward and promote excellence in performance standards," said Cr Wilson.
"With Hobsons Bay home to so many food businesses, the council works very closely with all of them to ensure that compliance with food safety standards is taken very seriously."
The council's public health unit assesses food operators against the Australian Food Standards.
Those that receive a good score put themselves in the running for the awards.
The five winners of the 10th annual food safety awards all received near perfect scores.
In the 2013 registration year there were 238 In the Running recipients.
As a reward for their efforts, the winners receive complimentary food premises registration for the next registration year, and promotion on the Hobsons Bay website and social media and within local media.
Cr Wilson said it was great to see businesses recognised for their high standards.
"Business owners and operators and their employees work hard to create the vibrancy and vitality of our hospitality industry, an important part of the city's identity and local economy."


text:
One of the best hot sauces on the planet comes from Yemen, a nation on the southern tip of the Arabian Peninsula.
It's called zhug, a fiery chili pepper paste that is both rich in flavor and spicy enough to require a tall glass of water on hand while eating. The main ingredient in zhug is the serrano, which can be a fairly hot chili depending on the individual pepper. The other two main flavors come from garlic – there is a lot of it in zhug – and cumin.
Zhug is starting to get more recognition on the international stage, though it's already quite popular in the Middle East. It can be found at Yemeni restaurants across the region (see here, for example). It's also very popular in Israel; zhug was brought to Israel by Yemenite Jews as they immigrated in the last half century. Today, zhug is a common condiment in Israeli street food, commonly spooned onto falafel and shwarma sandwiches.
Indeed, zhug goes well as a savory spread with just about anything: salads, chicken, meat, fish, eggs, and any type of sandwich or wrap. The only trouble is that its very difficult to find the green hot sauce for sale in grocery stores, especially outside of the Middle East.
So here is a simple, step-by-step illustrated recipe for making quick and easy batch of zhug at home with minimal ingredients. Note: there are many, many ways to make zhug (some Yemenis, for example, blend mint leaves into the mix) – this is just one example.


text:
Mar 3rd 2014
Tech News Today 955
Xbox Live Goes Cross Platform
Hosted by Mike Elgan
Cortana shows its face, XBox Live might go cross platform, Satya Nadella shuffles the deck, and more.
Records every weekday at 7:00pm Eastern / 4:00pm Pacific / 23:00 UTC.
Hosts: Mike Elgan and Jason Howell. Cortana shows its face, XBox Live might go cross platform, Satya Nadella shuffles the deck, and more. Guests: Jason Hiner, Tom Warren, Steve Kovach and Benjamin Mayo. Download or subscribe to this show at twit.tv/tnt. Submit and vote on story coverage at technewstoday.reddit.com. Check out the full show notes for today's episode. We invite you to read, add to, and amend the wiki entry for this episode at wiki.twit.tv. Thanks to Cachefly for the bandwidth for this show. Running time: 40:08
- Ellen Was On Stage At Oscars With Samsung, Backstage With iPhone
- This is Cortana, Microsoft's answer to Siri
- Microsoft wants Xbox Live to power Android and iOS games
- Nadella Shakes Up Microsoft
- Apple rebrands iOS in the Car as CarPlay, compatible vehicles launching later this year
- Show notes for today's episode


text:
First, familiarize yourself with what the new "DAP'' means in America. It isn't the knocking of fists together as a sign of respect, nor is it a product used to caulk your bathtub. No, "DAP'' is emblazoned on the purple silks of the horse with whom we're falling in love, California Chrome, and it stands for Dumb Ass Partners, accompanied by a donkey logo.
"Dumb asses,'' is how a trainer responded when Steve Coburn and Perry Martin spent $8,000 on a mare named Love the Chase, armed with a dream that she would breed a Kentucky Derby-winning horse. Not oozing of the wealth usually associated with thoroughbred racing owners, the partners chose to poke fun at themselves and stay true to their mission. Here in 2014, when bluebloods invest megamillions in locating super horses, Coburn and Martin really did seem like dumb asses.
That is, until California Chrome started dominating races leading up to Churchill Downs. With four routs in recent stakes events by a combined 24 lengths, Coburn and Martin were offered $6 million for a 51 percent share of the chestnut colt. The Dumb Ass Partners said no thanks and banked on what they'd seen all along with their own eyes, ignoring the daunting truth that no California-bred horse had won the Derby in 52 years and that winning the race would be akin to a bum crashing a wide-brimmed-hat society party.
"The first time we saw him, we knew it was going to be something special,'' Coburn said on Derby eve. "We're going to go down in history.''
The question now is how much history. In winning the 140th Derby in an impressive backstretch romp, California Chrome — would you believe the sire in this breeding process cost only $2,500? — may end up as the most cost-efficient champion in the history of sports. Go ahead and give Miguel Cabrera a $292 million extension. Go ahead and spend $1.5 billion to buy the heretofore downtrodden Los Angeles Clippers from Donald Sterling, who is not a racist, according to the woman who ruined his life. If this horse wins the Triple Crown, with the oldest trainer ever to win the Derby (77-year-old retirement home resident Art Sherman) and a jockey (Victor Espinoza) who grew up driving a bus in Mexico City, well, I suspect some of those Kentucky bluebooks may reconsider the money they're wasting. And before someone asks, no, the Dumb Ass Partners didn't pull off the Derby with advanced metrics. Coburn reports to a factory, where helps make magnetic strips on the back of credit cards. Martin runs a testing lab near Sacramento.
You could have downed 15 Mint Juleps and not concocted this story.
"I think we get along very well together,'' said Espinoza, who won his second Derby. "He's just an amazing horse.''
"I'm the same old Art Sherman,'' the trainer said, "except I won the Kentucky Derby.''
I think we gave up on Triple Crown winners about five years ago. Asking a horse to win three races in five weeks, when the distances are longer than accustomed, is damned near impossible. The last Triple Crown winner was Affirmed, in 1978, and while we've seen eight horses the last 17 years win the Kentucky Derby/Preakness double, the Belmont Stakes has become the inevitable downer.
Can California Chrome, with its humble entourage, make history of the epic sort? "This is just a dream come true,'' said Coburn, who won the Derby, naturally, on his 61st birthday. "If you don't believe in this horse now, then you've got to have your head examined.''
By the way, anyone seen that bigmouth trainer lately? The Dumb Ass Trainer?


text:
DAR Schools
The members of the Avery Trace Chapter, NSDAR, support the promotion of education by donating books to the Kate Duncan Smith DAR School in Grant, Alabama. We also collect and send Campbell's labels to Tamassee DAR School, Inc. in Tamassee, South Carolina, the school can redeem for supplies. The DAR schools have a variety of special needs programs including attention deficit disorder, dyslexia, adult literacy, and children in family crisis.


text:
This is a preview of your job post. Click below to activate with existing job credits or to purchase new credits. View your jobs in your settings section.
The Evergreen Lodge is looking for a fun, talented Outdoor Recreation Guide with broad experience leading outdoor guided trips and an area of expertise that fits one of our major guided recreation programs. We are seeking a guide who possesses strong people skills as well as strong outdoor skills and experience, and who is excited to share his/her experiences and passion for the outdoors with the 2-300 guests that stay with us each night. Evergreen's professional Recreation Guides work with our Recreation Manager to promote, coordinate and lead all of the Lodge's on-site and off-site recreation programs and activities. While our guided adventures include hiking, biking, sightseeing, fly-fishing and snowshoeing trips, the Evergreen's Recreation & Guide Service provides a variety of additional services, including expert advice, trip planning and coordinating nightly Lodge activities (e.g., campfires, naturalist slideshows, movies, etc.). While guides may specialize in one area, they cross-train, support and execute various recreational programs and activities (including assisting at our Rec Desk).
The ideal individual is excited to support the development of an exceptional, professionally run, friendly and fun recreation program and embraces working in a rustic environment in a relationship-oriented business. Ideal qualifications include: * Education: Outdoor recreation, naturalist or related focus a plus * Extensive experience leading guided fly fishing and other trips * Extensive outdoor experience including previous guiding experience as well as personal trips * Knowledge of "Leave No Trace" ethics and wilderness regulations * Strong general outdoor knowledge including flora, fauna, navigation and safety * Exceptional people skills and group leadership skills * Knowledge of Yosemite and the Sierra Nevada is ideal but not required * Minimum First Aid and CPR certified; Wilderness First Responder a plus * 1-2 years minimum trip leadership experience * Excellent communication skills * Interest in living on-site or in nearby housing * Strong interest in training/coaching and in supporting our Intern mission * Independent thinker with strong initiative, but comfortable working within a defined framework **Key personality traits** * Leading a healthy, drug-free lifestyle * High integrity * Guest service oriented * Self-motivated (takes initiative) with high standards * Mature and personable with a relaxed nature * Hands-on and variety seeking * Dynamic and fun, yet responsible and professional * Flexible with a "whatever it takes" attitude **DETAILS** * Position available immediately * Position can be seasonal or year-round * Room and board are included for fixed weekly cost * Compensation based on experience * Hours variable, including nights and weekends as well as situational availability; a regular schedule with specific days off will be established **ABOUT THE EVERGREEN LODGE** The Evergreen Lodge is a recently expanded historic tourist lodge and resort idyllically located on 22 acres bordering Yosemite National Park. The lodge is highly recommended by Fodor's, called a 'Hidden Gem' by Sunset Magazine, and described by Frommer's as "the classic Yosemite experience." The 90 year-old lodge had always featured cabins in the woods, a retail store, an excellent restaurant and a classic tavern. In 2002, the lodge was purchased and underwent a major expansion and modernization, reopening in 2004 with 50 new guest cabins, new guest facilities, new recreation programs and new on-site staff and manager housing. The lodge again expanded in 2009, adding 24 additional guest cabins (for a total of 90) and completing a variety of facilities and public space upgrades. The expanded Evergreen retains its original warmth, character and personal touch while providing the best all-around lodging and recreational facilities in the Yosemite area. The Evergreen provides great career opportunities for talented staff and managers. Since the lodge has a significant recreational focus, we seek staff and managers who are excited about the outdoors and lead a healthy, active lifestyle.
Position Type:
Remote ok?
over 1 year ago


text:
Arts courses will be offered as planned for the fall semester
The University of Iowa will be back in business in the fall, and that will include the departments most affected by the flooding: the School of Music, the Department of Theatre Arts, and the School of Art and Art History, all of which are located next to the Iowa River on the arts campus.
Audio slide show: Cleaning up as waters go down
Experience the sights and sounds of the vast cleanup efforts taking place on the University of Iowa arts campus. Whirring drills, thudding hammers, and powerful water pumps provide the soundtrack to the work being done to remove flood-damaged materials from Art Building West and the UI Museum of Art.
Flood of 2008: Your stories of hard work, unity, sadness
News in brief