What did you choose for your summer vacation? And how will you remember it?
We all love souvenirs, and I had grand aspirations to amass nifty collections from my travels. First, it was flags, but they were surprisingly difficult to come by. Then it was beach towels, but they take up too much space. Later, it was letter openers, but that was foiled by new rules post-9/11. So what's a gal to do? There must be a better option, and we all know that scrapbook isn't happening anytime soon.
Then, I found it. The perfect answer.
Most magnets cost less than $5.
At national parks, they're usually only $2.99.
Go ahead, pick one up in every park!
Like postcards, they can portray a sight with perfect weather and better lighting without a crowd.
Or they can be completely kitschy and good for a laugh.
You can even create a one of a kind family masterpiece and super glue a magnet to the back!
I don't want to think about the effort required to get this home safely.
And magnets won't destroy other items in your suitcase like this guy did.
Just be careful with them around your credit cards and hotel key cards!
Because you always need one of these.
And we'd be lost without a map!
Even hundreds of them only take up a little bit of space.
If you run out of room don't have a magnetic fridge, try magnetic paint or primer on a wall.
They don't count as clutter if they bring you joy!
Happy travels this summer and down memory lane later! What are your favorite souvenirs? Post them in the comments below.
Yes, yes, yes. And shot glasses and mugs sometimes break on the way home. Postcards are easy to pack, but mine ended up in stacks on a shelf. Do you display yours or send them to friends?
We display them – for awhile, but the magnet idea is much better!!
I love the magnet wall! It's fun to look at all the different places you two have been.
I had no idea that they made magnetic paint and primer! Love the idea of collecting magnets from travels. We collect rocks and, even though we don't label them, I bet we could tell you where each and every one came from!
The primer is super-sticky, like painting with tar, but then you can paint over it with any color you want. The paint is easier but more expensive.
I love the idea of collecting rocks! Different regions have so many different and beautiful colors. It's nice that it's all-natural too and every one is unique.
Cool collection, Julie! I love magnets too! Especially the ones that can hold a note or a business card (or emergency numbers). And they're a great reminder of all the fun you've had on your trip.
It is great that they can do double duty.
Magnets are definitely a compact way to buy something for someone else. I always like buying the snow globes for aesthetics. Plus I like giving it a little shake every now and then!
Ooh! I love snow globes too-they're so pretty! Mine seem to lose some liquid after a few years, though, (maybe because we live where it's super-dry?) and magnets last forever.
We try to pick up a magnet at each place we vacation, lots of fun to see them on the fridge!
It is nice to see them on display every day evoking warm memories and smiles, not buried in albums.
Nice, Julie. Magnets are the perfect souvenir. Compact and fun. I got another possibility for you–shot glasses. Not my cup of tea, but I had two coworkers who would always treat me to lunch if I brought them back shot glasses from wherever Mrs. Groovy and traveled. By the time our office was out of business, they each amassed a couple dozen shot glasses, all proudly displayed on their shelves above their desks.
Thanks for reminding us about the beauty of magnets, and thanks for reminding us to get out this summer and explore this beautiful country.
Shot glasses are a great idea. They can be useful for so many things other than shots, too, like holding paper clips, toothpicks, q-tips, etc. We'll keep this in mind!
I've got a bottle cap collection that rivals this. A powerful magnet stuck to the back of the cap doesn't quite touch the fridge, but holds them in place. No glue, no mess.
Didn't cost a thing but the cost of the magnets, which cost next to nothing on eBay.
We used to collect shooters (tall shot glasses) from all the places we visited, but we outgrew that habit, and eventually donated about $500 worth of souvenirs. Now the only souvenirs we bring back are digital images.
Bottle caps are fun, especially if you're artistic with their display. Digital photos are even better if they're enjoyed frequently. Sometimes we'll print ours out for a collage frame, but if we don't they are rarely seen again. Do you have a digital frame? How do you make sure you remember to enjoy your memories?


The sixth-generation Mustang resets the bar in the pony car category with fresh styling, an independent rear suspension and several new engine options, including the 2.3-liter turbocharged EcoBoost engine. Step up from the factory output of 310 horsepower with Full-Race! Improve the airflow in and out of the engine with our bolt-on solutions ranging from intakes to downpipes and exhaust systems. Cool your engine with an upgraded CSF radiator and your intake charge with our intercooler upgrade and bump up the boost with a turbocharger upgrade by Precision Turbo or our complete Full-Race Freak-O-Boost turbo kit.
Ford practically invented a vehicle genre with the release of the first Mustang in April 1964. The term "pony car", a complimentary reference to the Mustang, can be defined as an affordable, compact and sporty vehicle design with a performance oriented theme. Ford's Mustang established a new standard by which all the domestic brands competed.
The Ford faithful have always had a Mustang to admire on showroom floors, some better than others and, certainly some more desirable than others. With the release of the sixth-generation Mustang in 2015, Ford raised the bar once again. Not only has it taken steps to ensure that this model stands out in the pony car segment, it is the first ever Mustang to be sold in both domestic and foreign markets as a true global platform with right-hand drive models in the appropriate markets.
In 2015, the standard Mustang engine was the naturally-aspirated Cyclone V6. In 2018, this engine was dropped from the line and replaced by the previously optional turbocharged 2.3-liter EcoBoost engine that is shared with the Focus RS. Forced induction fans haven't seen a factory turbocharged Mustang since the 1980s, but this engine was worth the wait. This EcoBoost engine comes from the factory with 310 horsepower with some head room for growth. The aftermarket eagerly embraced the EcoBoost engine and its potential has yet to be fully explored. Basic bolt-ons have already yielded impressive results, leaving much to the imagination for fully built engines.


The price of bitcoin hit yet another all-time high this week when the market managed to reach $4,190 on August 13 as SegWit has been locked in and will soon come into effect. However, that was not the only driver of the cryptocurrency's price. The Bitcoin ecosystem is showing clear signs of maturing, with the cryptoasset not only into a viable alternative asset class, but also underpinning a new industry.
Bitcoin's trading volumes have jumped so far in August and the number of bitcoin transactions have doubled from August 1 to August 14, returning to the pre-fork level around 260,000 per day. While some of this volume can be attributed to bitcoin holders selling their "free" bitcoin cash (BCH) tokens, there is also new money flowing into bitcoin now that the split that threatened bitcoin's existence has passed with little to no damage to the digital currency or its network.
Furthermore, the Bitcoin ecosystem is expanding as seen by Coinbase's recent $100 million cash injection in the form of a Series D funding that now values Coinbase at around $1.6 billion. This makes Coinbase the first bitcoin startup unicorn and is a big step towards fully legitimizing bitcoin and cryptocurrency as an asset class. Also, Fidelity expanded on their offering to let customers view their holdings on Coinbase, after initially rolling out the tracking service for bitcoin in May. GBTC is trading at a substantial premium to bitcoin, approval for an ETF looks to be on the horizon and big players in the financial space are starting to take bitcoin seriously.
The Bittrex exchange has been one of the main benefactors as well as driving forces behind the boost in altcoin trading as it has now become the second largest exchange in terms of traded volume for digital tokens, which is also indicative of the progress of the Bitcoin ecosystem.
Bittrex is most known for being one of the first large exchanges to list new altcoins (especially ICO tokens) and capitalized on the Bitcoin blockchain fork by capturing a big share of bitcoin cash's (BCH) trading volumes just after the split, as well as adequately handling the split. Improved confidence, as well as moves away from Poloniex by many traders due to several 'red flags,' has propelled Bittrex to the forefront as a leading cryptocurrency exchange. Further, the popular trading website TradingView.com recently added trading pairs for the exchange, further increasing the visibility of bitcoin (and cryptoassets) to established traders and investors.
While bitcoin is soaring, altcoins are not lagging behind by much. The price of ethereum shot back up through the $300 mark amidst geopolitical turmoil in Korea and the cryptocurrency of China-based smart contract platform NEO (formerly known as Antshares) has shot into the top ten cryptocurrencies by market share, as well as into the top five of CoinGecko's weighted rankings, rallying from $15 to $52.
This week's review is compiled from contributions by Alex Lielacher, Nigel Dollentas, Jamie Holmes, Joseph Young, and Michael Scott.
SegWit Lock-In: What Does it Mean for Bitcoin?
On August 9, the highly-anticipated Segregated Witness (SegWit) protocol upgrade to the Bitcoin blockchain was officially locked in on block 479,707. While there is still a two-week waiting period before SegWit will be fully activated, the lock-in means that all bitcoin mining operations have to implement this update now or else they will have to give up their bitcoin mining income going forward. The two-week waiting period gives Bitcoin participants the time to upgrade their systems to the new software and will be finished around August 22.
The move of the Bitcoin community to implement SegWit, which also led to the hard fork that created the new altcoin bitcoin cash was welcome by the majority of the community as well as investors who witnessed the price of bitcoin rally to new all-time highs.
Since August 9, tensions between North Korea and the US have intensified, with South Korean traders piling money into the cryptocurrency of the second largest blockchain network, Ethereum. ETH-USD breached the $300 handle and now finds support at this psychological level; we provide an outlook for the cryptocurrency going forward.
While markets across the world have shown increased volatility in response to the war of words, cryptocurrencies have remained fairly stable, incubated from any threat of a war on the Korean peninsula. The drama started on August 9, when a US report was released claiming that the North Koreans had developed a minature nuclear weapon.
Two Australian Senators from different political parties teamed up on August 8 to speak at the country's parliament in Canberra about the promise of blockchain technology, and urged the Reserve Bank of Australia to consider a Bitcoin-esque currency.
Liberal senator Jane Hume and Sam Dastyari, a Senator from the Labor party, have pushed forward blockchain adoption 'Down Under' with the formation of the Australian Parliamentary Friends of Blockchain group. The motivation for the group is best explained by Dastyari, who stated that when he first raised the topic of bitcoin in the Senate, one of his colleagues came to him and said: 'I don't get what the issue is, don't they just melt all the coin bits they don't use?' The Australian Parliamentary Friends on Blockchain group will provide a much-needed forum for all things related to digital currency.
In a move viewed as highly questionable within some cryptocurrency and libertarian circles, non-profit media group WikiLeaks, founded in 2006 by Australian computer programmer Julian Assange announced that it is now accepting donations via the privacy-centric cryptocurrency zcash.
WikiLeaks recently revealed on Twitter its intent to utilize this new payment option. Zcash becomes the third cryptocurrency the organization is accepting for donations, along with bitcoin and litecoin. Exactly one week later on August 13, the organization announced it would be accepting Monero, another privacy-focused cryptocurrency.
WikiLeaks has been accepting cryptocurrencies for donations since 2011. This move was in direct reaction to efforts on the part of banking institutions to thwart the nonprofit's revenue streams. All of this was part of a larger attempt to squelch WikiLeaks repute as a public disseminator of classified information and secrets. As a result, WikiLeaks, in an effort to do a end-around government controls, now utilizes a funding model that is primarily cryptocurrency based.
A group of elementary students, including eight-year-old computer prodigy Seth Yee, at the Wooranna Park Primary School in Australia work on programming 'WoorannaCoin' under the guidance of former network engineer Kieran Nolan, which teaches them methods of developing software behind Bitcoin, including the blockchain.
The family of Yee permanently relocated from Singapore to the Dandenong North suburb in Melbourne, Australia, to provide a better ecosystem for Seth, who has proven his talents in coding and software development over the past few months.
The emergence of young minds and developers who are exposed to the blockchain at an early age, including Seth, will allow the Bitcoin ecosystem and blockchain-based projects to evolve exponentially.
Microsoft announced on August 10 a new technology looking to speed up blockchain-based systems and make them more private at the same time on the enterprise level.
Blockchains have always been very good at maintaining data integrity due to every participant in a network having their own copy of the ledger to verify all transactions, but this made it difficult for large businesses with strict privacy requirements to adopt the technology.
The system is called Coco Framework, which stands for Confidential Consortium. Coco will be made ready and open source by 2018 Microsoft is claiming. Coco would make it to where companies could control who was able to see what was on the network, without slowing it down. Microsoft is planning to offer Coco for free, in hopes that customers of the framework will use their cloud services as well.


text:
The Giant and the Sun – The Great Hill II
July 17, 2018 July 15, 2018 | Sue Vincent
(Continued from Part I)
Halfway across the length of Maiden Castle, the terrain changes. It is a slight demarcation… little more than a step 'up' at one end… yet the change is palpable. While the western entrance leads onto a place where people lived, the eastern end of the enclosure is where the dead were laid, in the care of the priesthood. We do not know exactly how these people worshipped, though we may glean a little insight from the so-called 'primitive' tribes that still exist. Their beliefs would have been animistic and their priesthood would have included the healers and seers, the shaman and the wise-woman. The earth was a living being and every rock, tree and creature a manifestation of Spirit. The forms of faith may differ, but in essence, they are the same as our own.
Spearhead embedded in a skeleton's spine. Image taken from photo of information board.
On our first visit to the site, five years ago, we had felt the change in the land. It was only later, when we did the research that we found that we had 'seen true'. There are many graves in this part of the hillfort, all buried with reverence and respect, though some had died violent deaths. In the 1930s, Sir Mortimer Wheel found a cemetery containing fifty-two skeletons and, although many of the males had died of horrific injuries, they were buried with care. Grave goods of pots, metalwork and even joints of meat were sent with the dead to the otherworld.
Image taken from photo of information board.
At the easternmost point of the hillfort there is a gate. Few visitors seem to venture through it to the mirror-maze beyond. Echoing the western maze, this one is more unkempt, left in peace for the atmosphere to build and the energies to whisper, and it seems more ceremonial than practical. It had been within this maze that we had seen how it could be used for the rites of passage and we had planned on gathering our companions here for the third and final visualisation of the weekend. Unfortunately, when we reached the eastern end, half our companions were already following their own calling to the Roman temple…
Artist's impression of the Temple of Minerva. Image taken from photo of information board.
While many hillforts had fallen out of use by the time the Romans arrived, Maiden Castle continued to be occupied and acted as a centre for crafts and trade. When Vespasian subdued the south in AD43, it seems likely that resistance was strong from the fortress… over 2000 slingshots were found stored in pits near the entrance to the maze, the confusing and winding pathway that served as a defensive measure and processional way.
Plaque showing Minerva, found at the Temple. Image taken from photo of information board.
On the northern side of the Castle is the outline of a Romano-British Temple dating to around AD400. It was built on the site of an Iron Age building and may have replaced a much more ancient shrine. We do not know to whom the original shrine was dedicated, but a plaque found at the site shows Minerva and suggests the Temple may have been dedicated to the goddess of wisdom and had particular significance for one of our company. It had something to tell me too, had I but realised it.
The Briggate Minerva, Leeds; a sculpture by Andy Scott.
Her symbol is the Owl… which was going to prove astonishingly significant over the next few days. Being kept in the dark by your own mind sometimes where these things are concerned, it is only now that the pieces are coming together. The Owl is the symbol of my own home city, where a modern Minerva wears the Owl mask and holds three aligned stars, like those of Orion's Belt…which ties us back to the Giant and its alignments. I won't even mention that my city got its Owl from the nobility of Anjou, who were granted lands in the area after the Norman Conquest, or that the nobility of Anjou were major players in the birth of the Knights Templar… and we had started our adventures that weekend with a Templar Head.
So it was unexpectedly perfect that we gathered for the final visualisation at the centre of the Temple of Minerva, where we again joined with the Web of Light to send thoughts of peace and healing out into the world. It never matters that our plans must change when the unexpected occurs… leaving 'space for spirit' means accepting the gifts of the day and being aware that sometimes, the day knows best. And then the weekend was over. All that remained was to say our farewells in the car park… but once again, for some of us the weekend was not the end, but only a beginning. But that is another story…
The Giant and the Sun: Patterns in the landscape was the Silent Eye summer workshop weekend. These informal events are held several times every year and are open to all. You do not have to be a member to join us as we wander the rich landscape of Britain, visiting ancient, sacred and intriguing places. We seek out myth and mystery, exploring what the land and its stories can teach us about our own daily lives and our place in the intricate tapestry of human Being.
After each event, we publish an account of the places we have visited and share a little of what we have discussed during the course of the weekend to give a taste of what we do.
If you would like to join us for a wander through the mysteries and history of Britain, please visit our Events page.
Posted in The Silent eye	ancient sitesartgeometryhillforthistorylandscapelegendsphotographyspiritualitysymbolism.weekend workshop
< The Giant and the Sun – The Great Hill
An Orcadian Diary (4) – The light of the North >
17 thoughts on "The Giant and the Sun – The Great Hill II"
Alethea Kehas says:
Sorry I'm one of the wanderers… 😉
With good reason though 🙂 x
One hopes 😉 ❤
Helen Jones says:
Me too! Sorry – the compulsions were just so strong there. I can still feel the sword and flame… (and yes, am writing it up) 😉
And, I, the stab and falling over. I think I'd rather hold the sword and flame 😉 It was so great finally meeting you, Helen 🙂
It was lovely meeting you too, Alethea 😊 I do hope our paths cross again xx
I do too 🙂
That's why we leave space for spirit 🙂
( OOh good 🙂 )
Anne Copeland says:
This part of the post was so fascinating, and timely too. I subscribe for a free publication, Ancient Origins, and they publish a lot of articles on archaeology, ruins and history throughout the world. So as I had this article up and was reading it, along comes a notification from Ancient Origins that there was an article about the Romans and their death ceremonies, which were like a circus almost. They were definitely intended as entertainment and not something serious. They even had people dress up with masks to look like the deceased and family, for a fee of course. And the Romans would have a bigger ceremonial burial if they were wealthier. The practices of burials throughout the world are definitely worth a whole study in and of itself. Thank you all once again for bringing this great adventure to all of us.
I wonder if,by wearing the masks, there was a more serious purpose and they were inviting the spirits of the dead to participate?
Both parts were fascinating Sue and I can only imagine the intensity of the atmosphere within in the settlement. There are a couple of places in Ireland where we have visited that have an almost magnetic resonance that makes me feel very unnerved.
'Unnerved' is a good way to put it, Sally… not necessarily unpleasant, but it is definitely a state of 'otherness'.
You got it xxx
Pingback: Smorgasbord Blogger Daily – Tuesday 24th July 2018 – #History – Tony Riches, Sue Vincent and Brian Lageose | Smorgasbord – Variety is the spice of life
Please leave a comment - we would love to hear from you Cancel reply

redpajama_set_name: RedPajamaCommonCrawl


1999-02-12 Assigned to UNWIRED PLANET, INC. reassignment UNWIRED PLANET, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: KING, PETER F.
2001-09-21 Assigned to PHONE.COM, INC. reassignment PHONE.COM, INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: UNWIRED PLANET, INC.
2001-09-24 Assigned to OPENWAVE SYSTEMS INC. reassignment OPENWAVE SYSTEMS INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: PHONE.COM, INC.
2012-09-19 US case 3:12-cv-00505 filed litigation Critical https://portal.unifiedpatents.com/litigation/Nevada%20District%20Court/case/3%3A12-cv-00505 Source: District Court Jurisdiction: Nevada District Court "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
2012-09-19 First worldwide family litigation filed litigation https://patents.darts-ip.com/?family=22567565&utm_source=google_patent&utm_medium=platform_link&utm_campaign=public_patent_search&patent=US6317831(B1) "Global patent litigation dataset" by Darts-ip is licensed under a Creative Commons Attribution 4.0 International License.
2013-09-06 US case 3:13-cv-04134 filed litigation https://portal.unifiedpatents.com/litigation/California%20Northern%20District%20Court/case/3%3A13-cv-04134 Source: District Court Jurisdiction: California Northern District Court "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
2015-06-11 US case 2015-1725 filed litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/2015-1725 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
2015-07-06 US case 2015-1795 filed litigation https://portal.unifiedpatents.com/litigation/Court%20of%20Appeals%20for%20the%20Federal%20Circuit/case/2015-1795 Source: Court of Appeals for the Federal Circuit Jurisdiction: Court of Appeals for the Federal Circuit "Unified Patents Litigation Data" by Unified Patents is licensed under a Creative Commons Attribution 4.0 International License.
Improved techniques for facilitating secure data transfer over one-way data channels or narrowband channels are disclosed. Often, these channels are wireless channels provided by wireless data networks. The techniques enable cryptographic handshake operations for a one-way data channel to be performed over a companion two-way data channel so that the one-way data channel is able to effectively satisfy security protocols that require two-way communications for the cryptographic handshake operations. Once the cryptographic handshake operations are complete, data can be transmitted over the one-way data channel in a secure manner. Additionally, the techniques also enable the cryptographic handshake operations to be performed more rapidly because the two-way channel is typically a wideband channel. In which case, the use of a wideband channel instead of a narrowband channel for the cryptographic handshake operations results in latency reductions, regardless of whether the narrowband channel is a one-way channel or a two-way channel.
This application is related to U.S. application Ser. No. 09/071,235, filed Apr. 30, 1998, and entitled "METHOD AND SYSTEM FOR INTEGRATING NARROWBAND AND WIDEBAND DATA TRANSPORTS", the content of which is hereby incorporated by reference. This application is also related to U.S. application Ser. No. 09/070,668, filed Apr. 30, 1998, and entitled "METHOD AND APPARATUS FOR PROVIDING NETWORK ACCESS OVER DIFFERENT WIRELESS NETWORKS", the content of which is hereby incorporated by reference.
The present invention relates to wireless networks, and more particularly, to secure data transmissions over wireless networks.
Wireless networks are often used to transmit messages from one location in a network to a destination location in the network. These messages contain data to be supplied to the destination location. More specifically, the messages include a header portion and a data portion. The header portion includes an address of the destination location, and the data portion contains data. The destination location is, for example, a mobile device or a server. A mobile device typically interacts with wireless networks to receive various types of notifications or to request and receive data from another network to which the wireless network is connected.
FIG. 1 is a block diagram of a conventional wireless communication network 100. The wireless communication system 100 includes a sever 102, a wireless network 104, and mobile devices 106. There are n mobile devices 106-1 through 106-n. The server 102 is typically a computer system that operates to send and receive messages to and from the mobile devices 106. The messages are often blocks of data that are to be transmitted to the mobile device 106. As examples, the data can pertain to various types of notifications, electronic mail, news data, configuration information, data files, library files, program files, etc. The messages can also be requests for information (e.g., certain data) that are transmitted from the mobile devices 106 to the server 102. The server 102 may also connect to other wired or wireless networks to receive messages from or forward messages to other computer systems. As an example, the server 102 can be connected to the Internet. For example, the server 102 can be a proxy server (or link server) coupled to the Internet or a network gateway coupled to a network. The tremendous growth of the Internet in recent years has fueled the need to provide mobile devices such as mobile telephones, personal digital assistants (PDAs) and the like with access to information and services available on the Internet.
The wireless network 104 typically uses radio transmissions to communicate with the mobile devices 106. The wireless network 104 can use a variety of different networks and communication protocols. Examples of wireless networks include Cellular Digital Packet Data (CDPD), Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA) and Time Division Multiple Access (TDMA) to name a few, and each of these wireless networks has different data transfer characteristics such as latency, bandwidth, protocols and connection methods. As examples, protocols can be Internet Protocol (IP), Short Messaging System (SMS) and Unstructured Supplementary Service Data (USSD), and connection methods can include packet switched or circuit switched.
As an example, a message to be sent by the server 102 to the mobile device 106-2 would contain an address that particularly identifies the mobile device 106-2. The message is then provided by the server 102 to the wireless network 104. For example, one wireless data network is a packet switched network using a Small Message Server Center (SMSC) which has a relatively small packet size (e.g., 140 bytes). The wireless network 104 causes the message to be properly routed to the mobile device 106-2 (i.e., in accordance with the address). The transmission between the wireless network 104 and mobile device 106-2 is wireless. The mobile device 106-2 receives the message that has been transmitted the wireless network 104. The mobile device 106-2 can then store the message and perform predetermined processing actions such as, for example, notifying a user of the mobile device 106-2 of the reception of the message.
Before transmitting messages or data between the server 102 and the mobile devices 106, a connection between the server 102 and the particular one of the mobile devices 106 needs to be made, unless already established. Additionally, when the data to be transmitted is private or confidential, then a secure connection is to be used. A secure connection is a type of connection in which security measures are taken so that only the sender and desired receiver can understand the data. The security measures are implemented by cryptographic techniques such as encryption. Cryptographic techniques are described in detail in Schneier, "Applied Cryptography," Second Edition, John Wiley & Sons, Inc. (1996), which is hereby incorporated by reference.
A secure connection is established in accordance with protocols concerning transmissions over wireless networks. Examples of protocols that are able to provide secure connections include Handheld Device Transport Protocol (HDTP) and Wireless Transport Layer Security (WTLS). HDTP is described in "HDTP Draft Specification," version 1.1 (1997), and is hereby incorporated by reference. The WTLS is the security layer protocol for Wireless Application Protocol (WAP). WTLS is described in "Wireless Application Protocol Wireless Transport Layer Security" (WAP WTLS), Wireless Application Forum, Apr. 30, 1998, and is hereby incorporated by reference.
One problem with the conventional approach to establishing a secure connection is that it requires a two-way data channel. As examples, both the HDTP and the WTLS protocols require a handshake operation between the server and a mobile device to establish a secure connection. Conventionally, the two-way data channel is needed to provide the handshake operation. As a result, one-way data channels have not been able to utilize the security features of protocols that require a handshake operation.
In some wireless networks, the server and the mobile devices can be connected by two or more channels. In one case, the server and mobile devices can be connected over a one-way data channel and a two-way data channel. A representative network (e.g., GSM) having such characteristics can use a Short Message Service Center (SMSC) to provide the one-way data channel and an Interworking Function (IFW) to provide the two-way data channel. In such a network, the one-way data channel is often considered a narrowband channel and the two-way data channel is often considered a wideband channel. As an example, the narrowband channel can transfer data at a rate of about 400 bits per second (bps), while the wideband channel can transfer data at a rate of at least 14400 bps. It is thus not uncommon that a server and a mobile device be connected (or connectable) by both a two-way channel and a one-way channel. Typically, the server and the client will decide to use either or both of the channels depending on the urgency of the data, the cost willing to incur, etc. Use of a two-way channel often causes the mobile device to incur charges (i.e., fees) from a carrier that provides the service to the mobile device. In contrast, use of a one-way, narrowband channel is often available at no cost or at a fixed cost regardless of usage. The one-way channel, however, is not able to establish secure connections because the conventional approaches to security require a two-way channel. This seriously impedes the secure transmission of data over one-way channels.
Thus, there is a need for improved approaches to providing secure data transmissions over one-way channels.
Broadly speaking, the invention relates to improved techniques for facilitating secure data transfer over one-way data channels or narrowband channels. Often, these channels are wireless channels provided by wireless data networks. The invention enables cryptographic handshake operations for a one-way data channel to be performed over a companion two-way data channel so that the one-way data channel is able to effectively satisfy security protocols that require two-way communications for the cryptographic handshake operations. Once the cryptographic handshake operations are complete, data can be transmitted over the one-way data channel in a secure manner. Additionally, the invention also enables the cryptographic handshake operations to be performed more rapidly because the two-way channel is typically a wideband channel. In which case, the use of a wideband channel instead of a narrowband channel for the cryptographic handshake operations results in latency reductions, regardless of whether the narrowband channel is a one-way channel or a two-way channel.
The invention can be implemented in numerous ways, including as a method, a computer readable medium, an apparatus, and a system. Several embodiments of the invention are discussed below.
As a method for securely transmitting data between a client and a server over a narrowband channel, where the client and server are connectable by not only the narrowband channel but also by a wideband channel, an embodiment of the invention includes the acts of: connecting the client and server over the wideband channel; exchanging security information between the client and server over the wideband channel; encrypting data to be transmitted from the server to the client using the security information at the server; and transmitting the encrypted data from the server to the client over the narrowband channel.
As a method for transmitting data in a secure manner from a server to a client, an embodiment of the invention includes the acts of: exchanging security information between the client and the server over a two-way channel between the client and the server; encrypting data to be transmitted from the server to the client based on the security information; and transmitting the encrypted data from the server to the client over a one-way channel between the client and the server that carries data from the server to the client.
As a wireless communication system, an embodiment of the invention includes: a wired network having a plurality of server computers; a wireless carrier network operatively connected to the wired network, the wireless carrier network supporting a first channel and a second channel, at least the first channel is a two-way data channel; a network gateway coupled between the wired network and the wireless carrier network, the network gateway includes a secure connection processor that establishes a secure connection over the first channel by exchanging security information over the second channel; and a plurality of wireless mobile devices that can exchange data with the server computers on the wired network via the wireless carrier network and the network gateway. The messages are supplied from the network gateway to the wireless mobile devices over the secure connection established over the first channel.
As a mobile device capable of connecting to a network of computers through a wireless link, an embodiment of the invention includes: a display screen that displays graphics and text; a message buffer that temporarily stores a message from a computer on the network of computers, the message having a service identity associated therewith; an application that utilizes the message received from the computer on the network of computers; and a cryptographic controller that controls encryption or signature of outgoing messages and controls the decryption or authentication of incoming messages, the cryptographic controller operates to establish a secure connection over which it receives the incoming messages by using a one-way channel, wherein a companion two-way channel is used to exchange security information needed to establish the secure connection over the one-way channel.
As a computer readable medium including computer program code for securely transmitting data between a client and a server over a narrowband channel, where the client and server are connectable by not only the narrowband channel but also by a wideband channel, an embodiment of the invention includes: computer program code for connecting the client and server over the wideband channel; computer program code for exchanging security information between the client and server over the wideband channel; computer program code for cryptographically processing data to be transmitted using the security information; and computer program code for transmitting the cryptographically processed data from the server to the client over the narrowband channel.
As a computer readable medium including computer program code for transmitting data in a secure manner from a server to a client, an embodiment of the invention includes: computer program code for exchanging security information between the client and the server over a two-way channel between the client and the server; computer program code for cryptographically processing data to be transmitted from the server to the client based on the security information; and computer program code for transmitting the cryptographically processed data from the server to the client over a one-way channel between the client and the server that carries data from the server to the client.
The advantages of the invention are numerous. Several advantages that embodiments of the invention may include are as follows. One advantage of the invention is that a secure connection can be established over a one-way channel. Another advantage of the invention is that the establishment of a secured connection can be rapidly achieved, thus improving the latency for such operations as compared to conventional approaches. Yet another advantage of the invention is that a server is provided with the option of additional secure data paths to a client (e.g., mobile device), whereby the server can use either or both of the paths depending on particular selection criteria including cost, speed and availability.
Other aspects and advantages of the invention will become apparent from the following detailed description, taken in conjunction with the accompanying drawings which illustrate, by way of example, the principles of the invention.
FIG. 10B is a block diagram of mobile device suitable for use with the representative communication system illustrated in FIG. 9.
The invention relates to improved techniques for facilitating secure data transfer over one-way data channels or narrowband channels. Often, these channels are wireless channels provided by wireless data networks. The invention enables cryptographic handshake operations for a one-way data channel to be performed over a companion two-way data channel so that the one-way data channel is able to effectively satisfy security protocols that require two-way communications for the cryptographic handshake operations. Once the cryptographic handshake operations are complete, data can be transmitted over the one-way data channel in a secure manner. Additionally, the invention also enables the cryptographic handshake operations to be performed more rapidly because the two-way channel is typically a wideband channel. In which case, the use of a wideband channel instead of a narrowband channel for the cryptographic handshake operations results in latency reductions, regardless of whether the narrowband channel is a one-way channel or a two-way channel.
Embodiments of the invention are discussed below with reference to FIGS. 2A-10B. However, those skilled in the art will readily appreciate that the detailed description given herein with respect to these figures is for explanatory purposes as the invention extends beyond these limited embodiments.
FIG. 2A is a block diagram of a communication system 200 suitable for coupling a mobile communication device to the Internet. Specifically, the communication system 200 includes mobile communication devices 202A and 202B. These mobile communication devices 202A and 202B respectively couple through carrier networks 204A and 204B to a network gateway 206. The network gateway 206 facilitates the coupling of the mobile communication devices 202A and 202B with the Internet 208. As is common, various computer systems including computers supporting remote server A 210 and remote server B 212 are coupled to or form part of the Internet 208. The primary function of the network gateway 206 is to receive data requests from the mobile communications devices 202A and 202B via the carrier networks 204A and 204B, respectively, and convert them into Hyper Text Transfer Protocol (HTTP) requests for use with the Internet 208. Likewise, the network gateway 206 also receives HTTP responses from the Internet 208 and converts them to data responses with a format (e.g., protocol) suitable for use with the carrier networks 204A and 204B.
The network gateway 206 is connected to the carrier network A 204A by a first channel 214 and a second channel 216. The first channel 214 is a two-way channel or a bi-directional channel. The second channel 216 is a one-way channel or a unidirectional channel. In addition, the network gateway 206 is connected to the carrier network B 204B by a first channel 218 and a second channel 220. Both the first channel 218 and the second channels 220 are two-way channel or bi-directional channels. The carrier networks 204A and 204B then respectively connect to the mobile communication devices 202A and 202B in a wireless manner.
The transmission of data associated with data requests and data responses between the network gateway 206 and the mobile communication devices 202A and 202B is performed over connections. In some cases, when the data being transmitted is sensitive, the connections are secure connections through the Internet 208. A secure connection is a connection over which encrypted and or authenticated data is transmitted. To establish secure connections, security protocols for wireless networks require the exchange of cryptographic parameters in a handshake operation. With one-way channels, the handshaking operation could not conventionally be performed and thus secure connections could not be established over one-way channels.
According to the invention, secure connections are able to be established over one-way channels. In the embodiment of the communication system 200 illustrated in FIG. 2A, the second channel 216 is a one-way data channel which supports transmission of data from the network gateway 206 to the carrier network A 204A, and does not allow transmission of data from the carrier network A 204A to the network gateway 206. Hence, obtaining a secure connection over the second channel 216 is not possible because handshaking is not possible. However, the first channel 214 is a two-way data channel which supports transmission of data in both directions between the network gateway 206 and the carrier network A 204A. According to the invention, the first channel 214 is used to perform the necessary handshaking operations for the second channel 216 such that a secure connection is able to be established over the second channel 216. Additional details on how the handshaking is performed are provided below.
Furthermore, according to the invention, secure channels are also able to be established more efficiently or rapidly over two-way channels. In the embodiment of the communication system 200 illustrated in FIG. 2A, the first channel 218 is a two-way, wideband data channel which supports high speed transmission of data in both directions between the network gateway 206 and the carrier network B 204B. The second channel 220 is a two-way, narrowband data channel which supports high speed transmission of data in both directions between the network gateway 206 and the carrier network B 204B. According to the invention, the first channel 218 is used to perform the necessary handshaking operations for the second channel 220 such that a secure connection is able to be more efficiently and rapidly established over the second channel 220. The improvement results from the use of a wider bandwidth channel to perform the handshaking operation. Additional details on how the handshaking is performed are provided below.
The communication system 200 is a representative communication system in which the network gateway 206 is coupled to the Internet 208 such that mobile communications devices 202A and 202B can interact with the Internet 208. The connection of the mobile communication devices 202A and 202B to the network gateway 206 is through one or more wireless networks supported by the carrier networks 204A and 203B. Although not illustrated, the communication system 200 can often support a large number of mobile communication devices. Further, the Internet 208 can more generally be any network (e.g., a private network, a public network, a Wide Area Network or a Local Area Network). The network gateway 206 typically operates as a proxy server, but more generally is a server.
FIG. 2B is a block diagram of a communication system 250 according to a basic embodiment of the invention. The communication system 250, for example, is a subsystem of a larger communication system such as the communication system 200 illustrated in FIG. 2A. The communication system 250 includes a server 252, a client A 254 and a client B 256. A server 252 can take a variety of forms including a proxy server or a network gateway. The server 252 interacts with the clients 254 and 256 to exchange data between the server and the client. Typically, the server 252 couples to a network and thus enables the clients 254 and 256 to interact with the network. The network can take a variety of forms include a Local Area Network (LAN), a Wide Area Network (WAN) or the Internet. Often the server 252 will support more clients than the two clients 254 and 256 illustrated in FIG. 2B.
Each of the clients 254 and 256 are connected the server 252 through a pair of communication channels. These communication channels are wireless channels and can be constantly connected (linked) or temporarily connected (linked). While these connections or links are preferably wireless (i.e., not wired), some portion of the connections can be wired as is known in the art. These wireless communication channels can be provided by a variety of wireless networks, including packet switched wireless data networks or circuit switched wireless data networks. More particularly, the server 252 is connected to the client A 254 through a narrowband channel A (NBCA) 258 as well through as a wideband channel A (WBCA) 260. Similarly, the server 252 is connected to the client B 256 through a narrowband channel (NBCB) 262 as well as through a wideband channel B (WBCB) 264. The narrowband channel A (NBCA) and the wideband channel A (WBCA) can be considered provided by a wireless network A, and the narrowband channel B (NBCB) and the wideband channel B (WBCB) can be considered provided by a wireless network B.
The wideband channels (WBCA and WBCB) 260 and 264 support greater bandwidths or data transfer rates than do the narrowband channels (NBCA and NBCB) 258 and 262. Accordingly, the ability to transfer data between the server and the client is significantly slower on the narrowband channels as opposed to the wideband channels. As an example, narrowband channels can transfer data at a rate of about 400 bits per second (bps), while wideband channels can transfer data at a rate of at least 14400 bps. The trade-off in bandwidth or transfer rate is typically reflected in the cost for use of the respective channels. In other words, it is often more expensive to transmit data over the wideband channel than the narrowband channel.
Often, there is a need or desire to transmit data between server and client in a secure manner. In such cases, cryptographic techniques (e.g., encryption) are used to provide the secure data transfer. As noted above, encryption techniques normally require that a server and a client perform a handshake operation in which security information is passed from client to server and from server to client. After the server and the client perform the handshake operation, the server and client are able to encrypt data at one end, transmit the encrypted data, and then decrypt the received data at the other end.
In the case of the wideband channels (WBCA and WBCB) 260 and 264, the exchanging of security information via the handshake operation is easily achieved because the wideband channels are normally two-way channels. However, the narrowband channels (NBCA and NBCB) 258 and 262 are often one-way channels that support transmissions from the server to the client but not from the client to server. As such, when the narrowband channels (NBCA and NBCB) 258 and 262 are one-way channels, the exchanging of security information via the handshake operation cannot be performed. Additionally, even when a narrowband channel is a two-way channel, the latency or delay to perform the handshake operation over the narrowband channel is greater (as compared to a wideband channel) due to its often significantly lower bandwidth or data transfer rate than the wideband channel.
According to the invention, secure data transfer can be performed over one channel because the exchange of the security information for a handshake operation occurs over another channel. In one embodiment, the exchange of security information is performed over a two-way channel so that secure data transfer can be performed over a one-way channel. In another embodiment, the exchange of security information is performed over a wideband channel so that secure data transfer can be performed over a narrowband channel.
FIG. 3 is a flow diagram of narrowband secure data transmission processing 300 according to an embodiment of the invention. The narrowband secure data transmission processing 300 occurs between a client and a server and can, for example, be performed by the communication system 200 illustrated in FIG. 2a.
The narrowband secure data transmission processing 300 begins with a decision block 302. As an example, the server may request a secure narrowband connection when it desires to send (or "push") data to a particular client. When the decision block 302 determines that a secure narrowband connection has not been requested, then the narrowband secure data transmission processing 300 awaits the reception of such a request. In other words, the narrowband secure data transmission processing 300 is only utilized when secure data transmission are to occur over a narrowband channel, other non-secure transmissions or secure transmissions over wideband channels follow other processing known in the art.
Once the decision block 302 determines that a secure narrowband connection has been requested, then processing is invoked to carry out the narrowband secure data transmission processing 300. Specifically, the client and the server are connected 304 over a two-way wideband channel. Then, narrowband security information is exchanged 306 between the client and the server over the wideband channel. The security information typically contains keys and other crpytographic parameters used with encryption algorithms. One popular set of encryption algorithms include public-key encryption algorithms. It should be noted that the exchange of the security information is being performed over the wideband channel when the connection request is for the transmission of data over the narrowband channel. Following block 306, the client and server are able to set up a secure connection between the server and the client over the narrow band channel because the required handshake operation has been performed. In other words, the security information that has been exchanged over the wideband channel is used to set up the secure connection over the narrowband channel.
Next, a decision block 308 determines whether there is data to be transmitted. When the decision block 308 determines that there is presently no data to be transmitted, then the narrowband secure data transmission processing 300 awaits the availability of data. Once the decision block 308 determines that data is available to be transmitted, then the data to be transmitted is encrypted 310 based on the security information. After the data is encrypted, the encrypted data is transmitted 312 over the narrowband channel. Here, the connection between the server and the client over the narrowband channel is assumed to be already established. However, in other embodiments, prior to the transmission of the encrypted data over the narrowband channel, a connection between the server and client over the narrow band channel may need to be established.
Following block 312, a decision block 314 determines whether the connection over the narrowband channel is still open. For a variety of reasons, a connection is often closed, and these reasons include a time-out condition, an error condition, or for security reasons. When the decision block 314 determines that the connection is still open, the narrowband secure data transmission processing 300 returns to repeat the decision block 308 and subsequent blocks. On the other hand, once the decision block 314 determines that the connection is no longer open, then the narrowband secure data transmission processing 300 returns to repeat the decision block 302 and subsequent blocks so that secure connection is re-established.
The narrowband channel used with the narrowband secure data transmission processing 300 can be either a one-way (server to client) or a two-way channel. As noted above, the invention provides advantages in either situation, though the invention is particularly beneficial when the narrowband channel is only a one-way channel from server to client.
Given that the server 252 and the clients 254 and 256 are connected by at least a pair of channels (258-264) as shown in FIG. 2B, it is not uncommon for secure transmissions to be concurrently utilized over both of the channels between server and client. In such cases, each channel needs to effectuate a handshaking operation to exchange security information needed for the establishment of a secure connection. FIGS. 4 and 5 describe the establishment of dual secure connections for a pair of channels between a server and a client.
FIG. 4 is a flow diagram of client-side secure connection processing 400 according to an embodiment of the invention. The client-side secure connection processing 400 is, for example, performed by a client such as the client 254 or the client 256 illustrated in FIG. 2a. In this embodiment, it is assumed that both first and second channels between a client and a server are to be used to provide secure connections.
The client-side secure connection processing 400 initially sends 402 a secure session request to a server (e.g., the server 202 illustrated in FIG. 2). Here, the secure session request is a request to setup secure connections over first and second channels. A decision block 404 then determines whether a response to the secure session request has been received. Here, the client is awaiting a response from the server. When the decision block 404 determines that a response has not yet been received, the decision block 404 causes the client-side secure connection processing 400 to await the reception of such a response. The request and response operate to exchange security information as a first handshake operation in accordance with a security protocol. The security information, for example, would contain cryptographic parameters that specify keys, random numbers, algorithms, vectors and the like for various cryptographic techniques.
Once a response has been received, a first key block for a first channel between the server and the client is generated 406. The first key block is used to contain keys used to encrypt or authenticate data or blocks of data that are to be transmitted between the server and the client via the first channel. Thereafter, a secure session complete notification is sent 408 to the server. The secure session complete is a notification to the server that the client has acknowledge receipt of the response and is prepared for a secured session.
Next, a decision block 410 determines whether a secure session has been established for the first channel. A secure session is established the client requests and the server agrees to setup the secure session, and then does setup the secure session. When the decision block 410 determines that the secure session has been established, then the secured session for the first channel is ready.
Now, the secure session for a second channel is established. Security information for the second channel is also sent 412 from the client to the server. It should be noted that the security information is sent 412 to the server over the first channel. The reasons for using the first channel are (i) necessity when the second channel cannot transmit data to the server or (ii) a latency improvement when the second channel is a narrowband channel.
Next, a decision block 414 determines whether security information has been received from the server. The security information from the server is also received over the first channel. The security information from the server is in response to the security information sent to the server by the client. This exchange of security information is a second handshake operation in accordance with a security protocol. The decision block 414 causes the client-side secure connection processing 400 to await the reception of security information from the server. Once the decision block 414 determines that the security information has been received, a second key block for a second channel is generated 416. Again, the second key block contains session keys that are used to encrypt or authenticate data or blocks of data that are to be transmitted over the second channel in a secure manner. Following block 416, the client-side secure connection processing 400 is complete and ends.
Additionally, when the decision block 410 determines that the secure session has not been established between the server and the client, then the client-side secure connection processing 400 issues 418 an error notification. Following block 418, the client-side secure connection processing 400 is complete and ends.
FIG. 5 is the flow diagram of server-side secure connection processing 500 according to an embodiment of the invention. The server-side secure connection processing 500 is, for example, performed by a server such as the server 252 illustrated in FIG. 2B.
The server-side secure connection processing 500 begins with a decision block 502. The decision block 502 determines whether a secure session request has been received. Typically, the secure session request will be issued by a client and then received by the server. The decision block 502 causes the server-side secure connection processing 500 to await the reception of a secure session request. Here, the secure session request is a request to setup secure connections over first and second channels.
Once a secure session request has been received, the server-side secure connection processing 500 continues. A first key block for a first channel is generated 504. A response is then sent 506 to the client that has requested the secure session. The secure session request and the response operate to exchange security information as a first handshake operation in accordance with a security protocol. Examples of protocols for a wireless network environment are HDTP and WAP WTLS. The security information, for example, would contain cryptographic parameters that specify keys, random numbers, algorithms, vectors and the like for various cryptographic techniques.
Next, a decision block 508 determines whether a secure session complete notification has been received. The secure session complete protocol is sent by the client to the server when the client has established a secure session for the first channel. The decision block 508 causes the server-side secure connection processing 500 to await the reception of the secure session complete notification. A decision block 510 then determines whether a secure session is established. When the decision block 510 determines that a secure session has been established, a decision block 512 determines whether security information has been received. Here, the security information would be received at the server after having been transmitted by the client. The security information is for the second channel. The client would send the security information to the server as part of its communications with the server in accordance with a protocol to establish a secure session for the second channel. As an example, the protocol here can be a session layer protocol or a transport layer protocol (e.g., HDTP).
Once the decision block 512 determines that the security information for the second channel sent to the client has been received, then the server sends 514 security information for the second channel to the client. A second key block is then generated 516 for the second channel. Following block 516, the server-side secure connection processing 500 is complete and ends.
Additionally, when the decision block 510 determines that a secure connection cannot be established between the server and the client, the server-side secure connection processing 500 issues 518 an error notification. Following block 518, the server-side secure connection processing 500 is complete and ends.
The sending and receiving of a secure session request as well as the sending and receiving of the security information are performed over the first channel. The information exchanged between client and server over the first channel is used to setup the secure communications between the client and server over the first channel and the second channel. The first key block is used to encrypt data transmitted over the first channel from the client to the server as well as to decrypt data received from the server over the first channel. The second key block is used to decrypt data received from the server over the second channel. In one embodiment, the first channel is a two-way channel and the second channel is a one-way channel. In another embodiment, the first channel is a two-way, wideband channel and the second channel is a two-way, narrowband channel.
In the case where the security protocol involved is HDTP, the secure session for the first channel is performed in ordinary course. The secure session for the second channel can piggyback on the client and server exchanges for the secure session for the first channel. Namely, HDTP uses HTTP type content transfer and thus headers (e.g., session headers) are normally exchanged between client and server. These headers can be used to exchange the security information for the second channel (blocks 414, 416, 512 and 514).
In the case where WAP is used, the security protocol involved is WTLS and a session-level protocol is Wireless Session Protocol (WSP). WSP also performs uses HTTP type content transfers. When WSP and WTLS create a secure session, headers (e.g., session headers) are normally exchanged between client and server. As with HDTP, these headers can be used to exchange the security information for the second channel (blocks 414, 416, 512 and 514).
Regardless of the specific protocol being used, a portion of the security information can be common (or shared) by both channels. In the case where the Diffie Hellman public-key encryption algorithm is used, the exchanges during the handshake operations include a key exchange and a random number exchange. Hence, normally, a key exchange and a random number exchange would be separately required for each channel. However, by sharing the same key for both channels, the second key exchange can be eliminated. Likewise, the sharing of the same random number can eliminate the random number exchange. The sharing of a portion of the security information improves latency or efficiency of the secure connection setup, but can result in a reduction in the strength of the security.
Moreover, it may be desirable to used the same security information for both (e.g., multiple) channels. In such cases, there need not be any exchange of security information for the second channel (or more channels) besides the security information exchanged for the first channel. Here, all the security information would be shared by the channels. Different connection identifiers would, however, distinguish the connections. For example, with respect to FIG. 4, blocks 412 and 414 could be eliminated, and with respect to FIG. 5, blocks 512 and 514 could be eliminated. Also, the generation of the second key block (blocks 416 and 516), could be eliminated by sharing of a key bock (e.g., first key block). Thus, secure connections can be setup over both (or multiple) channels using the same cryptographic parameters, with the tradeoff being a reduction in strength of the security.
FIG. 6 is a flow diagram of data transmission processing 600 according to an embodiment of the invention. In this embodiment, the data is typically transmitted over a second channel from the server to the client. As an example, the second channel is a one-way narrowband channel. The data transmission processing 600 follows the establishment of the secure session (connection) between the server and the client over the second channel as depicted in FIG. 4. Data transmission, if any, over the first channel is not shown.
The data transmission processing 600 begins with a decision block 602. The decision block 602 determines whether there is data to transmit over the second channel. When the decision block 602 determines that there is presently no data waiting to be transmitted over the second channel, then the data transmission processing 600 simply awaits the reception of such data.
Once the decision block 602 determines that there is data to be transmitted over the second channel, then the data transmission processing 600 proceeds so that the data is transmitted. Again, the secure session (connection) has already been setup for the second channel. Specifically, a block of the data is obtained 604. One or more keys from the second key block are obtained 606. Typically, an authentication key and an encryption key are obtained from the second key block. An initialization vector can also be obtained from the second key block. The initialization vector is used as a random seed for block-cipher encryption algorithms. Here, the second key block was generated in block 514 of the server-side secure connection processing 500 illustrated in FIG. 5. The second key block is located at the server.
Next, the block of data is encrypted and/or sign 608 using the key(s) obtained from the second key block. The particular signature technique used is, for example, a one-way hash algorithm. The particular encryption algorithm used can vary widely, but often public-key encryption algorithms are appropriate. In one embodiment, assuming both signature and encryption are desired, the block of data would be signed using the signature technique and the authentication key, and the block of data would be encrypted using the encryption algorithm and the encryption key, and then the two process blocks would be appended together.
Following block 608, the encrypted block of data is transmitted 610 over the second channel. Thereafter, a decision block 612 determines whether there is more data to be transmitted over the second channel. When the decision block 612 determines that there is more data to be transmitted, then the data transmission processing 600 returns to repeat the block 604 and subsequent blocks. On the other hand, when the decision block 612 determines that there is no more data to be transmitted over the second channel, then the data transmission processing 600 is complete and ends.
FIG. 7 is a flow diagram of data reception processing 700 according to an embodiment of the invention. In this embodiment, data is being received over a second channel. As an example, the second channel is a one-way, narrowband channel from the server to the client. In one implementation of the data reception processing 700, the processing is performed by a client such as the client 254 and 256 illustrated in FIG. 2B. The data reception processing 700 follows the data transmission processing 600, and thus the establishment of the secure session (connection) between the server and the client over the second channel as depicted in FIG. 4. Data reception, if any, over the first channel is not shown.
The data reception processing 700 begins with a decision block 702. The decision block 702 determines whether a block of data has been received over the second channel. The decision block 702 causes the data reception processing 700 to wait until at least one block of data has been received over the second channel. However, once the decision block 702 determines that at least one block of data has been received over the second channel, the data reception processing 700 continues so that the block of data can be processed. Namely, one or more keys are obtained 704 from the second key block. Typically, an authentication key and an encryption key are obtained from the second key block. An initialization vector that is used as a random seed for block-cipher encryption algorithms can also be obtained from the second key block. Here, the second key block is, for example, the second key block that was generated in block 414 of the client-side secure connection processing 400 illustrated in FIG. 4. In other words, the second key block here is local to the client.
Next, the block of data that has been received is decrypted and/or authenticated 706 using the key(s) that were obtained from the second key block. In one embodiment, assuming both signature and encryption were performed at the server side on the data being transmitted and now received at the client, the block of data received would be both signed and encrypted. Hence, in such an embodiment, the received block of data would be authenticated using the authentication key obtained 704 from the second key block at the client side, and the received block of data would also be decrypted using the encryption key also obtained 704 from the second key block at the client side.
After the block of data has been decrypted and/or authenticated 706, the decrypted block of data is stored 708 for subsequent use. Following block 708, the data reception processing 700 returns to repeat the decision block 702 and following blocks so that subsequent blocks of data can be processed as they are received over the second channel.
Carrier networks are commonly classified into packet-switched networks and circuit-switched networks. In packet-switched networks, communications between the carrier network and the wireless communication device can use Internet Protocol (IP) addressing because the wireless communication device has its own individual IP address. Circuit-switched networks, on the other hand, require the establishment of a circuit with the carrier network before the wireless communication device can communicate with the carrier network. In such networks, the wireless communication devices do not have a static IP address but instead have a dynamically assigned IP address or unique phone numbers. One example of a packet-switched carrier network is CDPD. One example of a circuit-switched network is Code Division Multiple Access (CDMA) and Global System for Mobile communications (GSM).
FIG. 8 is a block diagram of a communication system 800 according to an embodiment of the invention. The communication system 800 includes a network gateway 802 that facilitates access and retrieval of information from the Internet 208 to the wireless communication devices 202X, 202Y and 202Z. The network gateway operates similar to the network gateway 206 illustrated in FIG. 2A. The communication system 800, however, specifically pertains to the situation where the carrier network X 804 is a packet-switched network such as CDPD, the carrier network Y 806 is a SMS-type network using CDMA with an interface protocol of SMPP, and the carrier network C 808 is another SMS-type network that uses GSM with an interface protocol of UCP.
Since the carrier network Y 806 and the carrier network Z 808 are circuit-switched networks using SMS, they use Small Message Server Centers (SMSCs) and Inter-Working Functions (IWF) to provide communication with the carrier networks. The use of the SMSCs and the IWFs are conventional and typically provided by the carrier networks so that messaging and interaction can be achieved with the carrier networks. Hence, the communication system 800 includes SMSC-Y 810 and SMSC-Z 812 which respectively provide message services to wireless communication devices coupled to the carrier network Y 806 and the carrier network Z 808, respectively. The SMSCs 810 and 812 provide one-way notifications from the multi-network gateway 802 to the wireless communication devices on the carrier network Y 806 and the carrier network Z 808, respectively. The IWF-B 814 and the IWF-C 816 are respectively used to provide two-way interaction between the network gateway 802 and the carrier network-Y 806 and the carrier network-Z 808, respectively. The SMSC connections to the carrier networks are typically referred to as narrowband channels, whereas the IWF connections to the carrier networks are wideband channels. In this embodiment, the SMSC connections to the carrier networks are one-way, narrowband channels, whereas the IWF connections to the carrier networks are two-way, wideband channels.
FIG. 9 is a block diagram of a representative communication system 900 for use with the invention. The communication system 900 includes a wired section 902 and a wireless section 904. The wired section 902 includes a network 906 and a network gateway 908. In one embodiment, the network 906 is the Internet, which represents a large number of interconnected computers. In another embodiment, the network 906 is an intranet or private network of computers.
The network gateway 908 operates to provide a gateway from the wired section 902 and the wireless section 904. The network gateway 908 serves as a primary transition point between the wireless communication of the wireless section 904 and the wired communication of the wired section 902. The network gateway 908 receives the incoming content request from the carrier network 914 and performs protocol conversion as necessary. The network gateway 908 will normally perform some protocol translation and other account management and verification operations. The network gateway 908 includes an account information storage area 910 that stores account, configuration and other information. The wireless section 904 includes a carrier network 914 and at least one remote wireless computing device 916. The network gateway 908 also receives messages from the network 906 and forwards them to the appropriate remote computing devices.
The remote computing device 916 can, for example, be a mobile phone, a Personal Digital Assistant (PDA), or a portable general purpose computer. The remote wireless computing device 916 includes a display 918 for displaying screens or pages of information, a remote wireless browser 920, and navigation buttons 922 and 924. The remote wireless browser 920 is usually an application program that executes on the remote computing device 916. The remote wireless browser 920 provides the screens or pages of information to be displayed on the display 918. The navigation buttons 922 and 924 allow a user to navigate through or make selections from menus or lists being displayed on the display 918 by the remote wireless browser 920. The remote wireless computing device 916 can also include an alphanumeric keypad (not shown) that allows a user to enter alphanumeric information, though such is not necessary as alphanumeric information can also be entered using a dial screen displayed on the display 918 with selections being made using the navigation buttons 922 and 924. By interacting with the remote wireless browser 920, a user is able to access information located on the network 906. According to the invention, secure sessions between at least over the wireless section 904, namely between the remote wireless browser 920 and the network gateway 908. As noted above, these secure sessions can be provided even on one-way channels through the carrier network 914.
Typically, the wireless section 904 will include a plurality of remote wireless browsers 920, each of which executes on a different remote computing device. The configuration and other information stored in the account information storage area 910 can store service limitations, security limitations, preference information, screen configuration information, and the like for each of the remote wireless browsers 920. The account information storage area 910 can also store data or pages of data that are of interest to the remote wireless browsers 920. The stored data or pages can operate as a cache of information previously requested from the network 906 or can operate as an information server within the network gateway 908. For example, as an information server, the storage pages can represent pages to be displayed by the remote wireless browsers.
FIG. 10A is a block diagram of a network gateway 1000 suitable for use with the representative communication system 900 illustrated in FIG. 9. The network gateway 1000 can, for example, represent the network gateway 908 illustrated in FIG. 9 which is typically a server computer. To avoid obscuring aspects of the present invention, well known methods, procedures, components, and circuitry in the network gateway 1000 are not described in detail.
The network gateway 1000 includes a User Datagram Protocol (UDP) interface 1002 that couples to the carrier network 914, an HTTP interface 1004 that couples to the network 906, and a server module 1006 coupled between the UDP interface 1002 and the HTTP interface 1004. The server module 1006 performs traditional server processing pass as well as protocol conversion processing. In particular, the protocol conversion processing includes protocol conversion between UDP and HTTP. The server module 1006 also performs the processing associated secure sessions described above with respect to FIGS. 5 and 5. Further, to assist the server module 1006 in its processing, the proxy server 1000 includes a random access memory (RAM) 1008 and a read-only memory (ROM) 1010. Among other things, the RAM 1008 will store device identifiers, subscriber identifiers, configuration information, security information, and alias conversion information. In one embodiment, such information is stored in the RAM 1010 as a database. Also, the RAM 1010 can represent the account information storage area 910 illustrated in FIG. 9.
FIG. 10B is a block diagram of mobile device 1050 suitable for use with the representative communication system 900 illustrated in FIG. 9. The mobile device 1050 can, for example, correspond to the remote computing device 918 that operates the remote wireless browser 916 illustrated in FIG. 9.
The mobile device 1050 includes a UDP interface 1052 that couples to the carrier network 914 via a RF transceiver 1053 to receive incoming and outgoing signals. A device identifier (ID) storage 1054 supplies a device ID to the UDP interface 1052. The device ID identifies a specific code that is associated with a particular mobile device 1050. In addition, the mobile device 1050 includes a client module 1056 that performs many of the processing tasks performed by the mobile device 1050 including establishing a communication session with the carrier network 1014 and the network gateway 908, requesting and receiving data (e.g., pages) from the network 906, displaying information on a display of the remote computing device, and receiving user input. The client module 1056 is coupled to the UDP interface 1052 for the establishment of a communication session and the requesting and receiving of data. The client module 1056 also performs the processing associated with the transmission and reception of the messages transmitted from the gateway computer 908, 1000, including the secure session processing described above with respect to FIGS. 4 and 7. The client module 1056 controls the display driver 1058 to display information on the display 1060 to the user. Additionally, the client module 1056 is coupled to an input device 1062, a ROM 1064, and a RAM 1066. Preferably, among other things, the client module 1056 operates a network browser, such as a Handheld Device Markup Language (HDML) web browser. The input device 1062 allows a user of the mobile device 1050 to input data and thus make selections in controlling and using the mobile device 1050. The ROM 1064 stores predetermined data and processing instructions for the client module 1056. The RAM 1066 is used to provide temporary data storage for security information as well as for incoming and outgoing data being received and transmitted.
Although embodiments of the network gateway 1000 and the mobile device 1050 described in FIGS. 10A and 10B using UDP and HTTP protocols, it should be recognized that other protocols and other protocol stacks can be provided and utilized. Additional details on the design and construction of the network gateway 1000 and the mobile device 1050 are contained in U.S. patent application Ser. No. 08/570,210 entitled "METHOD AND ARCHITECTURE FOR AN INTERACTIVE TWO-WAY DATA COMMUNICATION NETWORK" by Alain Rossmann, which is hereby incorporated by reference.
transmitting the encrypted data from the server to the client over the narrowband channel.
encrypting the data to be transmitted from the server to the client using the server-side narrowband channel key block.
decrypting the encrypted data that has been received from the server over the narrowband channel.
transmitting different portions of the encrypted data from the server to the client over the narrowband channel and the wideband channel.
encrypting the portion of the data to be transmitted from the server to the client over the wideband channel using the server-side wideband channel key block.
decrypting the encrypted data that has been received from the server over the wideband channel using the client-side wideband channel key block.
transmitting the encrypted data from the client to the server over the narrowband channel.
encrypting the data to be transmitted from the client to the server using the client-side narrowband channel key block.
9. A method as recited in claim 1, wherein at least a portion of the narrowband channel and the wideband channel are wireless.
10. A method as recited in claim 1, wherein the narrowband channel has a bandwidth less than one-half of the wideband channel.
11. A method as recited in claim 1, wherein the narrowband channel is a one-way channel, and the wideband channel is a two-way channel.
wherein said transmitting operates to transmits the encrypted data and the signed data from the server to the client over the narrowband channel.
13. A method as recited in claim 12, wherein the narrowband channel is a one-way channel, and the wideband channel is a two-way channel.
wherein the two-way channel is a wideband channel, and the one-way channel is a narrowband channel.
15. A method as recited in claim 14, wherein the security information includes at least a key and a random number.
16. A method as recited in claim 14, wherein the security information further includes an identification of an encryption technique.
17. A method as recited in claim 14, wherein at least a portion of the narrowband channel and the wideband channel are wireless.
18. A method as recited in claim 17, wherein the wideband channel is provided by a circuit-switched data network, and the narrowband channel is provided by a one-way short message service network.
transmitting the signed data from the server to the client over the narrowband channel.
20. A method as recited in claim 19, wherein at least a portion of the narrowband channel and the wideband channel are wireless.
21. A method as recited in claim 20, wherein the narrowband channel is a one-way channel, and the wideband channel is a two-way channel.
wherein messages are supplied from said network gateway to said wireless mobile devices over the secure connection established over the narrowband channel.
a cryptographic controller that controls encryption or signature of outgoing messages and controls the decryption or authentication of incoming messages, said cryptographic controller operates to establish a secure connection over which it receives the incoming messages by using a narrowband channel, wherein a companion wideband channel is used to exchange security information needed to establish the secure connection over the narrowband channel.
24. A mobile device as recited in claim 23, wherein said application is a browser application that permits a user to retrieve information from the computers on the network.
computer program code for transmitting the cryptographically processed data from the server to the client over the narrowband channel.
computer program code for encrypting the data to be transmitted using the narrowband channel key block.
computer program code for signing data to be transmitted from the server to the client based on the security information.
28. A computer readable medium as recited in claim 26, wherein at least a portion of the narrowband channel and the wideband channel are wireless, and wherein the narrowband channel is a one-way channel, and the wideband channel is a two-way channel.
computer program code for transmitting the cryptographically processed data from the server to the client over a wireless, narrowband channel between the client and the server that carries data from the server to the client.
30. A computer readable medium as recited in claim 29, wherein said computer program code for cryptographically processing the data to be transmitted performs at least one of encrypting and signing of the data.
31. A computer readable medium as recited in claim 29, wherein the wireless, wideband channel is a two-way channel, and the wireless, narrowband channel is a one-way channel.
32. A computer readable medium as recited in claim 31, wherein the wireless, wideband channel is provided by a circuit-switched data network, and the wireless, narrowband channel is provided by a one-way short message service network.
"HDTP Draft Specification", Version 1.1, Unwired Planet, Inc. 1997.
"Magellan SUGP Protocol" Draft Specification, Unwired Planet, Inc. 1997.
"Wireless Application Protocol Wireless Session Protocol Specification" (WAP WSP), Version 30, Apr. 1998.
"Wireless Application Protocol Wireless Transport Layer Security" (WAP WTLS), Wireless Application Forum, Apr. 30, 1998.


Mark set up the Monday eve swim group thing for Monday, again at Gladhouse. There were a few interested parties but fewer than the last couple of Tuesdays. Lifts were arranged. And this time Mary came along too. I was keen for her to enjoy the swim in what were similar conditions to the last couple of successful outings. Having not done any long swims she decided to keep it brief and just visit the nearest island. The rest of us had opted to swim round the island across the way. Yes, that one you can hardly see it is so far away!
There was no hanging about - I always take a bit of time to acclimatise (I don't swim much) so spluttered and caught my breath for the first 15 minutes, until the coldish water tipping in my neckline warmed up. About halfway across I trod water and took a couple of pics, getting the camera out of the bumbag round my waist. It is on a leash so if I drop it, I won't lose it.
Then on to the island. It took a while but by the time you could see the bottom again I had relaxed and was breathing fine and enjoying the lack of choppy water. Jim arrived and told us some facts about the water we were swimming in; where it came from and other stuff, but I was distracted by the amazing surroundings and by a couple of pandions flying overhead. Jasmin had mentioned there might be a pair in the vicinity but also to keep schtum for obvious reasons. Hence the less well used (and less google-able) name. I wasn't sure I wasn't dreaming. And cursed the lack of zoom on the w/proof camera.
Mark, Jim and I all have a dislike of water in our ears. We have all messed about with ear plugs and various ways of keeping it out on a swim. I found after a while, and various experiments, that zinc oxide sports tape holds on surprisingly well even when wet, and keeps most of the water out better than any plugs I have tried. Also it doesn't block out sound too much. An advantage. So I let Mark and Jim try the tape and both reported back that it was successful. Jim liked how it was so sticky even after an hour in the water that he nearly lost chunks of earlobe and tufts of hair taking it off.
However he had taken quite long strips at the start of the evening, which protruded from under his swim cap and while he was giving us his lecture tour about the environs, looked (only a teeny tiny bit) like John McCririck. It was only the sideburn/deerstalker thing. Really. Only that. OK I'll cycle next week.
It was a properly glorious evening to be in the middle of this amazing place.
what do you mean you don't recall the alien spacecraft landing?
Catherine turned back at the island, the rest of us went round.
The sun was just dipping below the trees.
In recent weeks I've been annoyed by drips on the lens spoiling photos - it's not always easy to see results while treading water etc. So I was trying various techniques to disperse the water, shaking the camera and the like. Below was the first and last attempt to blow the water off. Frogspawn filter more like.
Next up: wiping off the water with a wet finger. Waterspout filter.
There are less convincing ghosts on the internet than this.
I was so busy dicking around with photos in the shallows towards the back of the island that the group got away from me. When I eventually caught Jim he had made 2 new friends; good going since this has to be one of the less well inhabited spots in the world. They were proper swimmers and one was not even wearing a wet suit. OMG! I was never cold during the 50odd mins we were out there but I couldn't speak properly when we finished which would suggest I wasn't overly warm either. And here's a dude half a mile from any land only in his speedos and swim hat. They also knew about the pandions. In fact it seems like a well known secret between the swimmers, the birders, the fisherfolk, the wind farm objectors and the locals, judging by posts on the internet and friends feedback. Still, lets keep it our secret.
Me, Jim and Mark as photographed by Mary.
Yes, all the girls finished before all the boys!
I was glad to see Mary (out the water and changed) when we eventually got back.
We changed quickly as clouds of midges and flying things were circling. Jim forgot his towel so we loaned him Mary's towelling kaftan; unfortunately he didn't put it on. All that fresh air and cold water gives you a massive appetite so we only stopped once on the drive home to get a quick pic of the sunset. Another superb outdoor swim in just the best surroundings. It doesn't get any better.


Cannabis Wheaton Income Corp (OTCMKTS:CBWTF) shares appear to be marking new key technical support and a line in the sand in the course of the latest stretch of this broad sector correction in the cannabis patch. Helping to drive recent strength, the company just announced that it has entered into a strategic alliance agreement with Ontario-based research and development firm Honest Inc. (d/b/a Province Brands of Canada).
According to that recent release, the agreement stipulates that Cannabis Wheaton will "assist Province with the establishment and licensing of a cannabis facility focused on the research, development, and commercialization of cannabis-based beverages." That has helped to buoy shares in recent action and give this stock a bit of a lift above other similar plays in the sector.
Cannabis Wheaton Income Corp (OTCMKTS:CBWTF) trumpets itself as an investment company that seeks to provide investor returns through streams and capital appreciation in the Canadian cannabis industry.
The company was formerly known as Knightswood Financial Corp. and changed its name to Cannabis Wheaton Income Corp. in May 2017. Cannabis Wheaton Income Corp. was incorporated in 1987 and is based in Vancouver, Canada.
As noted above, CBWTF appears to be outperforming the cannabis patch in recent action, with the company's new strategic relationships helping to power that outperformance.
Recent action has seen 6% piled on for shareholders of the name during the trailing week. The situation may be worth watching. CBWTF has a track record that includes a number of dramatic bounces. Furthermore, the name has seen a growing influx of trading interest, with the stock's recent average trading volume running 17% above the average volume levels in play in this stock over the longer term.
Earning a current market cap value of $279.3M, CBWTF has a significant war chest ($26.1M) of cash on the books, which stands against virtually no total current liabilities. CBWTF is pulling in trailing 12-month revenues of $51K. However, the company is seeing precipitous declines on the top-line on a quarterly y/y basis, with revenues falling sharply. As more color becomes clear on the name, we will review the situation and update our take.


text:
Definition - What does Impressed Current mean?
Impressed current is a type of cathodic protection utilizing electrochemical means to obtain protection against corrosion. This reduces the dissolution of anodic structures by decreasing the difference between potential energy and the cathodic and anodic sites on the metal surface when put into a conductive electrolyte such as water, concrete or soil.
Theoretically, impressed current cathodic protection is obtained during the stage where open circuit potential of cathodic areas gets polarized into the same circuit potential of anodic sites. The key in impressed current protection is to turn the whole structure cathodic in nature, or make it a current receiver rather than a current provider.
Corrosionpedia explains Impressed Current
An impressed current protection system can offer protection to structures and metals like:
Oil casings
It can also serve as a metal reinforcement in the case of concrete buildings, structures and bars. It can be applied in galvanized steel, where sacrificial zinc coatings protect steel parts from the harmful effects of rusting.
Utilizing this type of protection offers the following practical benefits:
Reduction in infrastructure corrosion cost
Fewer incidences of infrastructure failure
Lower chances of product loss from corrosion
Lower downtime in terms of emergency repairs
Increased service life of infrastructures
Enhanced quality of infrastructure service
Increased security and health to underlying infrastructures
An impressed current system serves as an ideal protection system for bigger structures that are not capable of delivering ample current to offer protection. This system is mainly composed of anodes attached to a power source (DC), which can be a rectifier connected to power (AC). In the absence of an AC power supply, other power sources may be used like wind power, solar panels and gas power. The anodes in the impressed current protection system can be found in various sizes and shapes. The most common ones are tubes and solid rods, while there are also continuous ribbons made from various materials like:
Cathodic Protection (CP)
Impressed Current Cathodic Protection (ICCP)
Cathodic Polarization
Cathodic Shielding
Pearson Survey
Insulating Flange (FIK)
Human Error as a Factor in Corrosion Failure
Corrosion Prevention for Buried Pipelines
VIDEO: Cathodic Protection in 2 Minutes Flat
Stray Current Corrosion and Preventive Measures
The Basics of Cathodic Protection
Correcting and Preventing Concrete Corrosion
Why should cathodic protection and a coating be used together to protect against corrosion?
CorrosionPreventionCathodic Protection