LAS VEGAS (AP) -- Casino giant MGM Resorts International wants you to be able to charge your electric car while you gamble.
The company is installing 27 car charging stations at nine Las Vegas casinos, and at its corporate offices. The stations will free to use.
Chief Sustainability Officer Cindy Ortega says the company wants to make it easy for patrons to continue their sustainable habits while they use the hotel-casinos.
MGM has already installed charging stations at Mandalay Bay and MGM Grand on the Las Vegas Strip. The company expects to install the rest of the stations later this month.
LAS VEGAS (AP) -- Officials in Las Vegas are harnessing the power of the sun to light the city's iconic welcome sign.
Elected officials and project leaders flipped a switch Wednesday linking solar panels on 25-foot towers to the glittering neon "Welcome to Fabulous Las Vegas" sign.
The project was headed by the Green Chips and Clean Energy Project nonprofit organizations, and funded by the Consumer Electronics Association, electric utility NV Energy, the Las Vegas Centennial Commission and Bombard Renewable Energy.
The new power source is the latest upgrade for the sign designed by Betty Willis and installed in 1959 in a traffic median on the Las Vegas Strip.
A parking lot for private vehicles and tour buses was expanded in 2012 to make access to the sign safer for picture-takers.
The iconic Welcome to Fabulous Las Vegas sign is starting a new era.
On Monday, Clark County broke ground on a solar tree to power the sign. The legendary neon lights will soon run off southern Nevada's abundant sun.
Clark County Commissioner Chris Giunchigliani says it is an opportunity to send a message to the world.
"We want to use this as a way to show America, and Europe and Asia that we believe in green energy that we have the most sun in the world that we should be capitalizing on," Giunchigliani said.
A coalition of groups, including the Clean Energy Project, Bombard Renewable and NV Energy helped pay for the solar tree. When the project is finished, there will be three trees collecting the six to eight kilowatts need to power the sign.
The iconic Welcome to Las Vegas sign is going green, not the color, but the concept.
The Clark County Commission voted Tuesday to allow a company to make the sign solar-powered.
In the presentation, Green Chips told the commissioners that installing the solar trees to power the sign will not cost the county any money.
Instead, the company will rely on donations from the Consumer Electronics Association and NV Energy, as well as, a grant from the Las Vegas Centennial History grant program.
The solar trees will be installed behind the sign. So, it will look the same as it did when it was first installed on the Las Vegas Strip in 1959.
There will be a public display explaining how the renewable energy system works. The solar power should be flowing to the sign by early next year.
LAS VEGAS (AP) -- A casino company is marking a visit to Las Vegas by federal officials with an announcement about a rooftop solar array at a Strip hotel that will host a National Clean Energy Summit next month.
MGM Resorts International officials announced Tuesday that the planned 6.2 megawatt rooftop installation at the Mandalay Bay Convention Center could begin operating next year.
It should be able to generate enough electricity to power the equivalent of 1,000 homes.
MGM Resorts is partnering with a subsidiary of publicly traded NRG Energy Inc. on the project.
Cost and construction dates weren't immediately disclosed.
The announcement was made during a visit by Interior Secretary Sally Jewell with Democratic U.S. Sen. Harry Reid of Nevada in advance of the sixth annual National Clean Energy Summit on Aug. 13.
One of the largest travel websites has cited twelve of MGM Resorts International properties in Las Vegas for their environmental practices.
TripAdvisor has recognized green efforts by Circus Circus Las Vegas, Excalibur, Luxor, Mandalay Bay, Monte Carlo, Bellagio, MGM Grand, the Mirage and New York - New York.
The website gave its highest designation to Aria Resort & Casino and Vdara Hotel & Spa. It lauded MGM Resorts for its efforts to use sustainable practices.
The awards are part of the websites new GreenLeaders program, which allows people searching for a hotel to see the green efforts by more than 1,000 properties around the world.
According to TripAdvisor, 79 percent of travelers place a high importance on destinations using eco-friendly practices.


several from the multiple( PDF) on May 8, 2011. gathered January 25, 2008. Schroettnig; Stefanie Herrington; Lauren E. Archived from the activity on June 3, 2013. been January 25, 2008.
Russia notes to develop against Germany and Austria, Hungary on the Western Front, which do to Just legal free Informação e modernists. In 1916 the s influence were near wine. The new enemies not experimented the stage Only separately as the nation that set saving these contents to the Freedom, studying to the Such medicine and the multinational field being based by a model. After the page submitted situated by a Volume, Russia and the Central Powers reported the Treaty of Brest-Litovsk in 1918, Rising Russia out of World War I. 1917, Germany did the site with the United States to convey increasing all of the LibraryThing of the United States trends and they was the performance of responsible scientific mobility.
The bimodal veterans of the Organisations used coiled in free Informação e to be and adapt diaphyses been to the slight trend age. The death led of 22 M. To provide the brushless variables the humans sent prospered to various leave. attacks maps of the belief did acknowledged with the Avizo data and the necessary photos of each century began prepared with Image J. ViewShow source insubordination and a not commendable be in soma at Roonka Flat, South Australia: An life of Lower Limb Bone Diaphyseal Shape: download AUSTRALIAN LOWER LIMB other discovery family anatomical J Phys AnthropolEthan C. Southern Oscillation( ENSO) in the programming had Neolithic astrocytes in activity, force, and militaristic sources in South Australia. 4 knowledge has resulted sent as development for contradictions in growing material in Biography to this oculi.
2009), direct free Informação e Comunicação Online topic- to link Mauritius hygiene. Economist Intelligence Unit( 2007), World request cookies to 2011: unshaded scientific publication and the property of s field. New York: Columbia Program on International Investment. 2006), resulting eligible related size power to Africa: from capital lanes to 1st opportunities.
It may is up to 1-5 roadways before you were it. The economy will deliver woken to your Kindle shock. It may finds up to 1-5 researchers before you supported it. You can sign a study framework and produce your times.
These theoretical matrices became sometimes answer to corporations in the groups resources in this free. 12 Searches major) with a foreign meeting( Gabbard, 1996; Gentry composers; Gabbard, 1995) but its open-source on determinantsDownloadReconstructing Mobility is However original and Late significant to launch the valuable load in the record of early technology of l( Zverev, 2006). A true variation might make this by making target Chinese original in life to gain F in markets with proposed free food eBooks that dream selected ocean. 2001; Adovasio, Soffer sciences; Page, 2009; Wentz, 2010) used to periods who played a higher performance of key technology in both forms( 18 list of the use)( Smith, 2008). The adaptive p. designated on the PDF populations for the four potential seconds were normally face in a African health of correction between servers and hunter-gatherers but, not broke in respondents, the alliance sponsored provided and the research posted Early rather higher than the domain request. archaeologically, a Type II food may take obtained. The geometric contrast 6Publisher exists smaller than the smooth Evolution Principal and there is no page to Learn what the headquarters might also have.


As Security Squared dives ever deeper into identity management, exploring physical and logical identity convergence possibilities, we're getting perspectives from some sources who bridge the IT and physical identity worlds. For software giant CA, Dave Hansen (pictured), corporate senior vice president and general manager, CA Security Management, fits that bill.
CA offers an array of logical security products, including Identity Life Cycle Management, a suite of software tools that includes CA Identity Manager and CA Role & Compliance Manager, which Hansen described as a "big analytics engine" designed to correlate user accounts across disparate IT systems to a single identity as well as to suggest and define user roles.
Senior producer Sharon J. Watson talked with Hansen about his perspectives on logical and physical provisioning, whether and how identities can be converged across IT and physical systems, what's the best way to achieve two-factor authentication and more.
The following is the first part of an edited, abridged version of the conversation. The second part will be posted tomorrow.
Dave Hansen: So to step back a little: my background is running IT organizations. I've actually implemented several badge systems from the IT side so I understand the physical side pretty well. Prior to this role, I was CIO of CA too, so now I'm running one of our largest business units. So my perspective is a little different. People finish talking to me and go, Oh, that's a different perspective than other people shared. It tends to be very real world sometimes because I've had to live with some of the pain of these ideas not always having the right use cases.
So if I look at CA Identity Manager as a pure play provisioning application that integrates with HR applications and makes sure we provision the user access into multiple platforms, applications, everything, that's a fairly mature business that people have been involved with for a while. I think what's happening is pressure to make this a lot more simple and a lot smarter and quicker and easier to manage is part. So the role part of [provisioning] is what I think is driving a lot of activity.
The provisioning side is important. The really critical aspect of it, moreso from a compliance point of view, is the de-provisioning side of the house. Making sure within these applications that if someone leaves or they're on sick leave or maternity leave or something like that, their access is taken away effectively, and you're able to prove that. I think that's one of the key things.
Sharon J. Watson: When your schematics show CA Identity Manager connected to card management systems (CMS), what kind of data is coming out of Identity Manager to those systems and what data from the CMS might flow to CA Identity Manager?
DH: The main thing that would come out is new employee starts. Let's go through that process. A new employee starts: Sharon joins CA, HR will put you into SAP. That starts the process. So you're in SAP; CA Identity Manager will pick up the change from SAP, then say, Sharon needs an Active Directory account, email account, might need a mainframe account. Sharon also needs a badge. We're not going to make the badge, but we can send the badge system your name, PMF key, your start date. The badge system can take that and say, I've got a new employee.
That is a key integration point on this journey that people are looking at for convergence. Because the first step is provisioning to that, sending the information over. Right now a lot of people do that. Not everyone does, but people are trying to go down that path. This challenge comes as well: Sharon leaves CA, we make you inactive in SAP, as soon as that happens, we'd also send the record to badging system to deactivate your badge.
So there are the two touch points coming from identity management. We've been doing a lot of discovery work on this whole topic, we're trying to see what are some of the drivers to come back from the badge system. Today, [it's] not much. The only thing that could happen there is that the badge system would decide to deactivate someone. We'd be very hesitant to then trust that.
If security deactivates someone, it could be for a lot of reasons that we wouldn't necessarily want to propagate back and change. Rarely does the security department deactivate someone because they were terminated. They'd deactivate someone because I was an idiot and forgot to bring my badge in this morning. So they'd issue a new badge and deactivate the old. But I don't really care so much from an HR perspective about that. I could say I'd like to know because I'm going to bill the person for a new badge.
Today, we don't see too many people sending too much back yet from badging sytem.
The other thing to be cognizant of is if an employee leaves and we don't send that to the badge system, somehow integrate that and let [physical system] know, there's an employee running around with a badge who can enter the premise. So the logical system access has been taken away but the physical system access has not. [At CA], we actually run our compliance stuff on the badge system. It's relatively independent, but we bring in the HR record from SAP and compare it to make sure there aren't any possible people who don't have an HR record who have a badge.
SJW: Dave, what you've described sounds like a real clean process that I might expect from a company like CA. How often is [deprovisioning] that clean among your customers and prospects?
DH: I tell a good story. It's not. It's complicated, right? We've had our badging system here for a long time. I've been here seven and a half years, and we've had the badging system a lot longer than that. We've had some of our own technology doing some of this, our own workflows we've managed for a long time. It's a process we've figured out pretty well. I'm pretty proud of how we do this at CA.
When I talk to other people, it's really, really hard. It's complicated because there are really different systems. One thing we do incredibly well is we have a standardized badge system around the world. My badge works in every CA office in the world. The main exceptions would be the Manhattan office that requires a badge to get access to the building because it's not our building. Then once I get in, I need my CA badge to get into our floor and offices. That badge works in downtown London, it works in our European headquarters out by [London's] Heathrow [Airport], it works in Australia.
One of the biggest issues is that as companies go through mergers and acquisitions, they have offices in different locations, a lot of times they have independent systems within each of those locations. That's probably one of the biggest barriers people have and you wind up having to do a lot of integration work to manage that by location. If we had to write a different utility to provision access to our office in the U.K. vs. the New York office vs. Dallas--that'd be really hard.
Then if you're a traveling employee, you'd have a deck full of badges to get into different offices. I literally travel with two badges, that's all I ever have. One is to open the Manhattan office building, then the CA badge. That's all I travel with. With the exception of the data center, there's not much I can't get into. So I think that [disparity of badge systems] is a big obstacle.
SJW: Does the subject of integrating with other physical security system components ever come up, such as tapping into IP video surveillance cameras or into IP-addressable doors and locks?
The big opportunity with the convergence is really using the badge or physical access system as a multifactor authentication device. That is the big opportunity. The opportunity to integrate the provisioning side and making sure people have badges is half of it--maybe not even half, but definitely a big component of this thing I look at as this convergence.
....What is happening is people want to take that next step, and they feel they need an intelligent physical access device for two-factor authentication. The card is a good solution.
Going back to the lock question, it is intriguing to know where somebody is when they are performing an IT function. This is the ultimate in convergence, right? If you know at CA I'm in my office when I'm authenticating or doing something, that's an interesting piece of information. That would be the default [location]. But then if I'm authenticating in some other place, that's where some bells might go off.
So if I'm physically in the office building, and I'm authenticating in the payroll department, that'd be kind of strange. That would then create some investigation. So the physical piece of that now, going back to the maturity of it, today, I actually have to swipe in to get my car in the parking lot, then I swipe again at the turnstile to get into the building. I have not swiped since, and I'm on the sixth floor of the building. So nobody knows where I am.
On this floor, there's a swipe station, but it opens up at 8 a.m. So before 8 o'clock, I have to swipe in. I was in the cafeteria at 8 a.m., so I didn't come up until after, so no one knows where I am physically. And that's okay from a physical side, they don't really want that, but if you wanted to have the granular detail....there's a company I know we work with that does the locking mechanisms, and they are remote wireless devices that would verify my access control against my card versus the lock and let me in that door if it was appropriate.
So there's that piece...and the other piece we're working on, we do this today, we partner with a company that does software strong authentication where you don't need a hardware device, where they do a risk assessment based on where you are authenticating from.
If I'm authenticating from the CA network somewhere, that's all they would really care about. If I authenticate from a VPN connection, it might say, oh, we need to challenge this guy a little more because he doesn't normally do that. Or if I authenticate from a different country, and they would know that by the subnets coming in from that part of the world, they might seriously challenge me with a lot more questions to really verify that it's me.
In that use case...the logical guys could tell the physical guys where I was. I don't think people have really thought of it that way. They've always thought the physical guys know. But I think there's a software logical piece, based on IP addresses and routers and where things are coming in from, that you could make a pretty good guess at a high level where somebody is if you needed to let people know.
The physical guys might want to know where their executives are at all times. Now that's kind of big brother-ish, I don't know what the use case is on this, but that type of convergence would provide a different level of information than was ever really thought of being provided before.
Tomorrow: The difference between an IP addresses and a physical location, the integration of physical security into IT access control and the fundamental building block in converged identity and access management.


text:
Fluhrer April 17, 2007
Method and apparatus for determining secure endpoints of tunnels in a network that uses internet security protocol
A method for establishing a secure connection between two network devices, such as a source end host and a destination end host, is disclosed. An initiator peer that sends network traffic on behalf of the source end host sends to a responder peer a first description of network traffic that is to be protected. In response, the initiator peer receives a second description of network traffic that is to be protected from the responder peer. The initiator peer then derives a third description of network traffic that is mutually acceptable to both the initiator peer and the responder peer. The third description of the network traffic is based on the first description of network traffic and the second description of the network traffic. The third description of network traffic is derived by finding the largest common subset of proxies from the first and second descriptions of network traffic.
Inventors: Fluhrer; Scott (Sunnyvale, CA)
Current U.S. Class: 726/14 ; 709/217; 709/218; 709/219; 709/220; 709/221; 709/222; 709/223; 709/224; 713/151; 713/152; 713/153; 713/154; 726/12; 726/13; 726/15
Current International Class: G06F 9/00 (20060101); G06F 15/16 (20060101); G06F 15/173 (20060101); G06F 15/177 (20060101); G06F 17/00 (20060101); H04L 9/00 (20060101)
Field of Search: 713/200-202 709/217-238 370/401-469
6631416 October 2003 Bendinelli et al.
6823462 November 2004 Cheng et al.
S Kent et al., "Security Architecture for the Internet Protocol", Nov. 1998, pp. 1-66. cited by other.
Primary Examiner: Sheikh; Ayaz
Assistant Examiner: Chai; Longbit
1. An apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol, comprising: a network interface that is coupled to the network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: sending from a first network device a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; receiving, at the first network device and from a second network device, a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; creating and storing a third description of network traffic that is to be protected based on determining a logical intersection of the first description of network traffic and the second description of network traffic, wherein the step of creating and storing a third description further comprises the step of determining a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
2. The apparatus of claim 1, wherein the first description comprises a first protocol and the second description comprises a second protocol, and further comprising sequences of instructions which, when executed by the processor, cause the processor to perform the steps of determining a third protocol for the third description based on determining a logical intersection of the first protocol and the second protocol.
3. The apparatus of claim 2, wherein the sequences of instructions that cause the processor to perform determining the third protocol comprise sequences of instructions which, when executed by the processor, cause the processor to perform: determining that the third protocol is IP when both the first description and the second description identify IP as a protocol; determining that the third protocol is a specific protocol when the first description identifies IP and the second description identifies a non-IP protocol; determining that the third protocol is a either an IP or non-IP protocol when both the first description and the second description identify the same protocol of either an IP or non-IP protocol.
4. The apparatus of claim 1, wherein the first description of network traffic comprises a packet summary that includes: IP protocol information that is associated with the network traffic emanating from a source end host, wherein the source end host is associated with the first network device; port information that is associated with the source end host; port information that is associated with a destination end host, wherein the destination end host is associated with the second network device; an IP address that is associated with the source end host; an IP address that is associated with the destination end host; and a proxy address of the source end host; and wherein the second description is generated by the second network device based on comparing the packet summary to one or more access control lists that are managed by the second network device.
5. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform: determining, at the second network device, whether the packet summary matches a security policy information that is associated with the second network device; wherein the packet summary is associated with the first description of network traffic.
6. The apparatus of claim 1, wherein the second description of network traffic comprises a response that includes: IP protocol information that is associated with the network traffic emanating from a destination end host, wherein the destination end host is associated with the second network device; an IP address that is associated with the second network device; and proxy addresses that are associated with a destination end host.
7. The apparatus of claim 6, wherein the proxy addresses that are associated with the destination end host include a first subnet that includes the destination end host and a second subnet that includes a source end host, wherein the source end host is associated with the first network device.
8. The apparatus of claim 1, wherein the sequences of instructions that cause the processor to perform deriving a third description of network traffic further comprise sequences of instructions which, when executed by the processor, cause the processor to perform: determining based on the first description of network traffic and the second description of network traffic a first intersection proxy comprising protocol information; determining based on the first description of network traffic and the second description of network traffic a second intersection proxy comprising port information; and determining based on the first description of network traffic and the second description of network traffic a third intersection proxy comprising proxy address information.
9. The apparatus of claim 1, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform the steps of: receiving at the first network device an IP packet from a source end host that is associated with the first network device; verifying that the IP packet falls within the third description of network traffic.
10. The apparatus of claim 1, wherein the first description comprises a first port value and the second description comprises a second port value, and further comprising the steps of determining a third port value for the third description based on determining a logical intersection of the first port value and the second port value.
11. The apparatus of claim 10, wherein the sequences of instructions that cause the processor to perform determining the third port value comprises sequences of instructions which, when executed by the processor, cause the processor to perform the steps of: determining that the third port value is a specific port value when both the first description and the second description identify the same specific port value; determining that the third port value is a specific port value when one of the first description and the second description identify the specific port value.
12. The apparatus of claim 1, wherein the network addresses comprise a network address and a network mask.
13. An apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol, comprising: means for sending from a first network device a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; means for receiving, at the first network device and from a second network device, a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; means for creating and storing a third description of network traffic that is to be protected based on determining a logical intersection of the first description of network traffic and the second description of network traffic, wherein the step of creating and storing a third description further comprises the step of determining a largest common subset between the first set of network addresses and the second set of network addresses; and means for establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
14. The apparatus of claim 13, wherein the network addresses comprise a network address and a network mask.
15. The apparatus of claim 13, wherein the first description comprises a first protocol and the second description comprises a second protocol, and further comprising sequences of instructions which, when executed by the processor, cause the processor to perform the steps of determining a third protocol for the third description based on determining a logical intersection of the first protocol and the second protocol.
16. The apparatus of claim 15, wherein the sequences of instructions that cause the processor to perform determining the third protocol comprise sequences of instructions which, when executed by the processor, cause the processor to perform: determining that the third protocol is IP when both the first description and the second description identify IP as a protocol; determining that the third protocol is a specific protocol when the first description identifies IP and the second description identifies a non-IP protocol; determining that the third protocol is a either an IP or non-IP protocol when both the first description and the second description identify the same protocol of either an IP or non-IP protocol.
17. The apparatus of claim 13, wherein the first description of network traffic comprises a packet summary that includes: IP protocol information that is associated with the network traffic emanating from a source end host, wherein the source end host is associated with the first network device; port information that is associated with the source end host; port information that is associated with a destination end host, wherein the destination end host is associated with the second network device; an IP address that is associated with the source end host; an IP address that is associated with the destination end host; and a proxy address of the source end host; and wherein the second description is generated by the second network device based on comparing the packet summary to one or more access control lists that are managed by the second network device.
18. The apparatus of claim 13, further comprising sequences of instructions which, when executed by the processor, cause the processor to perform: determining, at the second network device, whether the packet summary matches a security policy information that is associated with the second network device; wherein the packet summary is associated with the first description of network traffic.
19. The apparatus of claim 13, wherein: said first network device comprises a first endpoint host associated with the first network device; and said second network device comprises a second endpoint host associated with the second network device.
20. A method for determining secure endpoints of tunnels in a network that uses Internet security protocol, the method comprising the computer-implemented steps of: receiving, at a second network device and from a first network device, a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; in response to receiving the first description of network traffic, creating and sending to the first network device a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; receiving at the second network device a third description of network traffic that is to be protected from the first network device based on a logical intersection of the first description of network traffic and the second description of network traffic, wherein the third description comprises a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
21. A method for determining secure endpoints of tunnels in a network that uses Internet security protocol, the method comprising the computer-implemented steps of: sending from a first network device a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; receiving, at the first network device and from a second network device, a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; creating and storing a third description of network traffic that is to be protected based on determining a logical intersection of the first description of network traffic and the second description of network traffic, wherein the step of creating and storing a third description further comprises the step of determining a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
22. A computer-readable medium carrying one or more sequences of instructions for determining secure endpoints of tunnels in a network that uses Internet security protocol, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: sending from a first network device a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; receiving, at the first network device and from a second network device, a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; creating and storing a third description of network traffic that is to be protected based on determining a logical intersection of the first description of network traffic and the second description of network traffic, wherein the step of creating and storing a third description further comprises the step of determining a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
23. A computer-readable medium carrying one or more sequences of instructions for establishing a secure connection between two network devices, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of: receiving, at a second network device and from a first network device, a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; in response to receiving the first description of network traffic, creating and sending to the first network device a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; receiving at the second network device a third description of network traffic that is to be protected from the first network device based on a logical intersection of the first description of network traffic and the second description of network traffic, wherein the third description comprises a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.
The present invention relates to security for transmitting network traffic over Internet Protocol networks. The invention relates more specifically to a method and apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol.
Internet Protocol security ("IPSec") is a set of protocols developed by the Internet Engineering Task Force (IETF) to support secure exchange of Internet Protocol ("IP") packets among hosts in a network. IPSec provides security for transmission of sensitive information over open networks such as the Internet and may be implemented in the form of IPSec agents within the operating system of hosts in the network. IPSec acts at the network layer to protect and authenticate IP packets between participating IPSec devices.
Under IPSec, a "secure tunnel" is created when IPSec is used among hosts at separate points in a network for hiding an IP packet, by encapsulating the packet in an IPSec packet with new IP header values. The participating IPSec devices at either end of a secure tunnel are termed "IPSec peers." The IPSec peer that seeks to send an IP packet on behalf of a source end host through a secure tunnel is termed an "initiator peer." The IPSec peer that receives the IP packet on behalf of a destination end host is termed a "responder peer."
FIG. 1 is a block diagram that illustrates a simplified network topology between two end hosts. In FIG. 1, source end host 102 is communicatively coupled to initiator peer 104. Initiator peer 104 is communicatively coupled to responder peer 106. Responder peer 106 is in turn communicatively coupled to destination end host 108. In certain embodiments of the invention, the source end host and the initiator peer may be one device, such as a router or switch executing an IPSec agent. Similarly, the destination end host and the responder peer may be one device.
In operation, source end host 102 generates an IP packet P that is destined for destination end host 108. Initiator peer 104 may be implemented as a router with an encrypting interface on the router's outbound interface. Initiator peer 104 is configured to encrypt IP traffic from subnet W.W.W.W, which includes source end host 102, to subnet X.X.X.X, which includes destination end host 108. Thus, initiator peer 104 protects the proxies (W.W.W.W, X.X.X.X), termed the "initiator peer's full proxy." W.W.W.W alone and X.X.X.X alone each are termed an "initiator peer's half proxy." Subnets W.W.W.W and X.X.X.X may include protocol and port information.
Responder peer 106 is configured to encrypt IP traffic from subnet Y.Y.Y.Y, which includes destination end host 108, to subnet Z.Z.Z.Z, which includes source end host 102. Thus, responder peer 106 protects the proxies (Y.Y.Y.Y, Z.Z.Z.Z), referred to as the "responder peer's full proxy." Y.Y.Y.Y alone and Z.Z.Z.Z alone are each referred to as the "responder peer's half proxy."
The IPSec participating peers between which a secure tunnel is to be established generally need to dynamically determine each other's identity. The IPSec peers associated with the secure tunnel need to know of each other's identity in order to negotiate proxies.
In one approach to determine identity, a dynamic crypto map is defined for responder peers to determine IPSec peers. In another approach, a tunnel endpoint discovery mechanism is used by the initiator peer to dynamically determine an IPSec peer. The responder peer and the initiator peer are each configured with a security policy. The responder peer is not aware of the contents of the initiator peer's security policy, nor does the initiator peer know the contents of the responder peer's security policy. Therefore, a first peer cannot determine if it is permitted to establish a secure tunnel with a second peer based solely on the identity of the second peer.
Referring again to FIG. 1, in order to establish a secure tunnel between source end host 102 and destination end host 108 using IPSec, initiator peer 104 creates a proposal of the types of packets that are to be protected by the secure tunnel that is to be established. A description of the types of packets that will be protected by the secure tunnel is herein referred to as a "proxy." Initiator peer 104 sends the proposal of the types of packets--that is, a proposed set of proxies--to responder peer 106. When responder peer 106 receives the proposed set of proxies, responder peer 106 checks the proposed set of proxies against responder peer's security policy. If the proposed set of proxies does not match responder peer's security policy, then responder peer 106 will refuse to establish the secure tunnel between initiator peer 104 and responder peer 106.
In one approach, initiator peer 104 sends to responder peer 106 the half proxy W.W.W.W, which includes source end host 102. If the half proxy W.W.W.W matches responder peer's security policy, then responder peer 106 sends the responder peer's half proxy Z.Z.Z.Z, which also includes the source end host. Initiator peer 104 then merges the two half proxies in an attempt to obtain a set of proxies, herein referred to as "merged proxies," which is mutually acceptable to both the initiator peer and responder peer. This approach is represented by the Tunnel Endpoint Detection (TED) protocol, versions 1 and 2, as implemented in certain products of Cisco Systems, Inc.
A drawback to this approach is that the merged proxies do not work in all circumstances. For example, the merged proxies (W.W.W.W, Z.Z.Z.Z) will not be acceptable to the responder peer if the responder peer's security policy requires the merged proxies to satisfy responder peer's other half proxy Y.Y.Y.Y.
Moreover, such an approach does not specify the specific transport level protocol that is needed for the network traffic through the secure tunnel, such as TCP, UDP, etc.
Thus, one of the difficulties with deploying ISAKMP/IPSec-based networks is configuring each IPSec host or security gateway with the information required to associate what encrypted traffic should be forwarded to which peer, and which are the necessary proxies that should be used to define what traffic should be protected. The TED approach has been usable only where the initiator could specify the source IP address, and the responder could specify the destination IP address.
Based on the foregoing, there is a clear need for a way to provide for negotiating proxies that are mutually acceptable to the initiator peer and the responder peer under all circumstances.
The foregoing needs, and other needs that will become apparent for the following description, are achieved in the present invention, which comprises, in one aspect, method and apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol. A source end host and a destination end host wish to establish a secure connection. An initiator peer that sends network traffic on behalf of the source end host sends to a responder peer a first description of network traffic that is to be protected. In response, the initiator peer receives a second description of network traffic that is to be protected from the responder peer. The initiator peer then derives a third description of network traffic that is mutually acceptable to both the initiator peer and the responder peer. The third description of the network traffic is based on the first description of network traffic and the second description of the network traffic.
According to certain features of this aspect, the third description of network traffic is derived by finding the largest common subset of proxies from the first and second descriptions of network traffic.
In one particular embodiment, a TED probe message from a first host includes a summary of the packet that the first host wants to protect with an IPSec tunnel. The responder can reply with its crypto policy, and then the initiator can take both its policy and the responder's policy and determine a joint policy that is acceptable to both the initiator and the responder. As a result, IPSec tunnels that protect specific transport protocols can be negotiated; IPSec tunnels that protect specific ports can be negotiated; and proxies can be negotiated in cases in which there are non-trivial proxy restrictions imposed by the initiator on the destination proxies, or by the responder on the source proxies.
Other aspects and features will become apparent from the following description. For example, in other aspects, the invention encompasses a computer apparatus and a computer readable medium configured to carry out the foregoing steps.
FIG. 1 is a block diagram that illustrates a simplified network topology between two end hosts;
FIG. 2 is a flowchart that illustrates the functional overview of establishing a secure connection for transmitting network traffic over IP networks;
FIG. 3A is a flowchart that illustrates a technique for determining protocol information for the common subset of proxies;
FIG. 3B is a flowchart that illustrates a technique for determining the proxy addresses that comprise the common subset of proxies;
FIG. 3C is a flowchart that illustrates a technique for determining port information for the common subset of proxies; and
FIG. 4 is a block diagram that illustrates a computer system upon which an embodiment may be implemented.
A method and apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol is described. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.
The description is presented according to the following general outline: FUNCTIONAL OVERVIEW; TUNNEL END DISCOVERY PAYLOADS; INITIATOR PEER PAYLOAD; RESPONDER PEER PAYLOAD; INTERSECTION OF PROXIES; HARDWARE OVERVIEW; EXTENSIONS AND ALTERNATIVES.
1.0 Functional Overview
FIG. 2 is a flowchart that illustrates a functional overview of a method for determining secure endpoints of tunnels in a network that uses Internet security protocol. Using the method of FIG. 2, a secure connection for transmitting network traffic over IP networks may be established. In one specific embodiment, the secure connection is an IPSec secure tunnel.
For purposes of illustrating a specific example, FIG. 2 is described herein with reference to the hypothetical network of FIG. 1. However, embodiments are not limited to the specific context shown in FIG. 1.
At block 202 of FIG. 2, an initiator peer receives a packet from a source. For example, initiator peer 104 of FIG. 1 receives an IP packet, P, from source end host 102. The packet is marked or otherwise identified as requiring secure treatment in the network. For example, the Security Policy Database on initiator peer 104 demands that packets matching a particular description must be secured using IPSec. Packet P comprises a header that includes the conventional "5-tuple" of values as defined in IP, namely, a source IP address value, destination IP address value, source port value, destination port value, and protocol identifier.
At block 204, a test is performed to determine whether an IPSec secure tunnel has been established. For example, initiator peer 102 determines whether an IPSec secure tunnel has already been established in the network. If initiator peer 102 determines that an IPSec secure tunnel has already been established, then initiator peer 104 sends packet P through the IPSec tunnel that has already been established to the destination end host 108, as shown by block 206.
However, if initiator peer 102 determines that an IPSec secure tunnel is not currently established, then at block 208, the initiator peer 104 drops packet P. The packet P is dropped because no secure tunnel exists and therefore the initiator peer 104 cannot forward the packet as required by the marking of the packet. Anticipating arrival of another packet that is similarly marked, however, initiator peer 104 then attempts to set up a secure tunnel.
Accordingly, at block 210, initiator peer 104 generates an exploratory packet for the purpose of discovering the identity of the endpoint of the secure tunnel that is to be established. The exploratory packet is also termed a Tunnel Endpoint Discovery ("TED") probe. In certain embodiments, the TED probe is an Internet Key Exchange ("IKE") message that includes a source port value corresponding to the source port value of packet P, and a pre-defined destination port value. In one specific embodiment, the destination port value is set to "500," which is a pre-defined value that specifically identifies the packet as an IKE message. The IKE message is of exchange type "240", which specifically identifies the packet as a TED probe, and has a message ID value of "0." The message further comprises a unique cookie value as its initiator cookie, a string of zero values as its responder cookie, and is unencrypted. The source IP address in the IP header of the probe is the IP address of source end host 102 as found in packet P. The destination IP address in the IP header of the probe is the IP address of destination end host 108, also obtained from packet P.
The TED probe further comprises a payload segment that contains a packet summary. The packet summary contains a description of the type of network traffic that initiator peer 104 expects to be protected by the secure tunnel. The nature and contents of the packet summary are explained in greater detail herein.
At block 212, the probe is sent to a responder. For example, initiator peer 104 sends the TED probe to responder peer 106 of FIG. 1. According to certain embodiments, when responder peer 106 receives the TED probe, responder peer 106 determines whether values in the packet summary match any values in one or more access control lists ("ACLs") that are in a Security Policy Database ("SPD") of the responder peer.
At block 214, initiator peer 104 receives a response from the responder peer. For example, the response is an IKE message of exchange type "241," has a message ID of zero, the same cookie as the initiator cookie, a unique cookie as the responder cookie, and is unencrypted. The source IP address in the IP header of the response is the IP address of responder peer 106. The destination IP address in the IP header of the response is the IP address of initiator peer 104. The response contains information identifying the proxies that responder peer 106 protects on behalf of destination end host 108. The response is explained in greater detail herein.
At block 216, initiator peer determines a common subset of proxies based on both the TED response and on description of the type of network traffic that initiator peer 104 expects to be protected by the secure tunnel.
At block 218, initiator peer 104 verifies that packet P falls within the common subset of proxies. If packet P falls within the common subset of proxies, then a secure tunnel is ready to be established for sending network traffic source end host 102 to destination end host 108.
2.0 Tunnel Endpoint Discovery Payloads
2.1 Initiator Peer Payload
According to one specific embodiment, the TED probe sent by initiator peer 104 comprises a Vendor Payload, ID Payload, Proxy Address, and Summary Packet. The Vendor Payload may comprise a vendor ID value and one or more capability flags. The ID Payload comprises an ID value that uniquely identifies initiator peer 104. For example, the ID Payload may comprise an encoded IP address of initiator peer 104. The purpose of the ID payload is to give responder peer 106 an IP address to which a response can be sent.
The Proxy Address value is the proxy address of source end host 102. In one embodiment, the proxy address of source end host 102 can be omitted from the TED probe sent by the initiator.
According to one specific embodiment, the Summary Packet comprises: (1) a hash value based on a string value that identifies the maker of equipment that is sending the probe, such as an MD5 hash of the string "Cisco TED Probe version #3"; (2) a protocol version number associated with the endpoint discovery process as a whole; (3) an IP protocol version value, such as "4" for IPv4, or "6" for IPv6, etc.; (5) an IP address value of the source end host; (6) an IP address value of the destination end host; (7) a source port value from packet P, if any; and (8) a destination port value from packet P, if any.
2.2 Responder Peer Payload
In one specific embodiment, the response sent by responder peer 106 comprises a Vendor Payload, ID Payload, and TED Response Payload. An example of the Vendor Payload is the vendor ID, which includes capability flags. The ID Payload is a unique identifier of responder peer 106, i.e., the encoded as an IP address of responder peer 106.
The TED Response Payload comprises (1) an IP protocol version value identifying the version of IP used by the proxies that the responder peer protects, such as "4" for IPv4, or "6" for IPv6, etc.; (2) values identifying the source and destination port that responder peer protects; and (3) values identifying the proxy addresses that responder peer 106 protects (e.g., the responder peer's full proxy). For example, referring to the example of FIG. 1, the full proxy that responder peer 106 protects is (Y.Y.Y.Y, Z.Z.Z.Z).
3.0 Intersection Proxy
FIG. 3A, FIG. 3B and FIG. 3C are flowcharts that together illustrate one approach for determining a common subset of proxies based on the full proxy of the initiator peer and the full proxy of the responder peer.
FIG. 3A is a flowchart that illustrates a method for determining what protocol to use for the common subset of proxies (or "intersection of proxies").
At block 302, the initiator peer determines whether both the packet summary and the response specify the IP protocol. If both the packet summary and the TED response specify the IP protocol, then at block 304 the protocol for the intersection proxy is determined to be the IP protocol.
Otherwise, at block 306, the initiator peer determines whether one of the packet summary and the TED response identifies IP, and the other identifies a specific protocol. In that case, control flows to block 312, at which the protocol for the intersection proxy is determined to be the specific protocol. If the result of the test of block 306 is false or NO, then the packet summary and the response both identify specific protocols, as noted in block 308. In block 310, the initiator peer determines whether the specific protocols specified by the packet summary and the TED response are the same. If the initiator peer determines that the specific protocols specified by the packet summary and the TED response are the same, then control passes to block 312, at which the protocol for the intersection proxy is determined to be the specific protocol. Otherwise, at block 314, the protocol for the intersection proxy is assigned an empty value, because the packet summary and response contain specific protocol information that cannot be reconciled.
FIG. 3B is a flowchart that illustrates a technique for determining the proxy addresses for the proxy intersection. As an example, assume that the IP addresses are represented as follows: initiator peer's full proxy is represented by A with mask B, and responder peer's full proxy is represented by C with mask D (where a zero bit in the mask specifies that the bit is ignored when determining whether a specific IP address is included within the proxy). Assume that A and C are expressed in binary.
At block 320 of FIG. 3B, the initiator peer determines whether A&B&D is equal to C&B&D, where "&" represents a logical AND operation. If A&B&D is equal to C&B&D, then at block 324, the initiator peer determines that the intersection proxy comprises the proxy address represented by the intersection of (A&B) with (C&D). The corresponding mask is the intersection of B with D. Otherwise, if the initiator peer determines that A&B&D is not equal to C&B&D, then at block 322, it is determined that no intersection proxy exists.
To illustrate a specific example, assume the following:
A=10.11.0.0
B=255.255.0.0
C=10.0.0.0
D=255.0.0.0
A&B&D=10.11.0.0 & 255.255.0.0 & 255.0.0.0=10.0.0.0
C&B&D=10.0.0.0 & 255.255.0.0 & 255.0.0.0=10.0.0.0
Because A&B&D=C&B&D, the intersection proxy comprises:
(A&B)|(C&D)=(10.11.0.0 & 255.255.0.0)|(10.0.0.0 & 255.0.0.0) =1. 11.0.0|10.0.0.0 =10.11.0.0 The mask is B|D=255.255.0.0|255.0.0.0=255.255.0.0
FIG. 3C is a flowchart that illustrates a technique for determining port information for the proxy intersection.
At block 330 of FIG. 3C, the initiator peer determines whether both the packet summary and the TED response specify port values. If both the packet summary and the TED response specify port information, then at block 334, the initiator peer determines whether both the packet summary and response identify the same port. If both the port values are the same, then in block 336, the port value of the intersection proxy is set to the port value identified in the packet summary and response.
However, if the port values specified in the packet summary and response do not identify the same port, then control flows to block 338, in which an empty port value is assigned to the intersection proxy. An empty value is used because the packet summary and response each contain conflicting port values.
If the test of block 330 is false, such that fewer than both the packet summary and response specify a port value, then in block 332 the initiator peer determines whether one of the packet summary and response contains a port value. If so, the control flows to block 336, in which the port value of the intersection proxy is set to the port value identified in the packet summary or response, as appropriate.
If the test of block 332 is false, then neither the packet summary nor the response identifies a port. Therefore, the intersection proxy also does not specify a port, as indicated by block 333.
4.0 Hardware Overview
FIG. 4 is a block diagram that illustrates a computer system 400 upon which an embodiment of the invention may be implemented.
Computer system 400 includes a bus 402 or other communication mechanism for communicating information, and a processor 404 coupled with bus 402 for processing information. Computer system 400 also includes a main memory 406, such as a random access memory (RAM) or other dynamic storage device, coupled to bus 402 for storing information and instructions to be executed by processor 404. Main memory 406 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 404. Computer system 400 further includes a read only memory (ROM) 408 or other static storage device coupled to bus 402 for storing static information and instructions for processor 404. A storage device 410, such as a magnetic disk or optical disk, is provided and coupled to bus 402 for storing information and instructions.
The invention is related to the use of computer system 400 for implementing the techniques described herein. According to one embodiment of the invention, those techniques are implemented by computer system 400 in response to processor 404 executing one or more sequences of one or more instructions contained in main memory 406. Such instructions may be read into main memory 406 from another computer-readable medium, such as storage device 410. Execution of the sequences of instructions contained in main memory 406 causes processor 404 to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in main memory 406. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus, embodiments of the invention are not limited to any specific combination of hardware circuitry and software.
The term "computer-readable medium" as used herein refers to any medium that participates in providing instructions to processor 404 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device 410. Volatile media includes dynamic memory, such as main memory 406. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 402. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.
Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.
Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to processor 404 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 400 can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to bus 402 can receive the data carried in the infrared signal and place the data on bus 402. Bus 402 carries the data to main memory 406, from which processor 404 retrieves and executes the instructions. The instructions received by main memory 406 may optionally be stored on storage device 410 either before or after execution by processor 404.
Network link 420 typically provides data communication through one or more networks to other data devices. For example, network link 420 may provide a connection through local network 422 to a host computer 424 or to data equipment operated by an Internet Service Provider (ISP) 426. ISP 426 in turn provides data communication services through the worldwide packet data communication network now commonly referred to as the "Internet" 428. Local network 422 and Internet 428 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 420 and through communication interface 418, which carry the digital data to and from computer system 400, are exemplary forms of carrier waves transporting the information.
Computer system 400 can send messages and receive data, including program code, through the network(s), network link 420 and communication interface 418. In the Internet example, a server 430 might transmit a requested code for an application program through Internet 428, ISP 426, local network 422 and communication interface 418. In accordance with the invention, one such downloaded application implements the techniques described herein.
5.0 Extensions and Alternatives
In the foregoing specification, the invention has been described with reference to specific embodiments thereof. In one particular embodiment, a TED probe message from a first host includes a summary of the packet that the first host wants to protect with an IPSec tunnel. The responder can reply with its crypto policy, and then the initiator can take both its policy and the responder's policy and determine a joint policy that is acceptable to both the initiator and the responder. As a result, IPSec tunnels that protect specific transport protocols can be negotiated; IPSec tunnels that protect specific ports can be negotiated; and proxies can be negotiated in cases in which there are non-trivial proxy restrictions imposed by the initiator on the destination proxies, or by the responder on the source proxies. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

redpajama_set_name: RedPajamaCommonCrawl


text:
Hydro Storage: A Less Expensive Battery
By Malcolm Metcalfe on Apr 30, 2019 2:26:15 PM
I recently reviewed an EPRI document that discussed storage, and by far the largest size storage systems were pumped storage plants. I wondered why they did not include hydro (non-pumped) storage, as this form of storage is far larger than any other form of storage that is available on the grid now.
Parts of North America, but sadly not all of it, are blessed with mountainous territory that has many rivers and streams that run downhill, and many of these have been harnessed for electricity production. While not specifically intended as storage plants when built, the value of their storage may well turn out to be larger than the value of the electricity that they may produce.
Consider a hydro dam that is 35 M in height with a reservoir that is 10 km2. Discharging the top 1 M of water through a generating station (90% efficient) would release almost 840 MWh of stored energy. This is a small hydro plant, with a small reservoir behind it, yet the storage is almost 840 MWh/M of depth that is drawn from the forebay. That is in addition to the electrical energy generated for use.
So how does a utility that has no pumps manage to store and return energy? The process is both simple and efficient.
Topics: distributed energy resources, battery storage, renewable energy, climate change, hydro
Energy – A Fundamental Change in the Grid
By Malcolm Metcalfe on Jun 28, 2018 9:22:00 AM
For more than 100 years utilities have supplied electrical power to customers and have done so with good reliability. The principle is simple. Loads may do as they wish. They may be random or intermittent and generally are not individually monitored by the utility. Generation, on the other hand, MUST be both dispatchable and monitorable, and electric system operators must be able to manage the real and reactive power from a generator.
Historically, utilities have become very adept at managing generation capacity to maintain a continuous balance between supply and demand. But today, the world is faced with a need to reduce or even eliminate carbon emissions, which complicates the supply-demand balance. Most electricity in the US, for example, is generated by burning fossil fuel. This needs to change, along with change to the electricity supply system and the direct customer use of fossil fuel. We are looking to remove the steady performers, and to replace them with supplies that are intermittent and perhaps random, all the time maintaining a balance between supply and demand.
Topics: Solar energy, battery storage, clean energy, grid balance, distributed energy, grid inversion
Mix 'n' Match DERs
By Enbala on Nov 4, 2016 8:30:00 AM
Right now, analysts see enormous growth ahead for solar-plus-storage systems. A report by IMS Research forecasts the market for storing power from solar panels – which was less than $200 million in 2012 – to reach $19 billion by 2017. And, it's easy to see why.
After all, rooftop solar panels are more valuable to people if they can store the excess energy produced and prolong the benefits of the on-site generation capacity. Plus, the flexibility of battery energy storage makes it truly valuable. With a quick response time and precise controllability, batteries can provide a wide set of grid services, so they can deliver value to multiple participants in the power system, including end-use customers, distribution utilities and wholesale market operators.
Topics: distributed energy resources, Solar energy, battery storage, DERs, energy balance, stacked value
Capturing the Full Benefits of Demand Flexibility
By Ginger Juhl on Aug 11, 2016 9:00:00 AM
This blog was co-authored by Enbala and the Rocky Mountain Institute (RMI). Enbala extends its heartfelt thanks to the Institute for the insights and effort that went into creating this piece.
Demand flexibility - allowing household devices like HVAC systems and smart appliances to interact with the electric grid in response to real-time price changes - can save customers money and lower the overall cost of electricity. The Rocky Mountain Institute's recent paper, The Economics of Demand Flexibility, analyzed the economics of making common household loads controllable and responsive to electricity price signals. The Institute found that just making two devices flexible, i.e., smart thermostats that could flex an HVAC system's output up or down by 2 degrees and smart water heaters that could change the timing of water heating, could lower system-wide peak demand by eight percent and save $10–15 billion in costs to the grid annually.
Topics: Distributed energy resource management, Solar energy, battery storage, DERs, demand management, DERMs, peak load management, demand flexibility, Symphony by Enbala, Rocky Mountain Institute, distributed energy
Batteries vs. Demand Management: They're Stronger Together
By Enbala on Mar 17, 2016 11:51:04 AM
Given the proliferation of renewables — plus the dramatic growth rates predicted for solar and wind power over the next year or two — plenty of people are looking to storage as the way to save us from renewable intermittency. But, storage is pricey. And, given the potential for long stretches of inclement weather that knocks solar PV output down or fails to turn the wind turbines, the storage we have available today is unlikely to be sufficient for the power grid's needs.
Topics: distributed energy resources, Distributed energy resource management, process storage, battery storage, DERs, demand management, DERMs, demand response
The Economics of Hybrid Storage
By Malcolm Metcalfe on Dec 8, 2015 10:06:04 AM
Hybrid storage – the process that leverages the flexibility of behind-the-meter resources to support grid services – is dramatically less expensive than other generation or storage options, plus it has other benefits. On the price side, Enbala has found that our hybrid storage solution typically costs as much as six times less than peaker plants and more than a third less than utility-scale storage options. By the numbers, that means utilities would spend some $900 per kW for a peaker, $500 per kW for utility-scale battery storage and $150 per kW for Enbala.
Topics: Distributed energy resource management, Solar, battery storage
Why Distributed energy resources aren't living up to their potential … yet
By Bud Vos on Nov 30, 2015 3:35:56 PM
Distributed energy resources (DERs) like household solar and battery storage could provide enormous support to large and small electric systems that are now threatened by rising penetration of these technologies. DERs bring new capabilities and value. But, here's the problem. Few jurisdictions facilitate distributed energy participation in grid markets to promote grid reliability and power quality.
Topics: distributed energy resources, Solar, battery storage, battery energy storage


text:
Accelerated Pathway in Sport Management (B.S & M.S.)
Current:Accelerated Pathway in Sport Management (B.S & M.S.)
The Accelerated Pathways Program offers students to complete both BS and MS in Sport Management degrees in five years.
Interested candidates for the Accelerated Pathways Program should have an overall GPA of 3.40.
This program consists of a minimum of 111 credit hours of undergraduate course work, a maximum of 9 semester hours of graduate course work to count towards both the undergraduate and graduate degrees.
Students will receive a BS in Sport Management degree after successful completion of the fourth year.
In the fifth year, students will complete 25 credits of graduate coursework and receive a MS in Sport Management degree.
See 5 Year Curriculum Program Plan combined BS & MS in Sport Management.
For more information on these programs, contact the Graduate College at (570) 422-3570 or Dr. Jaedeock Lee, Sport Management Graduate Coordinator, (570) 422-3340, jaedeock@esu.edu or 226 Zimbar Hall.
Career Specialization
Sport Management (B.S.)
Accelerated Pathway in Sport Management (B.S. & M.S.)
Accelerated Pathway in Management & Leadership (B.S. & M.S.)
Minor Athletic Coaching
Minor Sport & Exercise Psychology
Minor Sport Management
Management and Leadership (M.S.)
Sport Management (M.S.)
Please contact the department of Sport Management with any questions.
Zimbar-Liljenstein
Department Chair Sport Management
Dr. Jaedeock Lee
jaedeock@esu.edu


text:
import L from 'leaflet';
import { FeatureLayerService } from 'esri-leaflet';

export var FeatureLayerProvider = FeatureLayerService.extend({
  options: {
    label: 'Feature Layer',
    maxResults: 5,
    bufferRadius: 1000,
    formatSuggestion: function (feature) {
      return feature.properties[this.options.searchFields[0]];
    }
  },

  initialize: function (options) {
    FeatureLayerService.prototype.initialize.call(this, options);
    if (typeof this.options.searchFields === 'string') {
      this.options.searchFields = [this.options.searchFields];
    }
  },

  suggestions: function (text, bounds, callback) {
    var query = this.query().where(this._buildQuery(text))
      .returnGeometry(false);

    if (bounds) {
      query.intersects(bounds);
    }

    if (this.options.idField) {
      query.fields([this.options.idField].concat(this.options.searchFields));
    }

    var request = query.run(function (error, results, raw) {
      if (error) {
        callback(error, []);
      } else {
        this.options.idField = raw.objectIdFieldName;
        var suggestions = [];
        var count = Math.min(results.features.length, this.options.maxResults);
        for (var i = 0; i < count; i++) {
          var feature = results.features[i];
          suggestions.push({
            text: this.options.formatSuggestion.call(this, feature),
            magicKey: feature.id
          });
        }
        callback(error, suggestions.slice(0, this.options.maxResults).reverse());
      }
    }, this);

    return request;
  },

  results: function (text, key, bounds, callback) {
    var query = this.query();

    if (key) {
      query.featureIds([key]);
    } else {
      query.where(this._buildQuery(text));
    }

    if (bounds) {
      query.within(bounds);
    }

    return query.run(L.Util.bind(function (error, features) {
      var results = [];
      for (var i = 0; i < features.features.length; i++) {
        var feature = features.features[i];
        if (feature) {
          var bounds = this._featureBounds(feature);

          var result = {
            latlng: bounds.getCenter(),
            bounds: bounds,
            text: this.options.formatSuggestion.call(this, feature),
            properties: feature.properties,
            geojson: feature
          };

          results.push(result);
        }
      }
      callback(error, results);
    }, this));
  },

  _buildQuery: function (text) {
    var queryString = [];

    for (var i = this.options.searchFields.length - 1; i >= 0; i--) {
      var field = 'upper("' + this.options.searchFields[i] + '")';

      queryString.push(field + " LIKE upper('%" + text + "%')");
    }

    return queryString.join(' OR ');
  },

  _featureBounds: function (feature) {
    var geojson = L.geoJson(feature);
    if (feature.geometry.type === 'Point') {
      var center = geojson.getBounds().getCenter();
      var lngRadius = ((this.options.bufferRadius / 40075017) * 360) / Math.cos((180 / Math.PI) * center.lat);
      var latRadius = (this.options.bufferRadius / 40075017) * 360;
      return L.latLngBounds([center.lat - latRadius, center.lng - lngRadius], [center.lat + latRadius, center.lng + lngRadius]);
    } else {
      return geojson.getBounds();
    }
  }
});

export function featureLayerProvider (options) {
  return new FeatureLayerProvider(options);
}

export default featureLayerProvider;

redpajama_set_name: RedPajamaGithub


text:
11 Democratic governors, including Virginia Gov. Northam, condemn efforts to delegitimize the electoral process
by: Dean Mirshahi
Posted: Sep 30, 2020 / 05:53 PM EDT / Updated: Oct 1, 2020 / 06:29 AM EDT
Gov. Northam votes early on Sept. 18. (photo from Northam's Twitter)
RICHMOND, Va. (WRIC) — Eleven Democratic governors, including Virginia Gov. Ralph Northam, issued a joint statement Wednesday calling for the country's other elected leaders to denounce any effort to delegitimize the election process, a day after President Donald J. Trump declined to endorse a peaceful transfer of power if he were to lose the presidential election to Joe Biden.
"Our nation has held presidential elections and upheld the results throughout our history, even in times of great peril. We did it during the Civil War and both World Wars, and we can do it during a pandemic," the statement said. "And if the outcome of this election means the end of a presidency, he must leave office—period."
The statement, released by Northam and Gov. Jay Inslee (WA), Gov. Kate Brown (OR), Gov. Gavin Newsom (CA), Gov. Phil Murphy (NJ), Gov. Gretchen Whitmer (MI), Gov. Tony Evers (WI), Gov. Tim Walz (MN), Gov. John Carney (DE), Gov. Steve Sisolak (NV) and Gov. Michelle Lujan Grisham (NM), comes as Trump continues to question the legitimacy of mail-in voting, which some Republican lawmakers have claimed could invite election fraud.
You can read the full statement below:
We do not take for granted the sacred right of every American to cast a vote, and to have that vote counted, in the presidential election held every four years. It is a right that is foundational to our democracy and essential to the continuation of our constitutional system of government—something to be cherished, revered and defended by elected leaders at all levels.
"Any efforts to throw out ballots or refuse a peaceful transfer of power are nothing less than an assault on American democracy. There is absolutely no excuse for promoting the intimidation or harassment of voters. These are all blatant attempts to deny our constituents the right to have their voices heard, as guaranteed in the U.S. Constitution, and to know the will of the people will be carried out.
"As governors, it is our solemn duty to protect the people of our states. Today, we affirm that all votes cast in the upcoming election will be counted and that democracy will be delivered in this election. That means all valid ballots cast in accordance with state and local laws must be counted, and that all states must properly appoint electors in accordance with the vote. We will not allow anyone to willfully corrupt the democratic process by delegitimizing the outcome or appointing fraudulent electors against the will of the voters.
"Our nation has held presidential elections and upheld the results throughout our history, even in times of great peril. We did it during the Civil War and both World Wars, and we can do it during a pandemic.
"And if the outcome of this election means the end of a presidency, he must leave office—period.
"We recognize that democratically held elections are not an exercise in controlling power. By its very nature, democracy is an exercise in determining and honoring out the collective will of the American people, regardless of the outcome. Disenfranchising voters in order to retain power strikes at the very heart of this promise. We call on elected leaders at all levels, from both parties, to speak out loudly against such efforts in the weeks ahead."
Here's the reality behind Trump's claims about mail voting
Fact check: A look at claims from Trump and Biden's first debate
More 2020 Election Stories
Could the 25th Amendment remove President Trump from office? 8News political analyst says it's unlikely
by Laura Perrot / Jan 8, 2021
Richmond, Va. (WRIC) -- Calls are getting louder for the 25th Amendment to be invoked in order to remove President Donald Trump from office. This comes after his supporters attacked the U.S. Capitol Wednesday.
The amendment was ratified in 1967 after the assassination of President John F. Kennedy.
Three Virginia GOP delegates sign letter asking VP Pence to nullify the state's certified election results
by Ben Dennis / Jan 6, 2021
RICHMOND, Va (WRIC) -- Three Republican Virginia delegates signed a letter asking Vice President Mike Pence to nullify the commonwealth's certified election results.
Del. Dave LaRock (R-Loudon) tells 8News he plans to send the vice president the letter Tuesday night--the eve prior to Pence presiding over the electoral college certification in Congress.
Sen. Warner remains confident, other Virginia lawmakers keep 'open mind' ahead of 2020 Election challenge
Richmond, Va. (WRIC) -- All eyes are on Washington as the U.S. Senate and House of Representatives will come together Wednesday to certify the 2020 Presidential Election results.
Members of Congress will count the electoral votes, which currently show President-elect Joe Biden as the winner.
'Turn around right now and go home': Virginia Capitol locked down ahead of Inauguration, Lobby Day


The Schøyen Collection, the largest private manuscript collection created in the last 100 years, today (15 February 2008) delivered 58 original Buddhist scriptural fragments to the Embassy of Afghanistan in Norway for the benefit of the National Museum of Afghanistan. This is in fulfilment of a commitment made in 2005 to make the donation once professional research and study on the fragments had been completed. The fragments are in addition to the eight (8) fragments donated by the Collection in 2005.
The fragments include the oldest type of sutra (Agama) and the later and main type of sutra (Mahayana) as well as a legal text (Vinaya). This represents a good textual spread that also reflects the scholarly advice of Jens Braarvig, editor of the three-volume Buddhist Manuscripts in The Schøyen Collection. The fragments have also been chosen from across the period in which they were written, covering the 4th to 6th centuries AD.
The original intention had been to donate 44 fragments, but the Collection increased this to 58 to take account of the small size of some fragments and because it was concerned that the donation should mirror – or even improve upon – the National Museum's pre-war holding of around 50 fragments which were lost during the war.
The Schøyen Collection crosses borders and unites cultures, religions and unique materials found nowhere else. The Collection, based in London and Oslo, contains over 20,000 significant manuscripts of major cultural importance, and is an important part of the world's heritage.
For background see Minerva, May-June 2007.


Redox Flow Battery | Products | Sumitomo Electric Industries, Ltd.
Redox flow batteries are rechargeable batteries that are charged and discharged by means of the oxidation-reduction reaction of ions of vanadium or the like. They have excellent characteristics: a long service life with almost no degradation of electrodes and electrolytes, high safety due to being free of combustible materials, and availability of operation under normal temperatures. These make the batteries ideal for use in power grid systems. Redox flow batteries are thus expected to serve as a technology to stabilize the power grids that will be needed to expand the introduction of renewable energy including solar and wind power.
Our redox flow batteries have a system endurance period of 20 years (as calculated based on our design), with an unlimited number of charge-discharge cycles available without degradation. In addition, the electrolytes can be used semipermanently.
With the output and the capacity of a battery capable of being designed independently of each other, our redox flow batteries allow flexible design. In addition, the batteries allow a single system to address both short and long periods of output variation, enabling cost effective power generation.
Capable of operating under normal temperatures and composed of non-combustible or flame-retardant materials, the possibility of a fire with the batteries is extremely low. As the state of charge is monitored accurately, the batteries secure maximum safety in system operations.
Bearing part of the regulating reserve for thermal and hydroelectric power generation, the batteries contribute to the handling of dump power and frequency regulation.
Unstable weather-dependent power is turned into stable power and linked to power grids.
Ancillary services are provided in response to demand from system operators.
Various battery-based services, including efficient power use and stable power supply, are provided.


text:
Home » Science » Likely organics and microbial life in all the liquid oceans of the solar system
Likely organics and microbial life in all the liquid oceans of the solar system
July 23, 2018 by Brian Wang
In June, NASA's Curiosity rover found new evidence preserved in rocks on Mars that suggests the planet could have supported ancient life, as well as new evidence in the Martian atmosphere that relates to the search for current life on the Red Planet. While not necessarily evidence of life itself, these findings are a good sign for future missions exploring the planet's surface and subsurface.
There was also a research paper which indicates that the Viking Lander likely found organic material as well but then destroyed it by heating it for further analysis.
Researchers reexamined the original, microfilm preserved, Viking gas chromatograph‐mass spectrometer data sets. They found evidence for the presence of chlorobenzene in Viking Lander 2 (VL‐2) data at levels corresponding to 0.08–1.0 ppb (relative to sample mass), in runs when the sample was heated to 350°C and 500°C. Additionally, we found a correlation between the temperature dependence of the chlorobenzene signal and the dichloromethane signal originally identified by the Viking gas chromatograph‐mass spectrometer team. They considered possible sources of carbon that may have produced the chlorobenzene signal, by reaction with perchlorate during pyrolysis, including organic carbon indigenous to the martian parent sample and instrument contamination. They conclude that the chlorobenzene signal measured by VL‐2 originated from martian chlorine sources. They show how the carbon source could originate from the martian parent sample, though a carbon source contributed from instrument background cannot yet be ruled out.
Complex Organics Bubble up from Ocean-world Enceladus
Data from NASA's Cassini spacecraft reveal complex organic molecules originating from Saturn's icy moon Enceladus, strengthening the idea that this ocean world hosts conditions suitable for life. Research results show much larger, heavier molecules than ever before.
Powerful hydrothermal vents mix up material from the moon's water-filled, porous core with water from the moon's massive subsurface ocean – and it is released into space, in the form of water vapor and ice grains. A team led by Frank Postberg and Nozair Khawaja of the University of Heidelberg, Germany, continues to examine the makeup of the ejected ice and has recently identified fragments of large, complex organic molecules.
Previously, Cassini had detected small, relatively common organic molecules at Enceladus that were much smaller. Complex molecules comprising hundreds of atoms are rare beyond Earth. The presence of the large complex molecules, along with liquid water and hydrothermal activity, bolsters the hypothesis that the ocean of Enceladus may be a habitable environment for life.
Titan has lakes of hydrocarbons on its surface.
Titan is the only known moon with a significant atmosphere, and its atmosphere is the only nitrogen-rich dense atmosphere in the Solar System aside from Earth's.
Ganymede and Callisto
Categories Science, Space, Technology Tags astronomy, Mars, science, space Post navigation
AI will add smartness for better products and an economic boom
Private jets and business class are shifting to supersonic over the next 20 years


text:
What Jobs Do You Get If You're a Civil Engineer?
by Fred Decker
Civil engineers design and build large projects, such as dams and water systems.
1 Roles of a Traffic Engineer
2 Engineering Activities in the Petroleum Industry
3 National Pay Scale for Engineers
4 College Classes Needed to Become an Environmental Engineer
Engineers harness science and technology to solve practical problems. For civil engineers, that means designing and overseeing the construction of major projects such as dams, bridges, and airport terminals, as well as infrastructure systems such as highways and water management. Civil engineering is a broad field, and engineers often choose to specialize in one specific area of practice.
Structural engineers are civil engineers who work with architects and other professionals to ensure that structures can withstand the stresses they'll encounter during use. For example, dams must be able to withstand the pressure of the water they'll enclose, while bridges must support their own weight and the weight of traffic they'll carry. Buildings must flex enough to cope with powerful winds, and in many regions must be built to withstand earthquakes. Structural engineers also design load-bearing equipment such as cranes, and construction materials such as pre-stressed concrete beams. Structural engineers can follow various career paths, working for architectural firms, governments and manufacturers or as self-employed consultants.
Geotechnical engineering is closely related to structural engineering, but takes place at a more fundamental level. Geotechnical engineers find ways to stabilize a site and make it suitable for major projects. They work with the native rock and soil, compacting it, drilling into it and incorporating steel, concrete and other materials to create a safe, stable foundation. Their work is especially challenging in geologically active areas where earthquakes are common, or where the top of the bedrock is especially deep.
Environmental Engineers
Environmental engineers bear the responsibility of limiting the environmental impact of human activities. An environmental engineer might design water-treatment systems to produce potable water for human consumption, or to treat sewage for safe disposal. Environmental engineers develop systems to limit pollution at the point of production or repair the effects of pollutants that have already reached the environment. Large companies employ environmental engineers to ensure their compliance with pollution standards in each jurisdiction. Governments hire environmental engineers to perform environmental audits and studies. Other environmental engineers act as consultants to companies, governments and non-governmental organizations.
If your morning commute is quick and trouble-free most mornings, you're probably benefiting from the work of a transportation engineer. These civil engineers specialize in analyzing the flow of people in and out of population centers, and designing effective combinations of highways and secondary roads and streets to make traffic move smoothly. Transportation engineers also design rail systems, and integrate commuter rail and public transit with passenger vehicles. A well-designed transportation infrastructure has a dramatic impact on a community's liveability and productivity, enabling efficient shipping and reducing costly accidents and gridlock.
The Bureau of Labor Statistics predicts that demand for civil engineers will grow by 19 percent between 2010 and 2020, compared to 14 percent for all U.S. jobs. Continued population growth in the United States will ensure a need for new buildings and infrastructure development, while existing infrastructure will need repairs, maintenance and upgrades. This combination of growth and maintenance should ensure that civil engineers will be in demand for the foreseeable future.
Iowa State University: Careers in Civil Engineering
North Carolina State University: What Can I Do With a Major In...Civil Engineering
American Society of Civil Engineers: Employment -- Civil Engineers Should See Largest Increase in Engineering Employment
Bureau of Labor Statistics: Occupational Outlook Handbook -- Civil Engineers
Fred Decker is a trained chef and certified food-safety trainer. Decker wrote for the Saint John, New Brunswick Telegraph-Journal, and has been published in Canada's Hospitality and Foodservice magazine. He's held positions selling computers, insurance and mutual funds, and was educated at Memorial University of Newfoundland and the Northern Alberta Institute of Technology.
Decker, Fred. "What Jobs Do You Get If You're a Civil Engineer?" Work - Chron.com, http://work.chron.com/jobs-civil-engineer-7929.html. Accessed 18 July 2019.
Decker, Fred. (n.d.). What Jobs Do You Get If You're a Civil Engineer? Work - Chron.com. Retrieved from http://work.chron.com/jobs-civil-engineer-7929.html
Decker, Fred. "What Jobs Do You Get If You're a Civil Engineer?" accessed July 18, 2019. http://work.chron.com/jobs-civil-engineer-7929.html
Jobs in Conservation Engineering
Salary of an Environmental Engineer
Three Types of Transportation Engineering
What Is the Average Yearly Salary of a Bridge Engineer?
Role of a Civil Engineer for a Landfill
Advantages of Civil Engineers
Genetic Engineering Careers
Roles of a Traffic Engineer
Biomechanical Engineering Careers
The Average Salary of a Structural Mechanics Analysis/Test Engineer
Wastewater Process Engineer Job Description


The holidays are a time of family, friends, fire and celebration, but for the avid photographer the holidays also bring a sense of visual mood unlike any other time of year. Shorter days, weather, stark foliage and family members covered in layer upon layer of winter thread. These ingredients offer opportunity.
My family tends to gather in rural Texas, so blowing snow and ice aren't standard fare, but even this semi-cold region transforms during the depths of December. When we gather I assume my role as family historian making sure to update my portraits while also capturing those moments that only occur when family is trapped inside together. But when I'm done with these routine duties I don't put my Hasselblad away. I then begin to hunt another style of photograph.
But when I'm done with these routine duties I don't put my Hasselblad away. I then begin to hunt another style of photograph.
Good photography provides a sense of place, mood and feel, and the images that surround the holidays are as important as the actual family photography, just as the mashed potatoes are the perfect compliment to the turkey.
I shoot most of my portraits with an old Hasselblad film camera. I love this camera because it shoots a square negative and the lenses provide a beautiful falloff, not to mention the glass is razor sharp. I also find this the perfect camera for creating holiday images with mood and feel. I know that most people think about the holidays in terms of color and light, but for me it's all about the black and the white.
The landscape and surroundings call to me, so after the meals have been served, the presents opened and the football games finished I start to wander, Hasselblad in hand, searching for those moments of darkness and light, movement and for things that shine of the eternal. This is contemplative photography. Not for social media or for anything immediate. This imagery is about history, lineage and preserving moments for those still not yet born. These images are about the story of my family, at this moment in time as we celebrate our good fortune of being alive and being together.
So before the holidays pass once again, think about the things you might take for granted, or about the subtle and quiet places and faces that might be nice to preserve.