text:
Security in a Web Services World: A Proposed Architecture and Roadmap
April 7, 2002
Version 1.0
Copyright Notice
© 2001-2002 International Business Machines Corporation, . All rights reserved.
This is a preliminary document and may be changed substantially over time. The information contained in this document represents the current view of International Business Machine and Microsoft Corporation on the issues discussed as of the date of publication. Because IBM and Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of IBM and Microsoft, and IBM and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
The presentation, distribution or other dissemination of the information contained in this document is not a license, either expressly or impliedly, to any intellectual property owned or controlled by IBM or Microsoft and\or any other third party. IBM, Microsoft and\or any other third party may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. The furnishing of this document does not give you any license to IBM's or Microsoft's or any other third party's patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, places, or events is intended or should be inferred.
This document and the information contained herein is provided on an "AS IS" basis and to the maximum extent permitted by applicable law, IBM and Microsoft provides the document AS IS AND WITH ALL FAULTS, and hereby disclaims all other warranties and conditions, either express, implied or statutory, including, but not limited to, any (if any) implied warranties, duties or conditions of merchantability, of fitness for a particular purpose, of accuracy or completeness of responses, of results, of workmanlike effort, of lack of viruses, and of lack of negligence, all with regard to the document. ALSO, THERE IS NO WARRANTY OR CONDITION OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, CORRESPONDENCE TO DESCRIPTION OR NON-INFRINGEMENT OF ANY INTELLECTUAL PROPERTY RIGHTS WITH REGARD TO THE DOCUMENT.
This document describes a proposed strategy for addressing security within a Web service environment. It defines a comprehensive Web service security model that supports, integrates and unifies several popular security models, mechanisms, and technologies (including both symmetric and public key technologies) in a way that enables a variety of systems to securely interoperate in a platform- and language-neutral manner. It also describes a set of specifications and scenarios that show how these specifications might be used together.
Executive Summary
The IT industry has been talking about Web services for almost two years. The benefits of having a loosely-coupled, language-neutral, platform-independent way of linking applications within organizations, across enterprises, and across the Internet are becoming more evident as Web services are used in pilot programs and in wide-scale production. Moving forward, our customers, industry analysts, and the press identify a key area that needs to be addressed as Web services become more mainstream: security. This document proposes a technical strategy and roadmap whereby the industry can produce and implement a standards-based architecture that is comprehensive yet flexible enough to meet the Web services security needs of real businesses.
A key benefit of the emerging Web services architecture is the ability to deliver integrated, interoperable solutions. Ensuring the integrity, confidentiality and security of Web services through the application of a comprehensive security model is critical, both for organizations and their customers.
Responding to concerns expressed both from our customers and the industry, IBM and Microsoft have collaborated on this proposed Web services security plan and roadmap for developing a set of Web Service Security specifications that address how to provide protection for messages exchanged in a Web service environment.
For the first time, we have created a security model that brings together formerly incompatible security technologies such as public key infrastructure, Kerberos, and others. In short, this is not an idealized framework but a practical one that can allow us to build secure Web services in the heterogeneous IT world in which our customers live today.
In this document we present a broad set of specifications that cover security technologies including authentication, authorization, privacy, trust, integrity, confidentiality, secure communications channels, federation, delegation and auditing across a wide spectrum of application and business topologies. These specifications provide a framework that is extensible, flexible, and maximizes existing investments in security infrastructure. These specifications subsume and expand upon the ideas expressed in similar specifications previously proposed by IBM and Microsoft (namely the SOAP-Security, WS-Security and WS-License specifications).
By leveraging the natural extensibility that is at the core of the Web services model, the specifications build upon foundational technologies such as SOAP, WSDL, XML Digital Signatures, XML Encryption and SSL/TLS. This allows Web service providers and requesters to develop solutions that meet the individual security requirements of their applications.
IBM and Microsoft intend to work with customers, partners and standards bodies to evolve and improve upon this security model in a phased approach. We are seeding this effort with the WS-Security specification. WS-Security defines the core facilities for protecting the integrity and confidentiality of a message, as well as mechanisms for associating security-related claims with the message. While WS-Security is the cornerstone of this effort, it is only the beginning and we will cooperate with the industry to produce additional specifications that will deal with policy, trust and privacy issues.
To make the issues and solutions discussed in this document as concrete as possible, we discuss several scenarios that reflect current and anticipated applications of Web services. These include firewall processing, privacy, use of browser and mobile clients, access control, delegation, and auditing.
We anticipate concerns about what can be done to ensure interoperability and consistent implementation of the various proposed specifications. To address this, IBM and Microsoft will work closely with standards organizations, the developer community, and with industry organizations such as WS-I.org to develop interoperability profiles and tests that will provide guidance to tool vendors.
This document outlines a comprehensive, modular solution that, when implemented, will allow customers to build interoperable and secure Web services that leverage and expand upon existing investments in security infrastructure while allowing them to take full advantage of the integration and interoperability benefits Web service technologies have to offer.
1 Introduction and Motivation
Providing a comprehensive model of security functions and components for Web services requires the integration of currently available processes and technologies with the evolving security requirements of future applications. It demands unifying concepts; it requires solutions to both technological (secure messaging) and business process (policy, risk, trust) issues; and finally, it requires coordinated efforts by platform vendors, application developers, network and infrastructure providers, and customers.
Unifying the range of security technologies available means that the functional requirements of application security must be abstracted from specific mechanisms employed. For example, a customer making an on-line purchase should not be impacted by whether they are using a cell phone or a laptop computer, as long as each device can securely express the proper identity.
The goal is to enable customers to easily build interoperable solutions using heterogeneous systems. For instance, the secure messaging model proposed later in this document supports both public key infrastructure (PKI) and Kerberos identity mechanisms as particular embodiments of a more-general facility and is capable of being extended to support additional security mechanisms. Integration through the abstractions of a single security model enables organizations to use their existing investments in security technologies while communicating with organizations using different technologies.
Further, as organizations using different identity mechanisms collaborate using Web services, the security trust model provides a flexible framework within which the organizations can interconnect when configured with appropriate authorization.
At the same time, every customer and every Web service has its own unique security requirements based upon their particular business needs and operational environment. Within workgroup settings, for instance, simplicity and ease of operations are a top concern, while for public Internet applications the ability to withstand concerted denial-of-service attacks is a higher priority. Because these requirements may be combined in many ways and expressed at different levels of specificity, a successful approach to Web service security requires a set of flexible, interoperable security primitives that, through policy and configuration, enable a variety of secure solutions.
To address these challenges, this document proposes an evolutionary approach to creating secure, interoperable Web services based on a set of security abstractions that unify formerly dissimilar technologies. This enables specialization to particular customer requirements within an overall framework while at the same time permitting technologies to evolve over time and be incrementally deployed.
As an example of this evolutionary approach, the secure messaging model can be added to existing transport-level security solutions. A customer can add message-level integrity or persistent confidentiality (encryption of message elements) to an existing Web service whose messages are carried through, for example, Secure Sockets Layer (SSL/TLS). The messages now have integrity (or confidentiality) that persists beyond the transport layer.
We anticipate that the proposed model and specifications that emerge will be broadly available from multiple vendors and will be considered by appropriate standards organizations. Together, the model, specifications, and standards process enable businesses to quickly and cost-effectively increase the security of their existing applications and to confidently develop new interoperable, secure Web services.
The business advantage of such a model is clear. By framing a comprehensive security architecture for Web services, organizations and customers can be better ensured that their investments and assets are protected as business processes become increasingly recast as Web services.
Web Services Security Model Terminology
Because terminology varies between technologies, this document defines several terms that may be applied consistently across the different security formats and mechanisms. Consequently, the terminology used here may be different from other specifications and is defined so that the reader can map the terms to their preferred vocabulary.
- Web service—The term "Web service" is broadly applicable to a wide variety of network based application topologies. In this document, we use the term "Web service" to describe application components whose functionality and interfaces are exposed to potential users through the application of existing and emerging Web technology standards including XML, SOAP, WSDL, and HTTP. In contrast to Web sites, browser-based interactions or platform-dependent technologies, Web services are services offered computer-to-computer, via defined formats and protocols, in a platform-independent and language-neutral manner.
- Security Token—We define a security token as a representation of security-related information (e.g. X.509 certificate, Kerberos tickets and authenticators, mobile device security tokens from SIM cards, username, etc.).
The following diagram shows some of the different kinds of security tokens.
- Signed Security Token—We define a signed security token as a security token that contains a set of related claims (assertions) cryptographically endorsed by an issuer. Examples of signed security tokens include X.509 certificates and Kerberos tickets.
- Claims—A claim is a statement about a subject either by the subject or by another party that associates the subject with the claim. An important point is that this specification does not attempt to limit the types of claims that can be made, nor does it attempt to limit how these claims may be expressed. Claims can be about keys potentially used to sign or encrypt messages. Claims can be statements the security token conveys. Claims may be used, for example, to assert the senders identity or an authorized role.
- Subject—The subject of the security token is a principal (e.g. a person, an application or a business entity) about which the claims expressed in the security token apply. Specifically, the subject, as the owner of the security token possesses information necessary to prove ownership of the security token.
- Proof-of-Possession—We define proof-of-possession to be information used in the process of proving ownership of a security token or set of claims. For example, proof-of-possession might be the private key associated with a security token that contains a public key.
- Web Service Endpoint Policy—Web services have complete flexibility in specifying the claims they require in order to process messages. Collectively we refer to these required claims and related information as the "Web Service Endpoint Policy". Endpoint policies may be expressed in XML and can be used to indicate requirements related to authentication (e.g. proof of user or group identity), authorization (e.g. proof of certain execution capabilities), or other custom requirements.
- Claim Requirements—Claim requirements can be tied to whole messages or elements of messages, to all actions of a given type or to actions only under certain circumstances. For example, a service may require a requestor to prove authority for purchase amounts greater than a stated limit.
- Intermediaries—As SOAP messages are sent from an initial requester to a service, they may be operated on by intermediaries that perform actions such as routing the message or even modifying the message. For example, an intermediary may add headers, encrypt or decrypt pieces of the message, or add additional security tokens. In such situations, care should be taken so that alterations to the message do not invalidate message integrity, violate the trust model, or destroy accountability.
- Actor—An actor is an intermediary or endpoint (as defined in the SOAP specification) which is identified by a URI and which processes a SOAP message. Note that neither users nor client software (e.g. browsers) are actors.
Web Services Security Model Principles
Web services can be accessed by sending SOAP messages to service endpoints identified by URIs, requesting specific actions, and receiving SOAP message responses (including fault indications). Within this context, the broad goal of securing Web services breaks into the subsidiary goals of providing facilities for securing the integrity and confidentiality of the messages and for ensuring that the service acts only on requests in messages that express the claims required by policies.
Today the Secure Socket Layer (SSL) along with the de facto Transport Layer Security (TLS) is used to provide transport level security for web services applications. SSL/TLS offers several security features including authentication, data integrity and data confidentiality. SSL/TLS enables point-to-point secure sessions.
IPSec is another network layer standard for transport security that may become important for Web services. Like SSL/TLS, IPSec also provides secure sessions with host authentication, data integrity and data confidentiality.
Today's Web service application topologies include a broad combination of mobile devices, gateways, proxies, load balancers, demilitarized zones (DMZs), outsourced data centers, and globally distributed, dynamically configured systems. All of these systems rely on the ability for message processing intermediaries to forward messages. Specifically, the SOAP message model operates on logical endpoints that abstract the physical network and application infrastructure and therefore frequently incorporates a multi-hop topology with intermediate actors.
When data is received and forwarded on by an intermediary beyond the transport layer both the integrity of data and any security information that flows with it maybe lost. This forces any upstream message processors to rely on the security evaluations made by previous intermediaries and to completely trust their handling of the content of messages. What is needed in a comprehensive Web service security architecture is a mechanism that provides end-to-end security. Successful Web service security solutions will be able to leverage both transport and application layer security mechanisms to provide a comprehensive suite of security capabilities.
Point-to-point configuration
End-to-end configuration
The Web service security model described herein enables us to achieve these goals by a process in which:
- A Web service can require that an incoming message prove a set of claims (e.g., name, key, permission, capability, etc.). If a message arrives without having the required claims, the service may ignore or reject the message. We refer to the set of required claims and related information as policy.
- A requester can send messages with proof of the required claims by associating security tokens with the messages. Thus, messages both demand a specific action and prove that their sender has the claim to demand the action.
- When a requester does not have the required claims, the requester or someone on its behalf can try to obtain the necessary claims by contacting other Web services. These other Web services, which we refer to as security token services, may in turn require their own set of claims. Security token services broker trust between different trust domains by issuing security tokens.
This model is illustrated in the figure below, showing that any requester may also be a service, and that the Security Token Service may also fully be a Web service, including expressing policy and requiring security tokens.
This general messaging model—claims, policies and security tokens—subsumes and supports several more specific models such as identity-based-security, access control lists, and capabilities-based-security. It allows use of existing technologies such as X.509 public-key certificates, Kerberos shared-secret tickets and even password digests. As we will discuss later, it also provides an integrating abstraction allowing systems to build a bridge between different security technologies. The general model is sufficient to construct higher-level key exchange, authentication, authorization, auditing, and trust mechanisms.
2 Web Services Security Specifications
The security strategy expressed here and the WS-Security specification introduced below provide the strategic goals and cornerstone for this proposed Web services security model.
Moving forward, we are continuing the process of working with customers, partners and standards organizations to develop an initial set of Web service security specifications.
This set will include a message security model (WS-Security) that provides the basis for the other security specifications. Layered on this, we have a policy layer which includes a Web service endpoint policy (WS-Policy), a trust model (WS-Trust), and a privacy model (WS-Privacy). Together these initial specifications provide the foundation upon which we can work to establish secure interoperable Web services across trust domains.
Building on these initial specifications we will continue to work with customers, partners and standards organizations to provide follow-on specifications for federated security which include secure conversations (WS-SecureConversation), federated trust (WS-Federation), and authorization (WS-Authorization).
The combination of these security specifications enable many scenarios (some of which are described later in this document) that are difficult to implement with today's more basic security mechanisms.
In parallel, we will propose and move forward with related activities that enhance the Web services security framework with specifications related to auditing, management, and privacy.
Additionally, IBM and Microsoft are committed to working with organizations like WS-I on interoperability profiles.
The combination of security specifications, related activities, and interoperability profiles will enable customers to easily build interoperable secure Web services.
Each of the proposed specifications is summarized below:
Initial Specifications
- WS-Security: describes how to attach signature and encryption headers to SOAP messages. In addition, it describes how to attach security tokens, including binary security tokens such as X.509 certificates and Kerberos tickets, to messages.
- WS-Policy: will describe the capabilities and constraints of the security (and other business) policies on intermediaries and endpoints (e.g. required security tokens, supported encryption algorithms, privacy rules).
- WS-Trust: will describe a framework for trust models that enables Web services to securely interoperate.
- WS-Privacy: will describe a model for how Web services and requesters state privacy preferences and organizational privacy practice statements.
Follow-On Specifications
- WS-SecureConversation: will describe how to manage and authenticate message exchanges between parties including security context exchange and establishing and deriving session keys.
- WS-Federation: will describe how to manage and broker the trust relationships in a heterogeneous federated environment including support for federated identities.
- WS-Authorization: will describe how to manage authorization data and authorization policies.
Providing security for WS-Security requires due diligence in the production of the descriptions, specification and profiles in a number of functional areas. These documents will change and evolve through a process that balances the needs of customers with the needs of the Web services development community and our own educational process as we go through the specification process.
WS-Security describes enhancements to SOAP messaging to provide quality of protection through message integrity and message confidentiality. As well, this specification defines how to attach and include security tokens within SOAP messages. Finally, a mechanism is provided for specifying binary encoded security tokens (e.g. X.509 certificates). These mechanisms can be used independently or in combination to accommodate a wide variety of security models and encryption technologies.
WS-Security provides a general-purpose mechanism for associating security tokens with messages. No specific type of security token is required by WS-Security. It is designed to be extensible (e.g. support multiple security token formats). For example, a requester might provide proof of identity and proof that they have a particular business certification.
Message integrity is provided by leveraging XML Signature in conjunction with security tokens (which may contain or imply key data) to ensure that messages are transmitted without modifications. The integrity mechanisms are designed to support multiple signatures, potentially by multiple actors, and to be extensible to support additional signature formats. The signatures may reference (i.e. point to) a security token.
Similarly, message confidentiality is provided by leveraging XML Encryption in conjunction with security tokens to keep portions of SOAP messages confidential. The encryption mechanisms are designed to support additional encryption technologies, processes, and operations by multiple actors. The encryption may also reference a security token.
Finally, WS-Security describes a mechanism for encoding binary security tokens. Specifically, the specification describes how to encode X.509 certificates and Kerberos tickets as well as how to include opaque encrypted keys. It also includes extensibility mechanisms that can be used to further describe the characteristics of the security tokens that are included with a message.
WS-Policy will describe how senders and receivers can specify their requirements and capabilities.
WS-Policy will be fully extensible and will not place limits on the types of requirements and capabilities that may be described; however, the specification will likely identify several basic service attributes including privacy attributes, encoding formats, security token requirements, and supported algorithms.
This specification will define a generic SOAP policy format, which can support more than just security policies. This specification will also define a mechanism for attaching or associating service policies with SOAP messages.
WS-Trust will describe the model for establishing both direct and brokered trust relationships (including third parties and intermediaries).
This specification will describe how existing direct trust relationships may be used as the basis for brokering trust through the creation of security token issuance services. These security token issuance services build on WS-Security to transfer the requisite security tokens in a manner that ensures the integrity and confidentiality of those tokens.
This specification then will describe how several existing trust mechanisms may be used in conjunction with this trust model.
Finally, the trust model will explicitly allow for, but will not mandate, delegation and impersonation by principals. Note that delegation is consistent with impersonation, but provides additional levels of traceability.
Organizations creating, managing, and using Web services will often need to state their privacy policies and require that incoming requests make claims about the senders' adherence to these policies.
By using a combination of WS-Policy, WS-Security, and WS-Trust, organizations can state and indicate conformance to stated privacy policies. This specification will describe a model for how a privacy language may be embedded into WS-Policy descriptions and how WS-Security may be used to associate privacy claims with a message. Finally, this specification will describe how WS-Trust mechanisms can be used to evaluate these privacy claims for both user preferences and organizational practice claims.
WS-SecureConversation will describe how a Web service can authenticate requester messages, how requesters can authenticate services, and how to establish mutually authenticated security contexts.
This specification will describe how to establish session keys, derived keys, and per-message keys.
Finally, this specification will describe how a service can securely exchange context (collections of claims about security attributes and related data). In order to accomplish this, the specification will describe and build upon the concepts of security token issuance and exchange mechanisms defined in WS-Security and WS-Trust. Using these mechanisms a service might, for example, support security tokens using weak symmetric key technology as well as issue stronger security tokens using non-shared (asymmetric) keys.
WS-SecureConversation is designed to operate at the SOAP message layer so that the messages may traverse a variety of transports and intermediaries. This does not preclude its use within other messaging frameworks. In order to further increase the security of the systems, transport level security may be used in conjunction with both WS-Security and WS-SecureConversation across selected links.
This specification will define how to construct federated trust scenarios using the WS-Security, WS-Policy, WS-Trust, and WS-SecureConversation specifications. For example, it will describe how to federate Kerberos and PKI infrastructures (as described in the scenarios below).
As well, a trust policy is introduced to indicate and constrain and identify the type of trust that is being brokered.
This specification also will define mechanisms for managing the trust relationships.
This specification will describe how access policies for a Web service are specified and managed. In particular it will describe how claims may be specified within security tokens and how these claims will be interpreted at the endpoint.
This specification will be designed to be flexible and extensible with respect to both authorization format and authorization language. This enables the widest range of scenarios and ensures the long-term viability of the security framework.
3 Relating Web Services Security to Today's Security Models
This Web services security model is compatible with the existing security models for authentication, data integrity and data confidentiality in common use today. As a consequence, it is possible to integrate Web services-based solutions with other existing security models:
- Transport Security—Existing technologies such as secure sockets (SSL/TLS) can provide simple point-to-point integrity and confidentiality for a message. The Web Services security model supports using these existing secure transport mechanisms in conjunction with WS-Security (and other specifications) to provide end-to-end integrity and confidentially in particular across multiple transports, intermediaries, and transmission protocols.
- PKI—At a high level, the PKI model involves certificate authorities issuing certificates with public asymmetric keys and authorities which assert properties other than key ownership (for example, attribute authorities). Owners of such certificates may use the associated keys to express a variety of claims, including identity. The Web services security model supports security token services issuing security tokens using public asymmetric keys. PKI is used here in the broadest sense and does not assume any particular hierarchy or model.
- Kerberos—The Kerberos model relies on communication with the Key Distribution Center (KDC) to broker trust between parties by issuing symmetric keys encrypted for both parties and "introducing" them to one another. The Web services model, again, builds upon the core model with security token services brokering trust by issuing security tokens with encrypted symmetric keys and encrypted testaments.
Note that while the models are compatible, to ensure interoperability, adaptors and/or common algorithms for signatures and encryption will need to be agreed upon or developed.
Existing models for federation, authorization (including delegation), privacy and trust are less common and more ad hoc. Specifications to address these security properties are identified in the later phases of the strategy.
Often the existing trust models are based on business agreements. An example of this is the UDDI Web service. In UDDI, there are several participants who provide a Universal Business Registry through an agreement to support a set of APIs. Rather than defining a single model for "trust" through the requirement of a specific authentication mechanism, the "trust model" in UDDI gives the responsibility for authentication to the node, which is the custodian of the information. That is, each implementation of the UDDI Web service has its own authentication mechanism and enforces its own access control policy. The "trust" is between operators, and between the requester and the operator that is the custodian of its information.
4 Scenarios
Below we present a number of scenarios that exemplify how we envision the proposed Web Service security specifications being used. These scenarios are intentionally focused on the technical details to illustrate the capabilities of the overall security strategy. There will be companion documentation that provides detailed business use scenarios.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, places, or events is intended or should be inferred.
The list below briefly introduces some of the scenarios that can be supported by the proposed initial specifications and associated deliverables:
- Direct Trust using Username/Password and Transport-Level Security—This scenario illustrates authentication using a username and password with transport security.
- Direct Trust using Security Tokens—This scenario illustrates direct trust using X.509 certification and Kerberos service tickets (ST).
- Security Token Acquisition—This scenario illustrates authentication using a security token stored independently from the message.
- Firewall Processing—This scenario illustrates how firewalls can leverage this security model for greater degrees of control.
- Issued Security Token—This scenario illustrates basic authentication.
- Enforcing Business Policy—This scenario illustrates how to use security token issuance for codifying business processes.
- Privacy—This scenario illustrates how clients and services can communicate their privacy policies.
- Web Clients—This scenario illustrates the use of a Web browser as a client.
- Mobile Clients—This scenario illustrates how mobile clients can securely interact with Web services.
The second set of scenarios is more sophisticated. These scenarios CAN be built on the current deliverables but are in need of follow-on specifications (like WS-SecureConversation) to make interoperability seamless.
- Enabling Federation—This section describes several different scenarios involving federated trust.
- Validation Service: describes how to use a service that validates the security of a message (e.g. signature).
- Supporting Delegation—This illustrates how to use security tokens for delegation.
- Access Control—This illustrates how Web services security supports traditional access control list-based security.
- Auditing—This illustrates the use of auditing to track security-related activities and incidents.
Note that in the descriptions below the use of the term requester is used to describe the broad variety of potential users of a Web Service and is not meant to limit the characteristics of the requester. Requestors can include business entities interacting with a service within a B2B environment or individuals accessing services from a browser or mobile device.
Direct Trust using Username/Password and Transport-Level Security
Here is a very basic example showing how Web services Security can be used with existing transport security mechanisms:
The requester opens a connection to the Web service using a secure transport (e.g. SSL/TLS). It sends its request and includes a security token that contains its username and password. The service authenticates the information, processes the request, and returns the result.
In this scenario, the message confidentiality and integrity are handled using existing transport security mechanisms.
This scenario assumes that the two parties have already used some mechanism to establish a shared secret—the requester password. No assumption is made about the organizational relationship between these parties.
Direct Trust using Security Tokens
This scenario illustrates the use of a security token that is directly trusted by a Web service. Here direct trust means that the requester's security token (or its signing authority) is known and trusted by the Web service. This scenario assumes that the two parties have used some mechanism to establish a trust relationship for use of the security token. This trust may be established manually, by configuring the application, or by using a secure transport to exchange keys. By secure transport of keys we mean that a transport such as SSL (or other mechanism or process) can be used as a way for a trusted party to assert the validity of a key or security token to a recipient party. No assumption is made about the organizational relationship between the parties.
The requester sends a message to a service and includes a signed security token and provides proof-of-possession of the security token using, for example, a signature. The service verifies the proof and evaluates the security token. The signature on the security token is valid and is directly trusted by the service. The service processes the request and returns a result.
Direct trust assumes that the policies for privacy are well understood by the parties involved.
Security Token Acquisition
In some cases, the security token used isn't passed as part of the message. Instead, a security token reference is provided that can be used to locate and acquire the token.
The requester issues a request to the service and includes a reference to the security token and provides proof-of-possession. The Web service uses the provided information to obtain the security token from the token store service and validate the proof. The Web service trusts (note that trust was established outside of the message semantics) the security token, so the request is processed and the response is returned.
Firewall Processing
Firewalls remain a critical component of the Web services security architecture—they must be able to continue to enforce boundary processing rules.
As shown below, the firewall examines incoming SOAP messages and only allows those from "authorized" requesters to penetrate the firewall.
In this scenario we have two requesters sending messages to a Web service inside a firewall. The firewall examines the messages to determine if the requester is "authorized" to send messages to the specified Web service inside the firewall.
In this scenario, the firewall makes this decision by examining the security token used to sign the message. If the signature is valid, and the signing authority for the security token is trusted to authorize messages into the firewall, and the token says that it does authorize messages into the firewall, then the message is allowed; otherwise it is rejected. In some cases, a signature may specifically reference the firewall as a SOAP actor.
In other scenarios the firewall could also act as a security token issuing authority and only allow messages that include proof-of-possession of a security token issued by the firewall.
Issued Security Token
Here is an example showing how Web services Security supports simple authentication by a trusted party:
In the first two steps, the requester communicates with a certifying authority to obtain a security token, specifically a signed statement of assertions attesting to the requester's identity.
The requester obtained a security token because the Web service has a policy requiring that a security token of the appropriate type was needed (in this case, proof of identity).
The requester next sends a message, with the security token and a proof of possession attached to the message (think authenticator or signed challenge), to the Web service and receives a response.
Note that in the above description, the operation of the identity certification service was not described in detail. To obtain an identity security token, requesters may use existing security protocols or they may leverage the Web services security specifications.
If we assume the requester is using the Web services security specifications, then the system would operate as follows: the identity service describes its requirements in a policy, and the requester can then request a security token along with its proof of identity.
Note that the identity service is just a security token service. Moreover, the symmetry of Web services allows for any Web service to also encapsulate a security token service.
Finally, note that Web services can obtain security tokens on the requester's behalf (from a security token service) and return them to the requester for use on subsequent messages.
Enforcing Business Policy
In many business processes there are specific policies that must be enforced. For example, a service may require that consumers have a certain rating or standing with a specific auditing company. With Web services many of these policies can be codified and validated automatically, simplifying the overall process.
Consider the following example:
Nicholas' Dealership has a Web service that it uses for interacting with its parts suppliers. However, they only want to deal with suppliers whose parts are certified by the manufacturer.
A parts company, Joshua's Parts, would go to the manufacturer and present (and prove) their identity security token (from, for example, the illustrated Security Token Service) and request a security token from the manufacturer stating they are a certified parts dealer (assuming they are certified and in good standing). Joshua's Parts could then contact Nicholas' Dealership and provide (and prove) both security tokens.
If Nicholas' Dealership has codified their business policy into the service policy, the burden of policy conformance could be front-loaded to the parts company (e.g. Joshua's Parts).
The service policy also may specify constraints on what information the manufacturer would be allowed to store to ensure compliance with privacy policy.
Privacy includes a broad set of concerns and will need to be accounted for in each of the specifications that emerge from this strategy.
Basic privacy issues will be addressed by providing privacy statements within the service policy. More sophisticated scenarios, involving delegation and authorization, will be covered in specifications specific to those scenarios.
As an example, an individual states a set of "privacy preferences" which describe what the individual does or does not want to allow applications acting on the individuals behalf to do with the personal information. A calendaring application, working on the individuals' behalf, can now access a calendaring service that uses a set of "privacy practice rules", to make statements and decisions about use and disclosure of personally information. The calendar service makes the decision by combines the privacy practice rules with the privacy preferences to determine whether a proposed use or disclosure is permissible.
Web Clients
Consider an example where we have a Web client communicating with a middle-tier Web application, which, in turn, is talking (securely) to a Web service in another domain. The middle-tier Web application, which is Web services-aware, wants to obtain a security token for the Web client.
Furthermore, this scenario assumes that the security token enables the middle-tier application to act on the client's behalf when it talks to the service.
To enable this scenario, the Web client's browser accesses the middle-tier application and is redirected to an associated identity service. Once authenticated (for example using a HTML form and https), the request is redirected back to the middle-tier application. The identity service provides a security token (asserting the identity and the delegations) to the original middle-tier application Web server (for example using a query string sent via HTTPS). The Web server can now use these security tokens and issue requests from its own identity to the Web service. The Web service processes the requests, and returns the results to the Web server, where the results are formatted and returned to the browser.
Mobile Clients
The specifications described in this document above provide substantial flexibility in addressing the design challenges that are unique to mobile security. The flexibility of the Web services approach enables support for multiple cryptographic technologies providing both strong and performant cryptographic protection on devices with limited computational and storage capabilities. Similarly it enables network operators to provide security proxies, such as network gateways, to act on the mobile clients' behalf.
Following is an example combining both these ideas. When a network operator supports mobile clients (using these Web service security specifications) they can configure those clients to send requests via the network operator's gateway. In this scenario the gateway is a SOAP intermediary that actively participates in the overall message flow; specifically, the network operator is providing a value-add encryption algorithm designed for mobile devices. The gateway can augment or change the security tokens and quality of protection of the message. Note that the flexibility inherent in this Web services security model allows this solution even when the device is roaming on a foreign network.
This is illustrated in the example below:
Enabling Federation
The Web services Security model is designed to support federation. Here is a simple example of identity federation:
Alice at Adventure456 wants to use the Currency Web service at Business456. The Currency service will only process requests with a security token issued by Business456. Alice only has a security token with identity claims (i.e. an identity security token) issued by Adventure456.
In this scenario, Alice will only be able to access the Currency service if Business456 is willing to accept security federation with Adventure456.
The following subsections describe several approaches to security federation.
Federation Using Security Token Exchange
In this approach, the Currency service's policy states that it only accepts security tokens issued by Business456. Because the policy indicates where to get the required security token, Alice presents (and proves) her Adventure456 security token to the Business456 security token service and receives a Business456 security token. She then presents (and proves) this security token in requests to the Currency service. This is illustrated in the diagram below:
In this approach the Business456 security token service was configured to accept security tokens with identity claims issued by Adventure456
It should be noted that this example is very similar to the example in the Enforcing Business Policy scenario. This demonstrates the flexibility of the web service security model.
Federation Using Trust Chaining
In this approach, the Currency service will accept a request with any security token, but it will not process the request unless it can obtain a Business456 security token based on the provided security token (and proof).
To do this, the Currency service forwards the original request to the Business456 security token service which evaluates the initial security token. If valid, it endorses the request and may include a Business456 security token for Alice to use on subsequent requests. This is illustrated in the figure below.
In this approach the Business456 security token service was configured to accept security tokens with identity claims issued by Adventure456
Federation Using Security Token Exchange (PKIKerberos)
In this approach Adventure456 has issued Alice a public key security token and the Currency service's policy indicates that it only accepts Kerberos security tokens from its KDC.
At the direction of the Currency service's policy, Alice presents (and proves) her public key security token to Business456's security token service. The security token service encapsulates Business456's KDC. As a result, it is able to validate Alice's public key security token and issues a Kerberos security token for the Currency service. This is illustrated in the figure below:
In this approach the Business456 security token service was configured to accept public key security tokens with identity claims issued by Adventure456.
Federation Using Security Token Exchange (KerberosSecurity Token Service)
In this approach Adventure456 has issued Alice a Kerberos security token and the Currency service's policy indicates that it only accepts security tokens issued by its own security token service.
Here we assume the administrators at Adventure456 and Business456 have exchanged public key certificates in order to federate security. We further assume that Alice only supports symmetric key technology.
Based on the Currency Web service policy, Alice needs to acquire a security token that can be used to access the security token service at Business456. Because Alice is using symmetric key security tokens, Alice first contacts her security token service to acquire a security token that is intended for the Business456 security token service. Note that this security token will contain a symmetric key, Sab, encoded with the public key of the Business456 security token service.
Using the security token intended for the Business456 security token service, Alice requests a security token for the Currency service. The Business456 security token service provides Alice with a symmetric key, Sac, and a security token for the Currency service.
Using the security token intended for the Currency service and the associated symmetric key, Alice makes requests to the Currency service.
Federation Using Credential Exchange (KerberosKerberos)
In this approach Adventure456 has issued Alice a Kerberos security token and the Currency service's policy indicates that it only accepts Kerberos security tokens issued by its own security token service that encapsulates its KDC.
Here we assume the administrators at Adventure456 and Business456 do not want to establish cross realm transitive trust but are willing to exchange public key certificates in order to federate security. Further we assume that both Alice and the Currency service only support symmetric key technology.
As in the previous example, the security token services have the ability to provide symmetric key security tokens to the services within their trust domain. As a consequence, the approach described above works in this scenario.
Validation Service
This Web services Security model also supports scenarios in which the requester outsources the processing of the message and security token validation. It should be noted that misuse of such a service can cause scalability issues. That is, depending on the implementation it may be cheaper—or more expensive—for the service to perform the validation service. The Web services security model supports either approach, thereby enabling this scenario.
In this scenario we have separated the validation service from the security token service. In other scenarios they could be combined or have a direct trust relationship (therefore not requiring WS-Federation).
In this scenario, the requester obtains a security token from the Security Token Service. It then sends a message to the Web service and includes proof-of-possession (e.g. a signature). The Web service sends the signature block, the security token, and its computation of the digest that was signed to the validation service. The validation service, which is trusted by the Web service, then issues a valid/invalid decision.
It should be noted that the validation service could indicate its decision by issuing a security token on behalf of the requester that asserts the appropriate claims.
Supporting Delegation
Web services security supports delegation. Here is a sophisticated delegation scenario designed to show the flexibility of the approach: Alice uses calendar456 to manage her schedule. She wants to allow Bob to set up a meeting with her on Tuesday. However, Bob does not do the scheduling directly. Instead Bob uses the service, schedule456, to set up meetings that need to be put on Alice's calendar.
Alice doesn't know how Bob will schedule the meeting, but she wants to limit the set of services that can see her calendar
Alice provides Bob with a security token that enables Bob to schedule meetings on her calendar. This security token contains claims that restrict Bob's ability to schedule meetings to Tuesday. Furthermore, this security token enables Bob to issue subsequent security tokens so long as the subject(s) can prove they have a privacy certification from TrustUs456, a third party service.
Since the service Schedule456 has been audited by TrustUs456, they have a security token that asserts their privacy certification.
When the schedule service accesses Alice's calendar at Calendar456, it can prove proof-of-possession of its privacy certification and its claim to access and schedule a meeting based on the security token(s) from Alice, through Bob, to itself.
Access Control
While working together, Alice and Bob find that they are frequently scheduling meetings with each other and develop a level of trust. Consequently, Alice wants to allow Bob to schedule meetings without having to delegate to him every time. She could increase the expiration of the delegation security token, but she will need to re-issue them and this is problematic if she wants to rescind Bob's ability to schedule meetings.
Alice communicates with her calendar service (authenticates herself) and obtains the authorization list. She updates the authorization list to allow Bob to see her free/busy data and schedule meetings and submits it to the service. Now when Bob accesses her calendar service for these operations, he doesn't need a delegation security token from Alice.
In the delegation scenario above, it is possible that an antagonist might try to schedule a meeting without a delegation security token or with an expired security token. In such cases the request will fail because the antagonist cannot prove the required claims.
In order to track this type of activity, the service may provide auditing features. That is, when a security-related event such as authentication or an unproven claim or a bad signature occurs, it is logged. An administrator can securely access the log to review security-related events and manage the log.
For example, antagonists may try to imitate Bob. Using a monitor/management tool, the security administrator, Carol, reviews the audit log and sees that Alice's calendar has had a number of security failures. In reviewing the data she sees that sometimes Bob's request fail because his signature does not match the message or messages are old (replayed). As a result Carol collects the audit records for use in trying to track down the antagonists.
5 Summary
As Web services are applied more broadly, as application topologies continue to evolve to support intermediaries such as firewalls, load balancers, and messaging hubs, and as awareness of the threats organizations face becomes more well understood, the need for additional security specifications for Web services grows clear. In this document, we propose an integrated Web services security model and a set of specifications for realizing that model. These new specifications, by extending and leveraging (rather than replacing) existing security technology and assets, will enable customers and organizations to more rapidly develop secure, interoperable Web services.
IBM and Microsoft believe that this is the first step in defining a comprehensive Web services security strategy. It reflects the challenges and solutions we have identified thus far. As we continue to work together with customers, partners and standards organizations to secure Web services, we expect that there will be additional ideas and specifications needed to make the strategy complete.
This document was jointly authored by IBM and Microsoft.
Key contributes include (alphabetically): Giovanni Della-Libera, Microsoft; Brendan Dixon, Microsoft; Joel Farrell, IBM; Praerit Garg, Microsoft; Maryann Hondo, IBM; Chris Kaler, Microsoft; Butler Lampson, Microsoft; Kelvin Lawrence, IBM; Andrew Layman, Microsoft; Paul Leach, Microsoft; John Manferdelli, Microsoft; Hiroshi Maruyama, IBM; Anthony Nadalin, IBM; Nataraj Nagaratnam, IBM; Rick Rashid, Microsoft; John Shewchuk, Microsoft; Dan Simon, Microsoft; Ajamu Wesley, IBM
- [Kerberos]
- J. Kohl and C. Neuman, "The Kerberos Network Authentication Service (V5)," RFC 1510, September 1993, http://www.ietf.org/rfc/rfc1510.txt.
- W3C Note, "SOAP: Simple Object Access Protocol 1.1," 08 May 2000.
- T. Berners-Lee, R. Fielding, L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax," RFC 2396, MIT/LCS, U.C. Irvine, Xerox Corporation, August 1998.
- W3C Recommendation, "Canonical XML Version 1.0," 15 March 2001.
- [XML-Encrypt]
- W3C Working Draft, "XML Encryption Syntax and Processing," 04 March 2002.
- [XML-ns]
- W3C Recommendation, "Namespaces in XML," 14 January 1999.
- [XML-Schema1]
- W3C Recommendation, "XML Schema Part 1: Structures," 2 May 2001.
- [XML-Schema2]
- W3C Recommendation, "XML Schema Part 2: Datatypes," 2 May 2001.
- [XML Signature]
- W3C Proposed Recommendation, "XML Signature Syntax and Processing," 20 August 2001.
- [WS-Routing]
- H. Nielsen, S. Thatte, "Web Services Routing Protocol ," Microsoft Corporation, October 2001.
- S. Santesson, et al, "Internet X.509 Public Key Infrastructure Qualified Certificates Profile," http://www.itu.int/rec/recommendation.asp?type=items&lang=e&parent=T-REC-X.509-200003-I.


text:
It has been reported that eating more fruits and vegetables may boost psychological well-being. New research now shows there can be a boost in motivation and vitality in as little as two weeks. That news provides an even greater incentive to include fruit and vegetable intake among the small changes to which we are aspiring during National Nutrition Month®.
Teachers and youth leaders are daily role models for kids. The personal changes made related to healthy eating habits can provide a positive influence in ways you may have not even considered! With these fun and positive employee wellness suggestions, start with fruits and veggies to enhance or develop healthy modeling at your school or program.
- Place simple fruit and vegetable messages in the staff room and hallways.
- Take photos of staff with their favorite fruit or vegetable and post. Encourage staff to share how they like to eat it and if there is a favorite recipe of theirs.
- Have staff share ideas to add more fruits and vegetables to their day. Such as:
- adding fruit to dry or cooked cereal
- putting extra vegetables in soups or casseroles or on pizza
- adding fresh fruits to yogurt
- making a fruit or vegetable a part of a snack
For the amount of fruits and vegetables recommended for adults each day, refer to MyPlate Daily Checklist. Recommendations vary according to daily calorie needs. For many adults that is around 2 cups of fruit and 3 cups of vegetables each day.

subset: commoncrawl


text:
Aspen James
Aspen James
Demgen Arnold
Baby girl Aspen James Demgen Arnold was born on Nov. 25, 2017, to Leslie and Adam Arnold of Lakeshore. She weighed 7 lbs., 9 oz. and was 20 inches long. She was delivered by Dr. Jennifer Arnhold at Tri-County Health Care in Wadena. Proud sister is Sailor Grace. Proud grandparents are Jim and Carol Demgen and Jeff and Kay Arnold.


text:
Yeah, thought I might be. ^_-
I have this perpetual urge to make little classifications and subdivisions to work I'm doing on the computer. I like to make meta-indexes – you know, stratified, taxonified collections of links to information? For instance, an index on Hawai'i (which I have), with a subpage on Maui, with a subpage on – oh, I dunno – small local businesses, with a subpage on cafés possibly with subpages arranged by town or region. I don't know if it's OCD or just being the daughter of a librarian, but gathering in huge amounts of information and then creating a cross-referenced index out of it is just my cup of tea. I'm good at it.
Anyway, I've had this tendency to want to do the same with blogging. I'll not share how many blogs I have, but it's a small slew, all by category of interest. One of them does pretty well for itself, but I'm not ready to share it here, methinks. However, I think the rest of them are perhaps not robust enough because I keep trying to hive out little chunks of thought streams.
SO – to that end, I think that, excepting topics that go better on that one blog I mentioned, I'm going to broaden the focus of UnRavelations and let it be my general blog for the moment. However, I'm still very much in a crafty state of mind, so there will still be plenty of *that.* I just plan on this being a more well-rounded journal.
I need to bounce – almost time to pick up the little dudes from school – but I thought I'd leave you with one of the better costume ideas I saw this Halloween:
The two boys dressed up here said they were bushes. And what looks like Spanish moss there is actually all yarn. Looks a bit like ghillie suits, but not quite, at least not to me. In any case, I thought they were fab!


text:
The last time the Panthers played the Carolina Hurricanes they blew a two-goal lead and after the game their coach was fired over the phone.
History nearly repeated itself, score-wise that is. Once again Florida coughed up a two-goal lead but this time pulled out a much-needed 3-2 victory over the undermanned Hurricanes on Tuesday night in a mostly barren BB&T Center to finish out a disappointing 1-3 homestand.
It took shootout goals by Aleksander Barkov and Jonathan Huberdeau to accomplish the task.
Roberto Luongo, who recently said he didn't deserve to be playing while going through one of the worst slumps of his certain Hall of Fame career, certainly needed a...


text:
Over at Balkinization,
Marty Lederman
discusses the revelation of the previously secret March 14, 2003, memo by John Yoo that extends the theory of the 2002 torture memo (which sought to excuse the CIA) to the military's operations. Pages 18 and 19 of this memo make the now-familiar and infamous argument that the torture statute would be unconstitutional as applied to the president acting in his capacity as commander in chief. As Marty explains, this memo "
effectively gave the Pentagon the green light to disregard statutory limits on torture, cruelty and maltreatment in the treatment of detainees.
" If you want evidence of how the law was badly twisted and misused in the Bush Justice Department, you need look no further than here.


text:
Walking and Trekking Holidays in Patagonia, Argentina
Argentina and Chile
Amazing Patagonia! Glaciers, lakes, towering peaks like Cerro Fitz Roy, Tierra del Fuego and the vast landscapes of Patagonia including Torres del Paine invite you to explore them all.
To plan your ideal Argentina walking trip, contact one of our trekking consultants today.
Grades Explained- Easy
- Moderate
- Demanding
- Strenuous
Detailed grade info here


text:
Discussion in 'BlackHat Lounge' started by MojoSoDope, Jun 27, 2012.
No, not in a bad way...
Just got Jr V.I.P
Welcome to the blue club, dude!
welcome buddy! I'm a new VIP myself.
congratulations! is joining the blue club the same as joining the mile high club? just wondering!
welccome to the club buddy hehehe i was blue too
Welcome to JrVip
Blue is good
Separate names with a comma.


text:
Monday, January 02, 2006
20 Comments:
- MilkMaid said...
I've looked back at your site the last week or so, and see no pictures of you. So...a picture?!?
Is that a question?
- OldOldLady Of The Hills said...
Where are you in the United States...I am in Hollywood!
I'm here from Michele today and wish you a VERY VERY HAPPY ANNIVERSARY!!! That is quite a milestone, a whole year of blogging!
- Crypto said...
Happy Anniversary. Question? Have you gotten what you want out of blogging? I mean, when you started, did you think it would help, or was it just a release or outlet? Is the reason you write today the same reason you started?
Ok, maybe that was more than one.
- Karen said...
Congrats and Happy Anniversary. Good for you for sticking with it for a year. I'm sure you find it lots of fun and very...fulfilling. Happy New Year!
Michele sent me!
- Tammy said...
Happy Anniversary! :)
Hope your New Year is wonderful, Dawn!
- Last Girl On Earth said...
Happy Blogoversary. I'll drink a toast for you tonight! Michele sent me. Happy 2006!
- Pieces of Me said...
HAPPY BLOG ANNIVERSARY!! I already have a beer opened for the ceremony!! I will ask a question...what makes me under the list of purses? LOL Happy New year!! TTYL
- Gary said...
I have no complaints. I'd just like to say that you take great pictures, so I hope to see lots more in the new year.
- Erin said...
hee hee! happy blogaversary!!!!! YAY! nobody really commented on my one year anniversary a few months ago, so i hope you get lots and lots of comments! i guess my question would be to see a picture of you AND(because i'm greedy...), how has blogging affected your life, good and bad? :)
Happy Anniversary!!
- momsgoneloony said...
Dawn, as far as the new post question on my blog.... you set it up in your blogroll account, under preferences, then recently updated.
HAPPY BLOGIVERSARY!! I want to see a picture too...we've seen crackhead sister already...and also..what is your rating system? Jewelry, purses?? Just nosy....
- delite said...
Happy Anniversary!!
Yeah, you need to post a pic of yourself! :D
- MommaK said...
Happy Blogversary my dear!! I'm glad you're still around. I wasn't sure where you had run off to. SO can I blogroll you here or is it on the DL?
Cheers to another year of you sweet Dawn:) xo
- cosmopolgirl said...
Happy anniversary! Cheers!
- PresentStorm said...
Very cool ...Happy 1 year :)
- Suzanne said...
Happy Blogaversary!
a question? ok..did you design your blog? I love the concept, it's very cute. oh...and post some pictures k?
- layman said...
Dawn, Happy Blogaversary (nice word, Suzanne) and Happy New Year.
I don't need a picture of you, from your writings, I know you are a beautiful person inside and out. I love your fortitude and resilience in face of difficulties.
What do you do to keep healty and what is your daily routine like?
- Blondie said...
Nice blog!!
Happy Anniversary!
- Rebky said...
Happy Anniversary! I've been getting caught up on your blog here...My questions:
How much weight have you lost?
What helped you the most loose it.. your 'secret weapon'?
How old are you?
What is your new job?
Are you going to show us some pictures with your new camara??
- Yara said...
Happy anniversary
My question to you would be: have you ever post something that was too embarrassing and have you removed it then again. And are there things that you find too embarrassing to even post in the first place.
- sage said...
Happy Anniversary Dawn, My year mark was last month, but your blog is so much more attractive. Blessings on another year!
Subscribe to Post Comments [Atom]


text:
Recession need not sink job hopesFinancial Post
This spring, 1.5 million university graduates will enter the one of the worst job markets in years. But in spite of an economy on the brink of recession it may not necessarily translate into a poor market for these grads. That's not to say it'll be a cinch for every graduate to find a job. While some industries are hot, others have gone cold. So each person's result will depend on factors such as education and occupational choice.
MilitaryConnection.com is a portal of all things military. We have thousands of pages and hundreds of databases of valuable information and resources. There is something for everyone. All of this is provided free to users. Additionally, we feature all types of Articles like this one to keep you informed. We will post your press releases, special events, newsletters, professional conferences and seminars, reunions, job fairs, and videos to help organizations get out the word. One of the areas of our focus is connecting candidates from the military community with outstanding government and civilian employers. We are well aware that candidates from the military community across the board have a work ethic second to none. They make highly valued employees. MilitaryConnection.com has a multitude of employment resources including a Directory of over 30,000 employers, Job Tips, Columns, our Job Board, Virtual Job Fair and much more. We understand the importance of education. Please check out our new Scholarship Directory featuring thousands of scholarships. When the next tour is back home, it's on MilitaryConnection.com.


text:
Real Housewives star Jacqueline Laurita is perhaps now more famous for her role as an advocate and mom for her autistic son. Watch her emotional interview with Parenting as she discusses how she discovered her son's autism and how the diagnosis changed their lives.
Check out stories from Parenting readers about how autism has affected their families


text:
The Chicago City Council voted 38-12 today to approve Mayor Richard Daley's $6.1 billion budget proposal largely intact, but not before aldermen offered the usual smattering of complaints.
Ald. Thomas Allen, 38th, announced he would vote against Daley's budget for the first time in his aldermanic career. Allen said the spending plan would fail to uphold the council's pledge to maintain at least $400 million in parking meter lease money in a long-term reserve fund to replace the parking meter proceeds the city lost.
"Sometimes we sit in this room and think the 50 of us are breathing different air," Allen said.
Read more on Clout Street


text:
South Florida has its Blackzilians, and New York has its Blacktalians. The incredible t-shirt you see above is a collaboration between Longo/Serra MMA and East Coast MMA Fight Shop, and features the famous "Ray Longo as a younger, suprisingly handsome man" photo that the acclaimed trainer proudly hangs in his gym, and proudly uses as his twitter avatar. You can buy one of these shirts right here for $26.
Of course, we wouldn't even mention this if we weren't giving you a chance to win one for free. Yes, ladies and gentlemen, it's fight-picking time. And we're going to keep it real simple this time. On Saturday night, Anderson Silva will meet Stephan Bonnar in the main event of UFC 153 in Rio. You're going to tell us who will win and how. Your entry should be in this format:
- Anderson Silva def. Stephan Bonnar via TKO (cut), 2:36 of round 2
- Anderson Silva def. Stephan Bonnar via unanimous decision (30-24 x 3)
- Stephan Bonnar def. Anderson Silva via submission (monkeys flew out of butt), 4:54 of round 3
Please include the judges' scores if you think a fight will end in a decision, in case we need them for a tie-breaker; keep in mind that Silva vs. Bonnar is only scheduled for three rounds. The most accurate prediction will win a fresh new Blacktalians t-shirt, though we may award more than one in case of a tie. Entries must be in by Saturday at noon ET, and we'll announce the winner on Monday. One entry per person, please. Any other questions, let us know. Good luck!
Bonus video: Ray Longo teaches The Fight Nerd how to hold focus mitts in 2009, with the help of some kid named Chris Weidman.


text:
Review | Author Bio | Read an Excerpt
Bodie Hodge & Tommy Mitchell's Bio:
Bodie Hodge is the author of Fall of Satan and co-author of Dragons: Legends and Lore of Dinosaurs. He is on the staff of Answers in Genesis, and is a speaker, writer, contributor, and researcher on a host of topics related to apologetics, biblical history, and the book of Genesis.
Dr. Tommy Mitchell is a scientist, physician, and father who has a burden to provide solid answers from the Bible to equip people to stand in the face of personal tragedy and popular evolutionary misinformation.


text:
Harwich Center
Additional Links:
Between the stately Brooks Academy Museum and the handsome spired First Congregational Church, this village contains the most classically elegant architecture anywhere on the Cape. Indeed the entire center of the village is on the National Historic Register.
A striking Greek revival building in the heart of Harwich Center, the Brooks Academy Museum, with its bright white facade and massive fluted doric columns, dates from 1844 and was built as a private school. It survived as a public school until 1963 when the new school opened nearby and the last group of students trod its historic halls.
Today the Brooks Academy building houses the Harwich Historical Society and within its walls can be found the history of Harwich in exhibits, books, programs and archives. Its friendly volunteers, many of whose families date back generations, are only too happy to share with visitors.
On permanent display is a comprehensive exhibit about the cranberry: its origins, cultivation and central role in the history of the town. Temporary exhibits include a scale model working railroad depicting the old rail line between Hyannis and Orleans which takes up nearly an entire room. Train buffs of all ages have been flocking to see it and give it rave reviews. Another display offers a new slant on the Civil War as seen through the eyes of Sidney Brooks who went to war as a member of the U.S. Christian Commission to minister to the spiritual needs of the men at the front. His letters home are riveting.
The First Congregational Church in its present form dates from 1854 and with its adjoining cemetery, forms a stunning centerpiece of the village. The nearby Brooks Library offers a wealth of town history or "Harwichiana" in its Cahoon History Room, a fine Cape Verdean Collection, and a local authors and painters section. Town offices are housed across the street in another handsome building, erected as a bank in 1914. An example of "colonial revivalism," it is on the Register of the Massachusetts Historical Commission.
Behind the Congregational Church the Cape Cod bike trail intersects the village, while nearby Brooks Park features a bandstand, ball field, tennis courts and ample parking. In the Summer the park holds weekly open air concerts and outdoor fairs. A Mexican restaurant and some small cafes dot the village, making it unnecessary to leave the village if you're hungry.
Scenic Cranberry Valley Golf Course, named one of Golf Digest's 50 Best Public Courses and rated "Excellent" by Zagat Golf Guide in 2007, is located in Harwich Center off Oak Street. A par 72, it's a full service course with pro shop, practice facility and a cafe serving breakfast and lunch.
If you like good baseball and would like to see prospective major league players up close, be sure to check out the Harwich Mariners of the famous Cape Cod League. They play their home games at Harwich High School's Whitehouse Field and are the 2008 League Champions.
For more information contact the Brooks Academy Museum (508) 432-8089 or the Brooks Library (508) 430-7562.
For charming inns and lodging contact the Harwich Chamber of Commerce (508) 432-1600.
V.E. Laporte
Harwich Historical Society


text:
Sales Have Ended
Sales Have Ended
This activity is for currently enrolled Rocky Run Middle School students in 7th/8th grade who have registered to participate in the After-School Program. If you have any questions, please email email@example.com
Activity Information:
Any students interested in playing or learning how to play chess can join this club. Board Games and online games are used. This is a relaxed and fun environment.
Activity Meeting Dates:
This club will meet Mondays that we have after-school program from 2:30-3:30pm. Students will be required to sign-up for each time that they would like to attend chess club.
How do I get home from after-school activities?
Please review our late bus list & how to get home from after-school program page. If you have additional questions, please contact firstname.lastname@example.com
What can I bring into the event?
Please leave your personal items in your locker. You will have time in between activities to go to your locker or gather your items before you go home. If this is a gym activity, you need to bring a separate pair of workout clothes and shoes. You will not be allowed to go to your gym locker.
How can I contact the organizer of this activity with any questions?
Amanda Tyner is the After-School Specialist. The best way to contact her is by email to email@example.com and someone from the after-school team will respond to you within 24 hours.
Do I have to bring my printed ticket to the event?
Only specific activities require a printed ticket and will say so in the Activity Description and Confirmation Email. If it does require a ticket, you can print it on your own, see Mrs. Tyner during lunches to print it out for you, or you can show the ticket on your mobile device or laptop.
Can I update my registration information?
You can update your registration for any activity by logging into your Event Brite account. In the right corner, you will see your name, click it. You will see "Tickets" you can click that you see all of the activities you have signed up for. Click the activity to be able to cancel your registration or update your information.


text:
Spell Candles Poured On The Moon
Remove Curse Candle Spell
Black & White Candle with Holly, rosemarry, and SD sage, Amethyst stone, Poured on the dark moon
About this Remove Curse Candle Spell:
Many worry if they cast a spell against someone that causes harm it will activate the law of return - I most certainly agree. The concept is what every you put out there you get 3x back. However, The use of a the Germanic Hexenspiegel or magick witch mirror dose not fit in this category. The mirror doesn't reflect on your intent ( excuse the pun ) it only reflects back the black magick that another would cast upon you. It more than triples the protection against incoming bad magic that the candle will clear during the ritual. So the Hexenspiegel's function is to bounce the hex or curse back to its sender. The more the bad witch or bad person tries harder to send negativity, the more it is reflected right back at them without effecting you.
To break a hex or curse that has been cast upon you. Powerful candle magic and seriouse intent is needed to remove the effects on you, and reverse the negative energy and turn its effects back on the individual who initially cast it. This remove curse candle and spell will guide you through the process, and protect you from any additional hexing in your future.
2" x 4-1/2 Tall about 1 pound of wax.
Each candle has four prayers, hand written on rice paper, charged and blessed with magickal oil and added to the wax as it is poured. Plus, each candle has one small stone talisman included in the wax to increase it's magickal properties. After the candle wax is gone, you will have this stone which has been charged over the time your candle was burned. Place your talisman on your alter, in your pocket or medicine bag to continue the magickal energy of your spell.
The dark moon the most powerful energy levels for spell casting, the dark moon is the best opportunity to remove unwanted things from our lives. This is also a good time to reverse spells others have cast, ideal for warding off or banishing spells and focusing on removal of negative energies.
Metaphysical Properties
: Colors:
Elemental spirits, Angels, God, divination and prophecy. Purification, purity, innocence, wholeness, completion. truth seeking, consecration, spiritual enlightenment, protection against negativity, divination, inpiration, and clairvoyance.
Elemental earth, deities of the Underworld. Repel and banish evil and negativity, protection, breaking free from bad habits and addictions, deep meditation, opens up deep unconscious levels. The
of the mirror is Female energy, cycles, rebirth, reincarnation, emotional stability, intuition, dreams, psychic abilities Silver, or Moon Metal, is the true metal of Witchcraft and the Occult. Silver's Magical Properties enhance all psychic, supernatural and Occult paranormal aspects. The protective qualities of Silver and it's association with the Moon and the night makes it the metal of choice to protect against all dark forces.
banishes evil this in combination with the
SD sage
will help remove evil black magic or the evil eye, purifies and protects. The sage was harvested on a reservation in SD pictured here.
is held as one of the oldest protection herbs, guarding against any evil work, spells, voodoo magick or spirits.
: Amethyst is a powerful stone and has many magickal properties. In this case we are useing its power give victory and quickens the mind to help control negative thoughts. The Chaldean Magi believed this stone protected against evil sorcery and brought success and good luck. Amethyst was also said to grant an understanding of hiddenknowledge. Because the stone has transmutational energies, it helps to open gateways into intense and transforming spiritual experiences, and can protect it's owner from black magic. Known as a change stone, amethyst can bring about any type of change in your life and consciousness. It also breaks up old emotional thought processes and assists psychic opening in a grounding manner.
Fennel is an important magickal herb that has been used for centuries. It is used in this candle to prevent negativity and provide protection from harmful spells, courage, divination, cleansing, strength, energy, meditation, virility, psychic protection, and as a means for counter-magick.
is ruled by the sun, giving it masculine energy, and associating it with the element of fire. When burned, this plant emits very powerful cleansing and purifying energy. Some people cleanse an area for ritual (or before divination) by using rosemary to flick about droplets of salted water.
: Get a small mirror or jewlery with a mirror on it. You can find such at hobby lobby or any bead shop or even the dollar tree, or use an old cosmetic makeup mirror from powder compact. Clean it with water. Do not use one that is cracked or the silver is scratched. Carve your intent into the sides of the candle. Words like: banish curse, remove evil, protction - 3x3. Hold the mirror in your hand so you can see the candle in it's reflection.
Recite the following incantation
while looking at the candle flame reflecting in the mirror
possible spell: (or write your own) light the candle and chant.
Mirror clear and mirror bright, reflecting the flame of my candle tonight. Remove the curse and the hidden energy, my powerful mirror is protecting me. Candle Flame and Candle bright, break this curse with your candle light. Mirror mirror blocks all negativity and sends it back by power of three. Heart and mind and soul combined, angels, guardians all aligned. I break this hex and am set free, I now invoke the law of three. This is my will, so mote it be."
Repeat this at least seven times every day until the candle is gone. Daily repetition will increase the spell's effectiveness. Then keep the stone from the candle with you for luck.
after the spell
-after the candle wax is gone hand the mirror in the middle of your house or apartment. Inside a light fixture or someplace on the celing. If it gets a crack in it burry it right away. The amathest stone could be wrapped with wire and worn as a necklace, charged with the same reflective energies. When you're not wearing the stone hang it on a nail next to your bed. I use a black cord double tied to slip on and off easier.
Feel free to call me between 8am - 8pm CST with questions - If you are looking for guidence please pay for one 1/2 hour consultation
Custom Poured Candles Are Available
SD Eagle Butte Sage


text:
Internet Explorer - From the Tools menu, select Internet Options. Click on the security tab and naviagte to the advanced settings of your current level. Set actice scripting to "Enable". Close and reopen your browser.
Students start their ePrep course in the Home Room, where they will set up a schedule, launch into practice tests, and track their progress and recommended lessons.
Students should create an ePrep Schedule to stay on track with their course assignments leading up to test day.
Students take practice tests, under simulated, test-day conditions, then transfer their answers to the online Exam Room. Once tests are graded, students watch detailed video explanations.
Based on practice test results, students receive detailed recommendations in the Study Hall for further lesson review.
Student build their vocabulary in WordSmith through sorting, review, and testing of over 1500 common SAT and ACT words.


text:
Weddings are very special occasions when everyone wants to look their best on the "big day". And, unless you're already in peak physical condition, you need to know how to diet for a wedding in order to look handsome in your tux or stunning in your wedding gown. The more time you have to work on your body and lose the weight, the better it will be. However, a diet for a wedding does not have to take several months to get you to your goal wedding weight, especially if you only have a few extra pounds to lose.
Once a wedding date has been set and assuming you've given yourself a few months to plan all the details, you'll want to put some effort into watching your eating habits. Food is the number one factor impacting weight loss and your goal here is to reduce the number of calories consumed in a day. It is critical at this point in your wedding diet to be sure to eat healthy and start limiting the excess number of discretionary calories. (Those are the ones that come from salad dressings, soda, candy bars, etc. Just remember, there's plenty of time for those after the wedding.)
The next part of the plan in your diet for a wedding is to get to the gym and start working out. Lifting weights and adding some muscle helps to improve upon the physical appearance of the body. Not to mention, adding muscle increases the body's metabolic rate which allows for more calories to be burned. Add that to the decrease in the caloric intake described above and you'll start seeing differences almost immediately.
Where the first two steps mentioned will reduce your weight by creating fat loss, the final step to lose weight actually only deals with water weight loss. And although fat loss in itself is something more tangible, water weight loss is something that can happen in considering less time.
Sometimes you can feel fat or even look fat simply by being bloated or retaining water. Getting rid of the excess liquid can cause you to drop upward of 10 lbs in a week. To reduce weight resulting from bloating or water retention, be sure and reduce your sodium intake. Excessive salt in one's diet will cause the retention or bloating to occur.
Another option is to drink a large amount of cranberry juice. Cranberry juice is something of a diuretic and will essentially detoxify the body causing the waste products in liquid and solid form to exit almost immediately within a 24 hour period and continuously for several hours throughout the day in which the juice was consumed. These techniques offer just a few options in losing weight for a wedding. Now that you know how to diet for a wedding you can spend the rest of your time preparing for your future with the one you love.


text:
FRANCIS LANCELOTT, ESQ. Queens of England. Vol.1.
DOWNLOAD THE ONLY FULL EDITIONS of
FRANCIS LANCELOTT, ESQ.Queens of England. Vol.1.
page 473
addresses. That her love was no new flame, hut the outburst of that passion which her royal marriage had smothered but not extinguished, is evident by the following rather lengthy postscript to a letter addressed by lier to Seymour a few weeks after the death of Henry the Eighth.
" I would not have you to think that this mine honest good will towards you to proceed of any sudden motion of passion, for as truly as God is God, my mind was fully bent the other time that I was at liberty to marry you before any man whom I know, Howbeit, God for a time, through His grace and goodness, made that possible which to me seemed quite impossible ; that is, made me to utterly renounce mine own will, and to cheerfully follow His will. To write all the process of this matter would require much time and great space; therefore, if I live I shall declare it to you myself; and here only say as my lady of Suffolk sailh, God is a marvellous man.
" liy her that is yours to serve and to obey during her life. "KATHEKIXE THE QUEEX, K. P."
At this period, Katherine was residing at her commodious but not highly magnificent or ornamental jointure palace at Chelsea, on tbe bank of the Thames, which with its extensive grounds occupied the spot now known as the Cheync Pier. Here it was she held secret meetings with her captivating lover, who strenuously urged her to consent to their immediate marriage, as will be seen by the following letter, which, although without date, was evidently written in reply to one of his billet-doux at about this period.
"As I gather by your letter delivered to my brother Herbert, you are in some fear how to frame my lord your brother, to speak in your favour ; the denial of your request shall make his folly more manifest to the world, which will more grieve me than the want of his speaking. I would not wish you importune for his good will
if it come not frankly at the first, yet it shall he sufficient once to have required it, and afterwards to cease. 1 would desire ye might obtain tbe King's letters in your favour, and also the aid and furtherance of the most notable of the council such as ye shall think convenient, which thing obtained, shall be no small shame to your brother and loving sister in case they do not the like. My lord, where as ye charge me with a promise written with my own hand to change the two years into two months, I think ye have no such plain sentence written with my hand. I know not whether ye he a paraphraser or not, if ye be learned in that science it is possible ye may of one word make a whole sentence, and yet not at all times after the true meaning of the writer, as it appeareth by this your exposition upon my writing. When it shall be your pleasure to repair hither ye must take some pain to come early in the morning that ye may be gone again by seven o'clock, and so I suppose ye may come without suspect. I pray you let me have knowledge over night at what hour ye will come that your portress may wait at the gate to the fields for you. And thus with my most bumble and hearty commendations I take my leave of you for this time, giving yon like thanks for your coming to the court when I was there.—Prom Chelsea.
" I will keep in store till I speak with you my lord's large offer for Pausterne, at which time I shall be glad to know your further pleasure therein.
" l'y her that is, and shall be, your humble, true and loving wife during her life. " KATHERINE TUE QUEEN, Κ. P."
Although in the above letter Katherine rebuked Seymour for his importunity, she was unable to check his ardour or her own passion ; and ashamed, or perhaps alarmed, at the probable consequences of the indelicate haste of their proceedings, she contracted a clandestine marriage with her fourth husband, the only man, in all probability, she had ever really loved. The date of the marriage is unknown ; Burnet says " it was so soon, that if she had conceived


text:
Vitsebsk: political activist Taras Surhan sentenced to a year of preventive supervision
The reason for supervision is that the Vitsebsk activist Taras Surhan had been detained three times and convicted for participation in oppositional actions. The Chyhunachny District Court in Vitsebsk sentenced the activist to a year of preventive supervision.
Deputy commander of public security police of Chyhunachny district, Viktar Kokhtau, petitioned for restriction of freedom for the opposition activist.
The police representative stated that Taras Surhan, who has previous criminal record, hasn't mended his ways, consorted with oppositionists and started to take part in unsanctioned rallies.
The formal reason for supervision was the fact that in 2009 Taras Surhan was detained and punished for participation in actions with white-red-white flags three times.
Judge Sviatlana Varatynskaya supported the initiative of the policemen. As a result, Taras Surhan is to be under police supervision for a year. Now he does not have a right to leave Vitsebsk without authorization of police, he cannot leave his house from 10 p.m. to 6 a.m., visit shops, restaurants where alcohol is sold, and other public places.
Bear in mind that Taras Surhan was detained on 9 January when he was taking out the trash. Tsyhankova, Judge of the Chyhunachny district court in Vitsebsk, found him guilty of 'using obscene language'. This article is widely used in Belarus to arrest oppositionists to hide political motivations of repressions.
As said by the activist, he connects his arrest provocations against all oppositionists of Vitsebsk, after a white-red-white flag appeared on the top of the main Christmas tree.
34-year-old Siarhei Kavalenka was detained for that on 7 January. On 10 January, he was placed in pre-trial prison for two months on a decision of the prosecutor of Vitsebsk. A case under article 339, part 2 of the Criminal Code (repeated hooliganism, or committed by a group of persons, or connected with committing less serious bodily harm) was instigated against him. Under this article a punishment could be up to 6 years of imprisonment. On 12 January the oppositionist was released with a written undertaking not to leave the place.


text:
Acupressure May Decrease Preoperative Anxiety in Children
]]>Acupressure]]> is an alternative therapy that is closely related to ]]>acupuncture]]> . However, acupressure involves pressure stimulation to acupuncture points instead of the needle stimulation used in acupuncture. This type of technique is also closely related to a type of Asian massage, Shiatsu. This technique has been used in China and Japan for centuries and has been reviewed by Western medicine for uses in pain and nausea relief. Research is still being done to understand the full range of benefits of acupressure.
Researchers from the Yale University School of Medicine reviewed the effect of acupressure on children's pre-procedure anxiety. The study, published in Anesthesiology Analogs , found that acupressure could decrease the levels of anxiety in children about to undergo an invasive medical procedure.
About the Study
The small ]]>randomized trial]]> involved 52 children aged 8-17. The children were scheduled to have an ]]>endoscopy]]> or ]]>colonoscopy]]> with ]]>general anesthesia]]> . The participants were randomly divided into two groups. One group had acupressure between the eyebrows (at Extra-1 acupoint) before the procedure. The treatment was done with a self-adhesive bead that was applied by an acupressure specialist. The second group received a ]]>sham treatment]]> . Both the acupressure and the sham treatment were delivered 30 minutes prior to procedure.
Participants' anxiety was measured using a child anxiety questionnaire. The measurements were done at ]]>baseline]]> and 30 minutes after applying acupressure or sham treatment. The study also tracked the amount of anesthetic needed during the treatment. The participants that had acupressure reported a 9% reduction in anxiety, while the participants in the sham treatment had a 2% increase in anxiety. There was no difference between the groups in the need for anesthesia.
How Does This Affect You?
This was a very small study. Larger studies will need to be done to confirm the benefits found here. However, the treatment has no known negative side effects and the special self-adhesive bead does not need to be applied by a specialist. It is an easy and low-cost method to decrease a common problem.
Medical treatments can cause anxiety and stress for anyone. If your child is undergoing medical treatments, talk to your child's healthcare team about options to help your child through the process.
American Academy of Pediatrics
Kids Health
Acupressure. EBSCO Natural and Alternative Treatments website. Available at: http://www.ebscohost.com/thisTopic.php?marketID=15&topicID=114. October 2007. Accessed November 11, 2008.
Wang SM, Escalera S, Lin EC, Maranets I, Kain ZN. Extra-1 acupressure for children undergoing anesthesia. Anesth Analg . 2008 Sep;107(3):811-6.
Last reviewed November 2008 by ]]>Larissa J. Lucas, MD]]>
Please be aware that this information is provided to supplement the care provided by your physician. It is neither intended nor implied to be a substitute for professional medical advice. CALL YOUR HEALTHCARE PROVIDER IMMEDIATELY IF YOU THINK YOU MAY HAVE A MEDICAL EMERGENCY. Always seek the advice of your physician or other qualified health provider prior to starting any new treatment or with any questions you may have regarding a medical condition.
Copyright © 2007 EBSCO Publishing All rights reserved.


text:
There is such an abundance of exceptional distilleries and producers cropping up in the UK now that here at The Vineyard we wanted to give you the opportunity to taste the best of them. Each month throughout 2013 we are working with a different distillery to showcase the best of what Britain has to offer.
This month we introduce:
Black Cow Vodka is produced in Dorset and made from 100% cows' milk. This is a totally unique concept that farmer Jason Barber took from a nomadic Siberian tribe called Tuva who have been using milk from their herds for many centuries to then ferment and make a spirit.
Although the idea may sound crazy, it is actually quite simple – you begin by making cheese. During this process you will separate the milk into curds and whey. Jason will take the curds and send them off to be made into his award winning cheese. The whey, which is usually considered a by product and discarded, is fermented into something much like a beer using a very special strain of yeast that converts the natural sugar in the milk to alcohol. This is then distilled, triple filtered and then bottled.
Only 300 bottles are produced from each batch of this brilliantly hand crafted and artisan vodka. It has an amazing mouth feel, which lends itself well to enjoying on its own or also in cocktails. Here at The Vineyard we have created some fantastic cocktails using this brilliant vodka. Alternatively we recommend drinking it with Fever-Tree Mediterranean Tonic Water, plenty of ice and a slice of lemon.
Black Cow Martini – £13.00
Black Cow Vodka stirred with dry vermouth; garnished with a twist of lemon
Milk & Honey – £13.00
Black Cow Vodka shaken with honey, lemon, apple and clove syrup and egg white
David Coveney
Head Barman