text:
We are passionately driven to deliver the highest quality services with the utmost integrity. Our staff members have trained at Bumble University, Wella International, Vidal Sassoon Academy, Sebastian Professional, Hairdreams, and many others. As a team, we're regularly involved in classes, photo shoots, and various other projects that keep us current, unique, and inspired.
Filomena has been working with hair since 1999. She started at Wak Shack Salon as the manager before buying it and making it her own as B Parlor. Filomena loves working with a client's natural texture to find a style and color that perfectly suits the shape of the client's face. She's a Wella Master Colorist; which means you can trust your hair in her hands. Filomena gets inspiration from nature, all human cultures, and by taking advanced education classes and educating other stylists. Her favorite product is Bumble and Bumble Cityswept; it's perfect for that lived-in texture on medium to coarse textures.
Heather has been a member of the B Parlor team since 2001 and in the beauty industry as an aesthetician, makeup artist, and hairdresser since 1998. She is also a network educator for Bumble and bumble as well as a teacher for our assistant program. Heather has a large male clientele base and is known for her custom color creations for the ladies. She also has a special talent for fast and efficient waxing. Heather specializes in makeup applications where she takes pride in customizing classic looks. In her hairstyling, she loves to take inspiration from classic looks and interpret them into modern contemporary styles. Heather's dream product is Bumble and Bumble Dryspun Finish for the fullness and texture it gives to hair.
Emily has worked with hair since 1999 and has found her passion: creating up-dos. In Emily's estimation, the up-do is hair construction in its purest form and allows the highest creative freedom. She is equally enthusiastic about cutting hair; she sees the cut as a delicate balance of construction and destruction. She finds great inspiration in working with a client whose lifestyle and face shape gives her a blueprint to work from. When Emily creates an up-do, she absolutely loves using Bumble and bumble Holding Spray.
Claudia thrives around positive and creative people. She is constantly inspired by architecture and art all around the world. Since 2009 she has continued to flourish in her craft through advanced education, with color classes at Wella Professional, cutting classes at Vidal Sassoon and cutting, barbering & styling classes at Sebastian and Bumble & bumble. With her new found competitive edge she has begun to enter competitions, having fun every step of the way.
Follow Claudia's work on Instagram @hairby_claudiap
Janine has had her hands in hair at B Parlor since 2012. Inspired by everyone's own individuality and style, she loves everything from precise retro styles and bald fades to undone bobs and beachy layers. Since she has graduated our assistant program she looks forward to attending Bumble and bumble university once a year along with all our in-house education. "There is no point in falling in line when you can express yourself and what you love with how you look", says Janine. Guided by practicality, whether it's big and bold or smooth and beautiful Janine also tailors each color service to her client. Color, curly, short, long, faded or retro Janine will have you leaving the salon with the knowledge you need to confidently do your hair at home. Her favorite Bumble and Bumble product is the prêt-à-powder because it soaks up oil and extends any blow dry with volume and fullness.
You can follow Janine's work on Instagram @hairby_janinepaige
Noeleen has been working with hair since 1987 and worked in Ireland and Australia before making San Francisco her home. She has been a stylist in the Lower Haight for twenty years and is happy to be part of the B Parlor team. Noeleen has trained with Toni & Guy, Sebastian, and Wella. She is inspired by her co-workers, the seasons, nature, and culture, and she loves to work with natural hair texture and all hair colors from natural looks to the colors of the rainbow. Noeleen loves when people come to her with ideas and pictures to work with her to create a fantastic new look. Bumble and bumble Straight line is her favorite because it can be used to create smoother looks as well as tousled.
You can follow Noeleen's work on Instagram @noeleenbparlor
Catie is a recent SF transplant who really enjoys doing creative color services, precise barber cuts, facial waxing, blowouts and working with long hair. Catie is also Deva Cut certified and loves to help curly clients embrace their natural texture. Catie knew from a young age she wanted to be a stylist and began her training at age 18. Catie has always been passionate about her diverse clientele and making them look and feel their best. Catie really enjoys using the Bumble and Bumble Thickening line, such as Dry Spun and Thickening Hairspray, to really get a hold on a style, make it long lasting, and create a tousled look to her blowouts.
You can follow her work on Instagram @cutandcolorcatie
Justin is a stylist now! He joined the B Parlor family in 2015 as an apprentice and completed our apprenticeship program in August 2016. He started his career at The Aveda Institute while having a secret love affair with all things Bumble and bumble. Justin gathers inspiration from his passion for K-pop, and his adoration for deconstructed geometric shapes. Justin's go-to product is Bb Dryspun for its quick volumizing and matte finish fix - perfect for any situation.
You can follow Justin's work on Instagram @jpophair
After nearly a decade of being behind the chair, Sammy is thrilled to join the team at B Parlor. Sammy began her training at the San Francisco Institute of Esthetics and Cosmetology. During her studies, she developed a passion for dimensional hair color and a polished style. After completing her initial training she has embarked on training from Toni and Guy- London and bumble and bumble in-house education. Her favorite bumble and bumble product is thickening creme contour, which she uses frequently on a variety of styles from pixies to deconstructed waves.
You can follow her work on Instagram @sammystylessf
Michelle is from the Windy City and has been working in a salon since sweeping hair at her Mom's salon as a youngster. Michelle enjoys styling hair from classic curls to braids. She also has a passion for balayage, enhancing natural texture and creative colors; always with the focus on the client being at ease with their hair needs.
She loves working with the Bumble & Bumble Thickening line to create the perfect blow-out and uses Dry Spun to finish the look, creating instant texture and volume.
You can follow her work on Instagram @meshelldoeshair
Get an experience, not just a haircut. Maureen, the Lady Rawker herself from Los Angeles, loves her passion behind the chair, as she creates innovative, unique hairstyles, creative color and your personal fashion statement - from current to classic. Extensions and color correction, too. It's Maureen's mission to make you look and feel great, and one she takes very seriously. She is comfortable working with every sort of person imaginable, including you. 'Cause she's cool and fun like that. Need more convincing? Be our guest and book your appointment. Favorite products: Bb prêt powder, Bb Brilliantine for shine and Bb Surf Spray for grit.
You can follow her work on Instagram: @rare_hair_sf


text:
Cooking on the trail has always been an area of interest for me. Depending on the length of the trip and location I have ranged from carrying only Clif Bars in Costa Rica to cooking full shore lunches from freshly caught fish in the Boundary Waters. This week I am reviewing a cooking system that falls right in the middle of these two extremes. The Jetboil Flash is a super quick water boiling wonder that is perfect for turning dehydrated food pouches into the veritable trail gourmet food that they are.
Side note: I have eaten dehydrated food both on and off the trail and while it does taste better after a long day of hiking in the middle of nowhere, they still aren't bad when you are in a rush. I always keep a few on hand with my home emergency kit just in case.
The Jetboil Flash is designed to do one thing very well- boil water. In fact you can get 0.5 liters boiling in as little as 2.5 minutes. This cooking system consists of a fuel canister stand, stove with electric starter, and an insulated cooking mug that screws into the top of the stove. You can grab ahold of the side of it thanks to the insulation, and the flame logo on the side turns orange when the contents are hot. Like most modern stoves it runs off of the typical Iso-Butane canisters. Be careful as a full JetBoil is incredibly top heavy and you don't want to spill boiling water on you and cause a forest fire at the same time. That would be terrible.
The key to using the JetBoil Flash is to never actually cook anything in it, otherwise you end up with an impossible mess and food burned into the bottom of the cooking mug. Boil your water and pour it into your dehydrated food pouches, don't try to get fancier than that. Trust me, it isn't worth it.
There are a wide variety of accessories that can adapt the system to work more like a traditional setup- frying pans, larger pots, etc. I wouldn't recommend going this route though. You are better off with a traditional stove and a regular cook set, you will get a lot more value for your money.
If you are the kind of person that doesn't like to fuss about the camp kitchen, then the Jetboil Flash is perfect for you.
Weight: 14 oz (400 g) * System weight does not include pot support and fuel stabilizer.
Volume: 32 oz (1 Liter)
Boil Time: 16 oz (0.5 Liter) = 2 minutes, 30 seconds (avg over life of Jetpower canister)
Water Boiled: 12 Liters per 100g Jetpower canister
Dimensions: 4.1" x 7.1" (104 mm x 180 mm)
Quick Links
Jetboil Website
Jetboil at REI

subset: commoncrawl


text:
The NHS in Scotland is struggling to recruit and retain enough nurses. It's a UK wide problem and the causes are many. Certainly Holyrood has not shone in delivering the health service we all need. Poignantly in the SNP's own White Paper on Independence just three years ago the issue wasn't even acknowledged.
It is difficult to get the right skills mix on hospital wards. A mixture of appropriate and advanced trained nurses is needed. This has in recent years meant using unqualified staff called Health Care Assistants. It's clear there is a large gap between HCAs and Registered Nurses and the UK government has piloted the idea of having Nurse Assistants to bridge this gap.
There is no standardised curriculum as yet, and there is no support from the nursing colleges and regulators. This isn't necessary. I believe in the idea of bringing back Enrolled Nurses to the UK.
New Zealand is in ways more like Scotland than many European countries and the cultural links are strong. It is remote and so needs more than many countries to develop domestic capacity nursing. We could learn something from them about how post-Brexit Scotland will ensure we have enough nurses.
In recent years New Zealand's Conservative government has reintroduced Level 2 nursing otherwise known as enrolled nursing. A standardised 18-month curriculum can be completed for about £10,000. That means a nurse with much of the scope of current nurses in half the time and a third of the cost.
Given how much registered nurse time is devoted to issues such as hygiene, feeding, dressing changes and observations there is clearly a gap in the market to develop here.
It does not matter how often people dismiss the idea of enrolled nurses not being as broadly trained as current staff. The fact is we need numbers quickly with a standardised curriculum to deal with care of the elderly, mental health and acute care that consume so much of the health spend.
Scotland could roll out this programme by lifting that curriculum directly from New Zealand and work with the nursing college to have them on the register. Until then they would be confined to working within Scotland, which in the short term is no bad thing.
Enrolled nursing can recruit from many walks of life and the academic requirements are far less than for degree-level nurses. There would be nothing to stop enrolled nurses converting at a later date as has happened already in the UK some 15 to 20 years ago.
We need real proposals to solve problems. The ping pong of Holyrood over the indyref issue is becoming very tiresome. As conservatives we have to be radical in shaking up established practice and not simply playing to the crowd by increasing funding here and there and cutting taxes at the same time.
The SNP has failed as a government to ensure we have adequate nurse numbers, the Conservatives must rise above the policy doldrums and chart a new course for safely staffing the health service.


text:
Yay the weigh in this week was good! :) I came in at 92.4kgs. Woohoo! So my starting weight of 103.2kgs is now 10.8kgs lower!!!
I've had one person comment on my weight loss, my beautician. No-one else has said anything. I do like it when it's not mentioned (otherwise I kind of feel like a side-show) but at the same time, I wonder if I am physically changing that much.
A nice compliment happened at work recently: I wear a uniform at work and every two years we are eligible for a top up. I ordered a size 16 shirt and a size 18 shirt. The girl putting in the order said I was ridiculous ordering a size 18 and she wants to change it to a 16. It's sweet that she thinks I'm not huge.... but I'm worried my new shirts will be too tight lol
So it's a double edged sword ;)
Today I ate:
Protein drink
Burrito mix with tomato cheese and sour cream
2 tsp cream and 1 tsp ABC spread
Tuna patty with ranch dressing
1/2 Protein drink
Chicken and mushrooms with artichoke dip
Ham cheese and tomato omelette (bought)
Protein drink
Burrito mix with tomato cheese and sour cream
Eggs with leftover lamb kebab contents
Protein drink
Chicken and mushrooms with artichoke dip
Lamb kebab in Turkish bread (the proper fluffy stuff)
Protein drink
Shepherd's pie
Protein drink
3 tsp cream
Two eggs and bacon with tomato sauce
Ham cheese and tomato omelette (bought)


text:
Dexter - Complete Seasons 1-8 DVD £20.69 including free delivery using code XMASBOX10 @ zavvi
Dexter is a crime drama about Dexter Morgan, a man who leads a double life as an incredibly likeable forensics expert for the Miami Police Department and as an emotionless vigilante serial killer. Taught by his foster father to harness his lust for blood and killing, Dexter lives by his own strict moral code - he only kills murderers who can't otherwise be brought to justice. Dexter is a killer who grapples with fitting into society while, at the same time, he struggles with his inability to feel emotion. The irony of Dexter's life is that he works closely as a blood splatter analyst with the very people who hunt his kind - the homicide departments.


text:
DEARBORN, Mich., Sept. 20, 2012 – On Saturday, Sept. 22, Ford Motor Company and Henry Ford Health System will auction a fabulous, one-of-a-kind 2013 Ford Shelby GT500.
As part of its 2012 "Get Your Heart Racing" event and charity auction, Henry Ford Health System has once again called on the creative talents of Ford designer Melvin Betancourt. To thank the dedicated team at Henry Ford Health System that Betancourt credits with saving his life when he was treated for a serious heart condition, the designer has focused all of his talents on creating this very special edition 2013 Ford Shelby GT500.
This year marks the 45th anniversary of the legendary Shelby GT500. Ford is marking the occasion with the 2013 Shelby GT500 – the most powerful pony car ever with 662 horsepower and 600 lb.-ft. of torque and a top speed of more than 200 mph.
For Henry Ford Health System, Betancourt wanted to create a one-of-a-kind Shelby that was true to the spirit of the original, but with a modern, sophisticated level of performance and an appearance to match. The car features unique white exterior paint and contrasting white graphics. Twenty-inch white wheels add to a look that is nothing short of breathtaking.
The racing-inspired cockpit boasts special white leather Recaro seats stitched with a black contrast thread for a truly unique look to complete an overall design theme that is worthy of this legendary car's outstanding heritage. With uncompromised performance, handling and luxury, the 2013 Shelby GT500 will satisfy the most sophisticated and discerning automotive enthusiast.
"Even with his rich racing pedigree, it's hard to imagine what Henry Ford might have thought had he ever encountered such a massively powerful vehicle as the 2013 Shelby GT500," said John Felice, general manager for Ford and Lincoln Marketing. "However, we're fairly certain he'd be thrilled the car carries the Ford oval, and that this unique edition is being auctioned to support the critically important work of saving lives."


text:
Patent application title: Subnet Box
Anthony C. Fascenda (North Bethesda, MD, US)
Anthony C. Fascenda (North Bethesda, MD, US)
KOOLSPAN, Inc.
IPC8 Class: AG06F1516FI
USPC Class:
Class name: Electrical computers and digital processing systems: multicomputer data transferring computer-to-computer session/connection establishing network resources access controlling
Publication date: 2011-10-27
Patent application number: 20110264815
Sign up to receive free email alerts when patent applications with chosen keywords are published SIGN UP
The invention provides an external in-line device ("Subnet Box") placed
between a network and an access point to achieve secure Wi-Fi
communications without needing to modify the access point. The Subnet Box
comprises an embedded token and will authenticate users based on
pre-stored access rights. In at least one embodiment of the invention,
the Subnet Box comprises: a first communications port for intercepting
data packets communicated to and from a wired communications network; a
second communications port for intercepting data packets communicated to
and from a wireless access point, wherein the wireless access point is an
edge device of the wired communications network; a database comprising a
number of serial numbers each associated with a client token and a secret
cryptographic key; and a processor for determining whether a computing
device having a client token can access the wired communications network
via the wireless access point. The processor establishes a secure tunnel
between the computing device and the first communications port.
1-11. (canceled)
12. A method of facilitating authentication and security at an edge of a network, the method permitting both authorized and unauthorized clients to simultaneously connect to the same access point, the method not requiring physical modification of the access point, the method comprising the steps of: interposing an apparatus between a network and the network access point, the network access point not requiring modification; receiving, at the apparatus and from a client within a local area network, a packet comprising an packet type indicating an unauthorized client; determining a final destination for the packet; passing the packet to the final destination if the final destination is in the local area network; and denying the packet if the final destination is not in the local area network.
[0001] The instant application claims priority to U.S. Provisional Application No. 60/600,651 filed Sep. 8, 2003, the disclosure of which is incorporated herein by reference in its entirety. The instant application is a continuation-in-part of U.S. patent application Ser. No. 10/679,371, entitled "Localized Network Authentication and Security Using Tamper-Resistant Keys," filed Oct. 7, 2003, the disclosure of which is incorporated herein by reference in its entirety. The instant application is also related to copending U.S. patent application Ser. No. 10/679,268, entitled "Shared Network Access Using Different Access Keys," filed Oct. 7, 2003, and U.S. patent application Ser. No. 10/679,472, entitled "Self-Managed Network Access Using Localized Access Management," filed Oct. 7, 2003, the disclosures of which are both incorporated by reference in their entirety.
[0002] 1. Field of the Invention
[0003] The present invention relates to wireless networking, and more particularly, to an authentication and secure communication technique for Wi-Fi (IEEE 802.11) networks.
[0004] 2. Description of Related Art
[0005] A Wireless Local Area Network (WLAN) is generally implemented to provide local connectivity between a wired network and a mobile computing device. In a typical wireless network, all of the computing devices within the network broadcast their information to one another using radio frequency (RF) communications. WLANs are based on the Institute of Electrical and Electronic Engineers (IEEE) 802.11 standard, which designates a wireless-Ethernet specification using a variety of modulation techniques at frequencies generally in the 2.4 gigahertz (GHz) and 5 GHz license-free frequency bands.
[0006] The IEEE 802.11 standard ("Wi-Fi") enables wireless communications with throughput rates up to 54 Mbps. Wi-Fi (for "wireless fidelity") is essentially a seal of approval certifying that a manufacturer's product is compliant with IEEE 802.11. For example, equipment carrying the "Wi-Fi" logo is certified to be interoperable with other Wi-Fi certified equipment. There are Wi-Fi compatible PC cards that operate in peer-to-peer mode, but Wi-Fi usually incorporates at least one access point, or edge device. Most access points have an integrated Ethernet controller to connect to an existing wired-Ethernet network. A Wi-Fi wireless transceiver connects users via the access point to the rest of the LAN. The majority of Wi-Fi wireless transceivers available are in Personal Computer Memory Card International Association (PCMCIA) card form, particularly for laptop, palmtop, and other portable computers, however Wi-Fi transceivers can be implemented through an Industry Standard Architecture (ISA) slot or Peripheral Component Interconnect (PCI) slot in a desktop computer, a Universal Serial Bus (USB), or can be fully integrated within a handheld device.
[0007] When network packets are formed, they typically result from a process known as encapsulation. FIG. 4 shows the "layered" sequence of packet formation well known as the "protocol suite." See Richard Stevens, TCP/IP Illustrated, Vol. 1 (Addison-Wesley ISBN 0-201-63346-9). All network packets are typically identified by an Ethernet Header (150). The addition of 802.11 wireless functionality adds yet another layer below the link layer and is known as the 802.11 layer and this layer adds an additional 802.11 header (410). The Client Network Interface Card (NIC) (110) adds the 802.11 header (410) to the Ethernet packet and is used to transport the Ethernet packet across the wireless medium
[0008] On receipt of an 802.11 packet from an authenticated and associated Client NIC (110), the Access Point (140) will remove the 802.11 header (410) and place the remaining packet on the Ethernet cable (150). The Ethernet packet stripped of its 802.11 header is placed on the LAN as if the Client PC were directly connected on the LAN instead of being bridged by the combination of Client NIC (110) and Access Point (140). This process of stripping headers is known as "de-multiplexing". As seen in FIG. 1, the 802.11 network (WLAN, 130) comprises at least one Access Point (140) attached via Ethernet cable (150) to the wired network (LAN, 190). The Access Point (140) provides a wireless bridge for connecting clients PCs (120) to the LAN, 190. The process of connection when security is not invoked is for the client NIC (110) to perform an Open Authentication to the Access Point (140). As the authentication is "open", any Client will be automatically authenticated. The Access Point (140) grants permission to the Client NIC (110) to "associate" to the Access Point (140). The Client NIC (110) then "associates" to the Access Point (140) and the Client's PC (120) is now "bridged" to the LAN (190).
[0009] The process of bridging involves the Access Point (140) to manage the wireless traffic and remove the 802.11 header (410) placing the packet on the Ethernet cable as if the Client PC (110) were "hard-wired" to the network. In the case of Wired Equivalent Privacy (WEP) security, the process is identical except that the 802.11 authentication type is changed from "open" to "WEP` and the predefined WEP parameters are used by the NIC (110) to encrypt communications from the Client PC (120) to the Access Point (140). The Access Point (140) decrypts all packets coming from the Client PC (120) using the pre-defined WEP parameters. Turning on WEP encryption prevents and Client NIC (110) not using the exact WEP parameters from connecting to the Access Point (140) and gaining access to the network (190). The WEP parameters thus are employed both for authentication and encryption purposes.
[0010] The Access Point (140) maintains the relationship between itself and the Client NIC (110) by means of the Client's MAC address (105). The Client's MAC address is the mechanism by which a Client's connection is managed by the Access Point (140). The Access Point (140) typically employs WEP security, a software algorithm that is used both for authentication purposes and to provide wireless link security. If WEP is turned on in the Access Point (140), no other users can connect to the Access Point without WEP turned on in their Client NIC (110) and the proper WEP parameters matching those in the Access Point turned on as well. This issue makes it impossible to support both people who desire security and those who do not at the same time.
[0011] The Institute of Electrical and Electronic Engineers (IEEE) has announced improvements to the security processes utilized in the 802.11 specifications. These improvements are known as Wireless Protected Access (WPA) and WPA2. Both improvements provider a greater degree of security over WEP, but still do not permit both secure and non-secure Clients to connect to the same Access Point. WPA2, in particular, requires new Access Point hardware and new Client NIC cards to be purchased by users who desire to use the improved WPA2 security. While a WPA2 Access Point will support WEP clients, it cannot support both WPA2 and WEP-based clients at the same time.
[0012] There are three typical types of authentication that are available for use with 802.11b networks: Open system; Shared Key; and IEEE 802.1X.
[0013] Open system authentication authenticates all wireless nodes using the Client NIC MAC Address (105), its wireless adapter hardware address. A hardware address is an address assigned to the network adapter during its manufacture and is used to identify the source and destination address of wireless frames.
[0014] For infrastructure mode, although some wireless APs allow you to configure a list of allowed hardware addresses for open system authentication, it is a fairly simple matter for a malicious user to capture frames sent on your wireless network to determine the hardware address of allowed wireless nodes and then use that hardware address to perform open system authentication and join your wireless network.
[0015] For ad hoc mode, there is no equivalent to configuring the list of allowed hardware addresses in Windows XP. Therefore, any hardware address can be used to perform open system authentication and join your ad hoc mode-based wireless network.
[0016] Shared key authentication verifies that the wireless client joining the wireless network has knowledge of a secret key. During the authentication process, the wireless client proves it has knowledge of the secret key without actually sending the secret key. For infrastructure mode, all the wireless clients and the wireless AP use the same shared key. For ad hoc mode, all the wireless clients of the ad hoc wireless network use the same shared key.
[0017] The IEEE 802.1X standard enforces authentication of a network node before it can begin to exchange data with the network. Exchanging frames with the network is denied if the authentication process fails. Although this standard was designed for wired Ethernet networks, it has been adapted for use by 802.11b. IEEE 802.1X uses the Extensible Authentication Protocol (EAP) and specific authentication methods known as EAP types to authenticate the network node.
[0018] IEEE 802.1X provides much stronger authentication than open system or shared key and the recommended solution for Windows XP wireless authentication is the use of EAP-Transport Level Security (TLS) and digital certificates for authentication. To use EAP-TLS authentication for wireless connections, you must create an authentication infrastructure comprising of an Active Directory domain, Remote Authentication Dial-In User Service (RADIUS) servers, and certification authorities (CAs) to issue certificates to your RADIUS servers and wireless clients. This authentication infrastructure is appropriate for large businesses and enterprise organizations, but is not practical for the home or small business office.
[0019] A solution to the use of IEEE 802.1X and EAP-TLS for the medium and small business is being developed. Windows XP Service Pack 1 and the Windows .NET Server 2003 family will both support Protected EAP (PEAP) and the Microsoft Challenge-Handshake Authentication Protocol, version 2 (MS-CHAP v2) EAP type. With PEAP and MS-CHAP v2, secure wireless access can be achieved by installing a purchased certificate on a RADIUS server and using name and password credentials for authentication.
[0020] Hot Spots typically provide no wireless link security. This is due to the fact that there is no mechanism for managing "keys" for transient users. The existing technology is vulnerable to hackers and the newer technology will not allow AES encryption to be run in the same Access Point as WEP-enabled customers. Hot Spots are faced with a situation wherein they cannot deploy the newer security technology as it means they will lose existing customers unless their customers also upgrade to the newer technology.
[0021] "Koolspan" functionality provides for mutual authentication of both the Client and the Network Edge device, typically an Access Point based on secure, tamper-resistant tokens on both sides of the wireless link. The modifier "Koolspan" refers to the authentication and secure communication technique(s) disclosed in U.S. patent application Ser. Nos. 10/679,371; 10/679,268; and 10/679,472, the disclosures of which are incorporated by reference in their entirety. As a product of this authentication process, a "Session Key" is independently generated on both sides of the link that is used to secure communications across the link for the duration of the session. Typically, the Access Point software is modified to provide for Koolspan authentication and to read an attached Koolspan token. Since this functionality requires modification of the Access Point software and an available port into which the token can be attached, not every Access Point can directly support Koolspan functionality. Existing wireless networks implement WEP security, the original security standard for 802.11 networks. This security mechanism is not safe and can be easily cracked. Newer technologies such as WPA and WPA2 are more secure, but will require new Access Points to be deployed and or new Network Interface Cards (NIC) for the user to install. It is highly desirable, therefore, that a means be provided that would allow the network to achieve Koolspan functionality without requiring the Access Points to be modified or replaced.
[0022] The present invention provides an external in-line device ("Subnet Box") placed between the network and the access point to achieve Koolspan functionality without modifying the Access Point. Much like a dual-Ethernet ported firewall, the Subnet Box contains an embedded Koolspan token and will authenticate users based on pre-stored access rights.
[0023] In an embodiment of the invention, a method of facilitating authentication and security at an edge of a network is disclosed comprising the steps of: receiving a data packet; determining whether a source identifier exists in said data packet; and if the source identifier exists, retrieving a cryptographic key from local storage associated with the source identifier, and decrypting a portion of the data packet using the identified cryptographic key, and directing the data packet toward its recipient. The step of retrieving comprises the steps of: identifying a match to the source identifier, e.g., MAC address, within a pre-stored list of source identifiers; and loading a cryptographic key associated with a matching source identifier from the pre-stored list of source identifiers. If the source identifier doesn't exist, the method comprises identifying whether the data packet is a pass-through data packet, and then either directing the data packet toward its recipient if the data packet is identified as a pass-through data packet, or dropping the data packet if the data packet is not identified as a pass-through data packet.
[0024] In another embodiment of the invention, an apparatus is disclosed comprising: a first communications port for intercepting data packets communicated to and from a wired communications network; a second communications port for intercepting data packets communicated to and from a wireless access point, wherein the wireless access point is an edge device of the wired communications network; a database comprising a number of serial numbers each associated with a client token and a secret cryptographic key; and a processor for determining whether a computing device having a client token can access the wired communications network via the wireless access point. The processor establishes a secure tunnel between the computing device and the first communications port.
[0025] An advantage of the invention is that it provides an external solution that enables a totally secure tunnel across the wireless link, thereby allowing secure transmissions between the Subnet Box and the connected Client regardless of the intervening Access Point. Another advantage of the present invention is that it allows existing customers without a Koolspan token to "pass-through` the Subnet Box without security as before.
[0026] Another advantage of the invention is that it implement an authentication and wireless security technique at the edge of the network without requiring modification of the Access Point software/hardware. The invention works with all flavors of 802.11: "a", "b", "g" etc. and provides automatic security without needing to distribute keys across a wired or wireless network.
[0027] The foregoing, and other features and advantages of the invention, will be apparent from the following, more particular description of the preferred embodiments of the invention, the accompanying drawings, and the claims.
[0028] For a more complete understanding of the present invention, the objects and advantages thereof, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:
[0029] FIG. 1 illustrates a conventional Wi-Fi network;
[0030] FIG. 2 illustrates a Wi-Fi network implementing a Subnet Box according to an embodiment of the invention;
[0031] FIG. 3 illustrates Subnet Box functionality according to an embodiment of the invention;
[0032] FIG. 4 illustrates a conventional encapsulation protocol stack;
[0033] FIG. 5 illustrates packet types according to an embodiment of the invention;
[0034] FIG. 6 illustrates a client driver according to an embodiment of the invention;
[0035] FIG. 7 illustrates "Koolspan" client packets according to an embodiment of the invention;
[0036] FIGS. 8a-c illustrate processes implemented by the Subnet Box according to an embodiment of the invention;
[0037] FIG. 9 illustrates a process implemented by the Subnet Box according to an embodiment of the invention;
[0038] FIG. 10 illustrates an authentication process according to an embodiment of the invention; and
[0039] FIG. 11 illustrates a Subnet Box according to an embodiment of the invention.
[0040] Preferred embodiments of the present invention and their advantages may be understood by referring to FIGS. 2-3 and 5-11, wherein like reference numerals refer to like elements, and are described in the context of a Wi-Fi network. Nevertheless, the present invention is applicable to wired and wireless communication networks in general.
[0041] The objects of the present invention are as follows: first, to implement Koolspan functionality across the wireless link (User(AP)→a Subnet Box) using any 802.11-compliant Access Point without modification and second, to provide a facility that provides wireless link encryption for Koolspan-enabled clients and at the same time allowing non-Koolspan clients to pass through to the network across the wireless link.
The Koolspan technique is an improved method of authentication and security that provides a secure Wi-Fi communications method and system employing a combination of physical keys, or tokens, that attach to existing computing devices and wireless access points. These keys are typically connected via a USB port, although other types of connections, e.g., Ethernet, PC-Card, serial, parallel, and the like may be employed. In overview, each component of the Wi-Fi network employs a physical key. For example, a client key is used to enable wireless connections on a user's computing device. An access point key ("AP key") is used to activate at the access point the secure Wi-Fi functions described herein. Moreover, a master key is provided to enable and administer secure authentication and communications on the network. Each key comprises a serial number, which is forever unique, and must be unlocked using a personal identification number (PIN) known only to the owner, i.e., user, of the key. This PIN can be changed by the owner at any time.
[0042] Each physical key comprises a common network send ("NKS") and a common network receive ("NKR") cryptographic key used only during the authentication phase by all components on the LAN. Each physical key further includes a unique secret cryptographic key used in the second step of the authentication process. There is no mathematical relationship between key serial numbers and either the network send or network receive cryptographic keys, and the unique secret cryptographic key. The authentication process results in two random numbers that are known by both sides of the wireless channel and are uniquely generated per communications session. For example, when a client connects to an access point, the authentication process results in two unique random numbers being generated (one on each side of the connection). Only the random numbers are sent across the wireless channel and in each case these numbers are encrypted.
[0043] A transposed cryptographic key is used to encrypt all communications across the wireless channel between client and access point on behalf of the user. The transposed cryptographic key is preferably a 32-byte (256-bit) key generated using the random numbers generated during authentication and the client's secret cryptographic key. Using the serial number of the client's physical key, the access point knows the client's secret cryptographic key. Thus, both sides of the wireless channel know the secret key without it ever being transmitted between the two. The two random numbers are used to scramble the secret cryptographic key to generate a transposed version, which is finally used by both sides for secure data transmission after authentication.
[0044] Referring to FIG. 2, the Koolspan authentication and security technique is implemented in an in-line device (160) called a "Subnet Box" that is inserted in between the Access Point (140) and the network (190). This technique does not require an authentication server, certificate server or any other network support.
[0045] In an exemplary embodiment of the invention, the Subnet Box comprises several hardware components as seen in FIG. 11. These components include an field programmable gate array (FPGA) (1200) (e.g., an Altera FPGA), a Smart Card (1210), (2) Ethernet transceiver integrated circuits (1240/1260), two Ethernet ports (1250/1270), flash memory (1220) and synchronous SRAM memory (1230) integrated circuits. Additional interface components are also added to the design. The Subnet Box can be powered over Ethernet (POE) according to standard, well-known techniques (1260) or powered by an external AC adaptor (1230).
[0046] As seen in FIG. 11, the block diagram of the Subnet Box, there are two Ethernet Ports. The wireless Access Point is connected to the first Ethernet Port (1270) and the Subnet Box is connected to the Network through the second Ethernet Port (1250). All packets sent from clients destined for the network must pass through the Subnet Box.
[0047] The FPGA (1200) acts as a control element of the Subnet Box. An Altera FPGA is a field-programmable gate array comprising approximately 6,000 logical elements. The internal configuration of the Altera Chip is programmed according to the desired hardware functionality. The Altera FPGA (1200) internal sub-sections are configured to include the NIOS 32-bit processor (1201), AES Crypto Engine (1203), a memory bus interface (1204), a Smart Card interface (1202) and a PCI-bus interface (1205).
[0048] The NIOS processor (1201) executes firmware instructions contained within the Flash Memory (1220) as interfaced through the Memory Bus Interface (1204). External data storage is provided in the Sync SRAM IC (1230). The NIOS processor (1201) reads the Smart Card data through the SIM I/F interface (1202) and processes Ethernet packets coming to/from the wireless Access Point through Ethernet Port (1270) via the Ethernet Transceiver IC (1260). The hardware interface to the Ethernet Transceiver IC (1260) is via the Altera FPGA (1200) PCI Interface (1205). Ethernet packets to/from the wired network are interfaced similarly via the Ethernet Transceiver IC (1240) and physical jack (1250).
[0049] While an Altera FPGA IC (1200) has been implemented in the preferred embodiment, an entirely different hardware configuration may be utilized to the same effect.
Subnet Box Functionality
[0050] As seen in FIG. 2, all packets to/from the Client's PC (120) via the Client NIC (110) must go through the Subnet Box (160) before reaching the wired Ethernet network (190). The Access Point (140) is configured without WEP security and is left in "open" mode; that is, any 802.11 Client NIC (110) can authenticate and associate to the Access Point (140). All Client PCs (120) will be authenticated and bridged onto the Ethernet cable (150). Any Ethernet packet that is sent from the Client NIC will be `bridged` onto the Ethernet cable (150) attached to the Access Point (140). The function of the Subnet Box is to permit Koolspan Client NICs (110) to establish a secure "tunnel" between the Client's PC (120) and the Subnet Box (160) providing security across the wireless 802.11 network. All traffic to/from the Client's PC (120) is encrypted using secure keys.
[0051] In the preferred embodiment, the secure keys are stored in a secure, tamper-resistant Smart Card (128) inside a Koolspan Token (125). The token is attached to the Client PC via one of many interfaces (USB port, Parallel port, Serial Port etc.) The secure keys are never exchanged or transmitted and are thus impervious to sniffing across the wireless network.
[0052] As seen in FIG. 3, the Subnet Box comprises two Ethernet ports. The first Ethernet port (305) is attached to the Ethernet cable (150) that is connected to the Access Point (140) in FIG. 2. The Ethernet port is identified by its MAC Address (300), a 48-bit hardware address whose function is well understood by one of ordinary skill in the art. Similarly, a second Ethernet port (315) is found on the Subnet Box that is attached to the Wired Ethernet Network (LAN, 190) in FIG. 2. Packets input on the Ethernet port (305) must be processed internally within the Subnet Box (160) before appearing on port (315) and then going onto the network (190).
[0053] The Subnet Box further contains a KEY DATABASE (340) that is uploaded securely by a Key Management Program. The KEY DATABASE contains, by example, all of the SERIAL NUMBERS of authorized Client Tokens (125) and their encrypted Secret Key (NK_UIDs). Additional parameters may be stored in the Key Database (340) such as STATUS, PRIORITY etc.
[0054] The Subnet Box further maintains a table (330) containing a list of all active Client sessions. Entries in this table are made from time to time as individual Clients are authenticated in the Subnet Box. This table (330) contains the Client NIC's MAC Address(105), Client Token (125) Serial Number and AES Session Key among other parameters.
Koolspan Protocol
[0055] As seen in FIG. 7, Koolspan packets are formed by setting the TYPE field (530)="Koolspan" within the Ethernet Header (150). The next eight bytes of the data portion of the Ethernet packet are used as the Koolspan Protocol Header (KP) as seen in FIG. 7. The Koolspan Protocol Header (720) contains various parameters (740) such as KOOLSPAN_TYPE. The setting of "KOOLSPAN_TYPE` defines how the rest of the Ethernet packet is constructed.
[0056] There are three currently defined KoolspanTypes.
[0057] Type=KEP AES Encrypted IP data;
[0058] Type=KMP Koolspan Management Protocol; and
[0059] Type=KAP Koolspan Authentication Protocol.
Client NDIS Intermediate Driver
[0060] In a preferred embodiment, as shown in FIG. 6, an NDIS Intermediate Driver (630) is placed in the driver stack of the operating system, e.g., Microsoft Windows Operating System. The purpose of this NDIS Intermediate Driver (630) is to intercept packets to/from the network at the appropriate level. In non-Koolspan mode, when the Client Key is NOT inserted, the NDIS Intermediate Driver (620) operates in pass-through mode (640) whereby all packet between the LAN Protocols component (660) and the NDIS Device Driver (620) are untouched.
[0061] When the Koolspan Key is first inserted, the NDIS Device Driver (620) for the wireless NIC (110) will perform an "open authentication" followed by an "association" with the Access Point as previously described. On completion of the "association", the NDIS Device Driver (620) will trigger an event message that is passed up the stack to signify that association is complete and the Client's PC is now on the network. As the Koolspan Client Key has been inserted, the NDIS Intermediate Driver (630) is now intercepting all packets between the LAN Protocols (660) and the NDIS Device Driver (620). The NDIS Intermediate Driver (630) will now attempt to perform a Koolspan Authentication wherein a Koolspan Authentication Packet is formed by the NDIS Intermediate Driver (630). As the Access Point (140) is acting now in bridge mode, all packets received are simply passed onto the Ethernet Cable (150) where they are received first by the Subnet Box (160).
[0062] As seen in FIG. 5, all Ethernet packets comprise a DESTINATION_MAC_ADDRESS (SIO), a SOURCE_MAC_ADDRESS (520) and a TYPE field (530) that precede the data portion of the packet (540). The MAC addresses are 48-bit fields that identify a unique hardware address of a node on the network. The TYPE field is used to determine how to process the data portion (540). Well known packet types are as follows:
TABLE-US-00001 TABLE 1 Ethernet Packet Types FIG. 5 Name Type Description 550 ARP 0806 Address Resolution Protocol 560 RARP 8035 Reverse Address Resolution Protocol 570 IP 0800 Normal IP Traffic 580 Koolspan "koolspan"1 Koolspan Packet 1Koolspan Type to be subsequently provided by the Internet Authority Naming Association (IANA).
[0063] Koolspan uses a well-defined fourth type (type="Koolspan") to distinguish Koolspan packets from other well-known packets (550/560/570). In forming a Koolspan first authentication packet, the Ethernet Header Type (530) is set to Koolspan and the DESTINATION_MAC_ADDRESS (510) is set to "FF:FF:FF:FF:FF:FF". This initial setting will ensure that the Access Point "broadcasts" this first authentication packet to all locally connected nodes attached to the Access Point. The Subnet Box will be the only device locally attached to the Access Point that will respond to a Koolspan First Authentication Packet and will respond as shown in the flow chart, FIG. 8. When responding to the authenticating Client NIC (110), the Subnet Box will set its SOURCE_MAC_ADDRESS to that of its Access Point Ethernet Port (300) (hardware address)
[0064] The Subnet Box software is designed to intercept all packets of the Ethernet Type="Koolspan" including "Authentication Packets". There are several other types of Koolspan packets including "Management" and "Discovery" packets as well as "Koolspan Encryption" packets (the most common packet type for sending AES encrypted data during a session).
Subnet Box Packet Processing: Wireless Side Processing
[0065] Note the Subnet Box has two Ethernet Ports, one attached to the Access Point (300) and one attached to the LAN (wired network) side (310) as seen in FIG. 3. The Subnet Box further has an embedded Smart Card (165) that is provisioned with three keys: [0066] NKS--Network Send Key [0067] NKR--Network Receive Key [0068] NK_UIDs--Secret Key
[0069] The NKS key is the mirror of the Client's NKR key and the NKR key is the mirror of the Client's NKS key. In this manner, data encrypted by the Client with his "SEND" key (NKS) can be decrypted with the Subnet Box's RECEIVE key (NKR).
[0070] In the preferred embodiment of the invention, the Subnet Box processes packets of data according to the series of flowcharts seen first in FIG. 8a.
[0071] On receipt of any wireless packet step 800, the Subnet Box will know from the Ethernet Header (150), the SOURCE_MAC_ADDRESS (520) of the Client NIC (110). This address will be saved temporarily. The Ethernet Header (150) will be examined further to determine the packet TYPE (530) in step 810. If the packet type is non-Koolspan (ARP (S O), RARP (560) or IP (570)), the Subnet Box will check its current configuration to see if unencrypted packets are allowed to pass through, step 812. If not, the packet will be dropped step 814. If "pass-through" is permitted, the packet will be sent, step 816, to the LAN via the LAN-PORT (165) of the Subnet Box.
[0072] If the Ethernet Header TYPE field (530) is set to Koolspan, the Subnet Box (165) will examine the next eight bytes as a Koolspan Protocol Header (KP) (720). Within the KP header, is a "KOOLSPAN_TYPE` field that can have one of several values: 1. Authentication; 2. Management; and 3. Encryption.
[0073] The KOOLSPAN_TYPE field is discovered in step 825.
Koolspan Authentication Protocol
[0074] If the KOOLSPAN-TYPE is "Authentication", the Subnet Box (165) will examine the data portion of the Ethernet packet (730) as an "authentication packet" (700). The First Authentication Packet is generated by the Client NDIS Intermediate Driver (630) and is formed as shown in FIG. 7. After the Ethernet Header (150), the data portion of the Ethernet packet comprises a Koolspan Protocol Header (720) whose internal structure is shown in the diagram (740). The Koolspan Protocol Header (KP) (720) is followed by a Koolspan Authentication Packet Header (KAP) (710)
[0075] The KAP (710) includes several fields shown by example (700) including the authentication version, KOOLSPAN_TYPE etc. The Subnet Box (160) will process the data portion of the packet that contains the appropriate encrypted Koolspan authentication data formed by the Client NDIS Intermediate Driver (630).
[0076] The Subnet Box will begin processing the First Authentication Packet step 827, by decrypting the authData (shown in 700) with the Subnet Box's NKR (Receive Key), step 860, contained within the Subnet Box Smart Card. The structure of an Authentication Packet is shown by example in step 855. Various checks are made to determine if the packet has been altered. In step 865, the Serial Number of the Client's token (125) is used to retrieve the Client's Secret Key (NK_UIDs) from the Subnet Box Database (340) of previously stored Serial Numbers and matching encrypted Secret Keys (NK_UIDs). If the serial number does not exist in the Subnet Box Database (340) an error message, step xxx, is returned to the Client. If the serial number is found in the Subnet Box Database (340), then the Client's NK-UISs is retrieved from the Subnet Box Database (340) and the hash is computed on the received data, step 868, and compared, step 869, against the received signature, step 862. If the signatures do not match, an error message is returned to the Client, step 870 and further processing stops.
[0077] If the signature match, a new entry is made in the Subnet Box Client Table (330), step 880, The entry into this table (330) contains the Client MAC Address (105) recovered from the Ethernet Header (520), the Client Token (125) Serial Number and eventually the AES Session Key when computed in step 890.
[0078] The Subnet Box will continue processing the AuthData recovering the Random Number (R1) by decrypting the internal packet data with the Client's NK_UID recovered from the Subnet Box Database (340) using the Client Key (125) Serial Number step 882. A second random number (R2) is computed, step 884, and concatenated with R1 and then encrypted with the Client's secret key (NK_UIDs), step 886. The ciphertext is then encrypted this time with the Subnet Box's SEND Key (NKS) and the ciphertext is placed into the "authData" field of the Koolspan Authentication Packet (700) and the appropriate parameters are set in the Koolspan Authentication Header to indicate this is the Second Authentication Packet and the entire packet is returned to the Access Point for transmission to the Client via the Client's MAC Address, step 892.
[0079] The Access Point, now acting as a bridge, delivers the Koolspan Second Authentication Packet to the Client, step 1105. The construction of the packet data is shown, by example, in step 1100, FIG. 10. Referring to FIG. 10, The authData of the Authentication Packet (700) is decrypted by the NDIS Intermediate Driver (630) step 1110 yielding the encrypted R1:R2 numbers and the signature. The encrypted R1:R2 numbers are then decrypted with the Client Token's (125) RECEIVE KEY (NKR), step 1130, yielding the unencrypted R1:R2 combination. A signature is computed from these two numbers, step 1140, and compared against the received signature, step 1150. If a match is not found, the error is reported to the user, step 1160, and processing terminates leaving the client blocked from sending further packets through the Subnet Box.
[0080] If a match is found, then the NDIS Intermediate Driver will conclude that the Koolspan Authentication process has been successful and will compute the AES Session Key from the two random numbers R1, R2, step 1180 and save the AES Session Key for further use during the session. All further communications between the Client and the Subnet Box will subsequently be encrypted with the AES Session Key. Additionally, the Client NDIS Intermediate Driver (630) will note the SOURCE_MAC_ADDRESS (520) of the Subnet Box that is returned in the Ethernet Header (150) of the Second Koolspan Authentication Packet. All further Koolspan-enabled communications between the Client NDIS Intermediate Driver will be specifically addressed to the MAC Address of Subnet Box Access Point port (300).
[0081] If, in fact, the Client has been authenticated, then when sending network traffic of any kind, the Client NDIS Intermediate Driver (630) will encapsulate all of the fields of a normal Ethernet packet (IP header, TCP header, Application Data, Ethernet trailer with the exception of the Ethernet Header) as shown in FIG. 4, encrypting this data with the Client's AES Session Key. The Koolspan Protocol Header will set the KOOLSPAN_TYPE to Koolspan Encrypted Protocol (KEP) and the Ethernet Header Type will be set to Type="Koolspan".
[0082] On receipt of a type KEP Koolspan packet, processing will he directed to step 828 as shown in FIG. 8c. The Ethernet Packet Header will reveal the SOURCE MAC ADDRESS of the Client (105). The SOURCE_MAC_ADDRESS will (520) will be used to see if there is an entry in the Subnet Box NETWORK TABLE (330). If there is no entry for that SOURCE_MAC_ADDRESS (520), step 900, an error message will be returned to the Client NIC (110), step 910, and the packet will be dropped, step 912. If the SOURCE MAC ADDRESS (520) is found in the Network Table (330), it will then be used to retrieve the AES Session Key from the Network Table (330). The AES Session Key is then used to decrypt the Koolspan Data field resulting in a normal Ethernet Data Packet (non-Koolspan type). This packet is then directed appropriately to either the normal LAN port (310) or the Access Point port if the routing indicates the recipient also resides on the wireless side of the Subnet Box.
[0083] In the case of an inbound packet destined to be returned to another Koolspan-enabled Client on the wireless side of the Subnet Box, the plain-text packet, step 906, must now be encrypted with the recipient's AES Session Key for transmission to the recipient. If the recipient is not Koolspan-enabled and "pass-through" mode is enabled, the packet is simply sent normally without encryption. If "pass-through" mode is not enabled, the packet is dropped.
[0084] All AES-encrypted Koolspan packets are directed to the Subnet Box (165) using the Subnet Box's MAC address (300). This is necessary to ensure that all packets regardless of their destination be first decrypted in the Subnet Box before they are sent to their destination.
[0085] The reason this is necessary is that if two clients attempt to communicate on the same wireless side of the Access Point, the Access Point will simply route the received communications from the sending client to the receiving client as the Access Point routing table will not forward the packets to the Ethernet Port of the Access Point but instead retransmit the packet wirelessly. By forcing all packets to go directly to the Subnet Box regardless of their ultimate destination, this ensures that proper authentication and security are always maintained.
[0086] The Subnet Box (160) can be configured to allow both non Koolspan-enabled Clients to communicate as well as Koolspan-enabled Clients. This method of allowing non Koolspan-enabled Clients to communicate is known as "pass through" mode.
[0087] In "pass through" mode, the Ethernet Packet Header Type field (530) indicates a non-Koolspan TYPE. On determination that "pass through" mode is enabled, the packet is allowed to pass through. It's final destination, however, determines how the packet is transmitted in the outbound direction.
[0088] If the packet was received on the Access Point side of the Subnet Box, Ethernet Port (300), and the destination is on the LAN side (310), the packet will simply be let through the Subnet Box (165) without further processing. If however, the destination is on the same Access Point side (300) i.e., another wireless Client connected to the same Access Point, further processing is required. If the destination Client is non-Koolspan enabled and "pass through" mode is enabled, the Subnet Box will simply pass the packet through to the Access Point via the Access Point Ethernet Port (300). If the destination Client is Koolspan-enabled, the packet must be encrypted using the destination Client's AES Session Key with an appropriate Koolspan KEP header and Koolspan KP header pre-pended to the packet.
[0089] This dual-use mode allows the possibility of both Koolspan-enabled Clients and non-Koolspan-enabled Clients to communicate on a wireless network. Koolspan-enabled Clients are provided automatic AES security across the wireless link whereas non-Koolspan-enabled Clients may be either denied access entirely (pass-through mode disabled) or provided non-secure access (pass-through mode enabled).
[0090] The technology described herein provides an end-to-end security link. In the preferred embodiment, the network is wireless, but in other embodiments the end-to-end link (client-to-subnet box) might not involve any wireless components.
[0091] The present invention provides a technique for automatically detecting both non-Koolspan clients and Koolspan-enabled clients and thus providing both protected communications for Koolspan-enabled clients and normal (non secure) communications for non Koolspan-enabled users simultaneously. Wireless link security can be provided in a public hotspot by the simple addition of an inline Koolspan Subnet Box providing automatic wireless link security without affecting existing non-Koolspan-enabled users.
[0092] Other embodiments and uses of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. Although the invention has been particularly shown and described with reference to several preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims.
Patent applications by Anthony C. Fascenda, North Bethesda, MD US
Patent applications by KOOLSPAN, Inc.
Patent applications in class Network resources access controlling
Patent applications in all subclasses Network resources access controlling
User Contributions:
Comment about this patent or add new information about this topic:


text:
Thursday, November 6, 2014
Baby Bennett's Diaper Bag
8 comments:
The bag looks great and I need to make one. My daughter is having my third grandchild and this time it is a girl.ReplyDelete
Very cool diaper bag! The pockets inside and out will come in handy!ReplyDelete
Great diaper bag! Lots of great pockets! I deliberated long and hard about making one for myself, but opted to take the easy road and order one on-line in favour of finishing the babies' quilts!ReplyDelete
Great bag! I need to make one of these for a shower gift ASAP!!ReplyDelete
Love it! Cool fabric choices!ReplyDelete
This is a great article. I've read in manyReplyDelete
other places before that but
I did not get this type of effective and
more useful text. It is really important now to
vary your anchors as this seems more natural to user.
This article helped me a lot to understand information.
So, I go awol for a few weeks and I come back and you have made a bazillion things! Am I surprised??? No!!! You are amazing! They are all beautiful! I'm so happy for you Grandma! :)ReplyDelete
These bags are so awesome. What pattern did you use?ReplyDelete
Thanks for leaving your thoughts! I LOVE to hear from you :) I cherish every word :) I read ALL of your comments and try to reply to every single one.... but it sometimes takes me a few days xoxo
***If I don't get back to you, it is likely that you are a "No Reply Blogger" :( ***


text:
With the constant stream of revelations about Hollywood mega producer and uber Democrat donor Harvey Weinstein's sexual depradations disgusting the public, it's worth revisiting an aborted attempt by the Democrat National Committee last spring to tie then-GOP front-runner Donald Trump to abusive treatment of women.
It wasn't pretty.
According to the leaked emails published by WikiLeaks during the campaign, the DNC sought to place Craigslist ads that, while partially in jest, could be interpreted as planning a false sexual harassment scandal against then-candidate Donald Trump.
Advertisement - story continues below
The ad was first floated around on DNC email chains in May of 2016, advertising a fake position within the Trump organization, the leaked emails show.
"Seeking staff members for multiple positions in a large, New York-based corporation known for its real estate investments, fake universities, steaks, and wine. The boss has very strict standards for female employees, ranging from the women who take lunch orders (must be hot) to the women who oversee multi-million dollar construction projects (must maintain hotness demonstrated at time of hiring)," the ad read.
TRENDING: Local Resident Rips Apart Acosta's Border Wall Claim With His Own Photos
The title of the job? "Honey Bunch (that's what the boss will call you)"
Job requirements included, "No gaining weight on the job (we'll take some 'before' pictures when you start to use later as evidence) … Must be open to public humiliation and open-press workouts if you do gain weight on the job … A willingness to evaluate other women's hotness for the boss' satisfaction is a plus (and) Should be proficient in lying about age if the boss thinks you're too old.
Advertisement - story continues below
"Working mothers not preferred (the boss finds pumping breast milk disgusting, and worries they're too focused on their children)," the fake advertisement continued.
The ad described the Trump organization as a workplace "proud to maintain a 'fun' and 'friendly' work environment, where the boss is always available to meet with his employees. Like it or not, he may greet you with a kiss on the lips or grope you under the meeting table."
The emails show that the truth was not high on the list of DNC staffers' concerns.
"This is copy for a job we'd like to post on Craigslist," one staffer says during the chain. "We're aware that it might get taken down, and we're comfortable with that, but we want to make sure we're not exposing ourselves to any other action when we post."
The lawyers at the DNC weren't terribly thrilled over it.
Advertisement - story continues below
"The defamation risk here is too high," one lawyer said. "I know we are going for a parody, but given the content of the post (his private business practices, sexual harassment, etc) we would open ourselves up to a defamation suit if we posted."
While a parody, the clear intent here for the DNC was to smear The Donald with sexual harassment charges while not actually listing any particular charge he could deny. Needless to say, this could have led to litigation, which means it's probably for the best it wasn't posted.
But publication of the emails clearly embarrassed the Democrats. The left-leaning "fact checker" website Snopes, in fact, went to great pains to try to explain how really, there was nothing wrong with trying to gin up a spurious sexual harassment case against a major candidate for a major party's presidential nomination.
That no matter what Democrat apologists like the Snopes fact checkers might come up with, the fact the DNC was even considering this shows just how morally bankrupt the party is, and how far they were willing to go during the 2016 campaign.
Advertisement - story continues below
Please like and share on Facebook and Twitter with your thoughts on this Craigslist ad.
What do you think about the DNC's tactics? Scroll down to comment below.


text:
*Though Not as Many as the Number of Children Poisoned by Cosmetics, Household Cleaning Products and Painkillers.
In the past couple years we've seen a growth of e-cig and cannabis edible usage and a corresponding increase in corporate media scare stories warning us of the dangerous epidemics sweeping the country: children accidentally ingesting cannabis edibles and nicotine liquid. Though such incidents are a real concern that the public needs to be aware of and take steps to prevent, actual statistics show that the problem is not as alarming as it's often made out to be when examined in relation to other products that harm children when ingested.
With the advent of legal recreational cannabis in Colorado, data from the Rocky Mountain Poison and Drug Center (RMPDC) is often cited by news media for stories about the dangers of marijuana edibles. In 2014 the RMPDC received 151 calls about marijuana exposure, 45 of which involved children 8 years old and younger. Of course this should cause concern, but not as much concern as for the 2,690 calls to the RMPDC about children 5 years old and under poisoned by cosmetics, 1,495 calls for household cleaning product ingestion, and 739 calls regarding vitamins in 2011 (especially in light of the fact that no one has ever died of a cannabis overdose). It's also worth mentioning that while some studies have shown that repeated cannabis use may impact adolescents' developing brains (a claim that is still being debated), there is no conclusive evidence of its long-term negative effects on young people.
Similarly, the rapid rise in usage of e-cigs has triggered a flood of similarly-themed scare pieces which usually fall into the categories of "more teens using e-cigs" and "more toddlers getting poisoned by e-liquids". Like with cannabis edibles this is of course cause for concern but since e-cigs are a relatively new product, the increase in numbers would initially seem more dramatic.
Because nicotine has been shown to have a negative impact on adolescent brain development it definitely should not be sold to or marketed towards teenagers, but what such news stories leave out (or report as a completely separate issue) is correlated data showing a decrease in teen smoking.
As much as we want all teenagers to to be completely nicotine-free, there will always be some who experiment (especially those with backgrounds of physical or emotional abuse). Because e-cigs have been proven to contain less harmful toxins than tobacco cigarettes and e-cig users can choose to downgrade the level of nicotine contained in the e-liquids used (or switch to e-liquids containing zero nicotine or substances less harmful than nicotine), perhaps e-cigs could more accurately be viewed as "anti-gateway" Harm Reduction devices?
According to the American Association of Poison Control Centers (AAPCC), there were 1,543 e-cig and e-liquid exposures reported to Poison Centers in 2013. While unfortunate and preventable if more people took precautions with the handling and storage of e-cigs and e-liquids, the number of cases weren't even close to the top exposures called in to Poison Centers. To put them in context, in the 2013 Annual Report of the American Association of Poison Control Centers' National Poison Data System, the following were the top 10 substance categories most frequently involved in human exposures:
- Analgesics 298,633
- Cosmetics 199,838
- Cleaning substances 196,183
- Sedatives/Hypnotics/Antipsychotics 153,398
- Antidepressants 109,110
- Foreign bodies/Toys/Misc. 103,737
- Cardiovascular Drugs 101,544
- Antihistamines 99,176
- Topical preparations 89,287
- Pesticides 85,033
The report also included the top 10 substance categories most frequently involved in pediatric (≤5 years) exposures:
- Cosmetics 151,154
- Cleaning substances 113,872
- Analgesics 106,639
- Foreign bodies/Toys/Misc. 75,184
- Topical preparations 66,893
- Vitamins 47,816
- Antihistamines 45,250
- Pesticides 35,254
- Plants 29,346
- Gastrointestinal preparations 28,481
Of course these figures do not diminish the seriousness and danger of children being exposed to e-liquids, but it does highlight the often selective nature of news reportage, the inability of regulatory measures to completely prevent such incidents, and the overall importance of personal responsibility and vigilant parenting. While news media does have an important role to play in educating the public about health issues, it's important to understand that what is reported and the way it is reported is never completely without bias.
As members of the e-cig industry, it should be clear Cascadia Vape has an interest in defending the e-cig industry. Often less clear is the interest of corporate news media in releasing particular scare stories to increase viewership. Higher ratings and "correct" messaging ensure support from corporate sponsors who may also influence which stories are covered and/or how they're reported. For example, would it not be in the interest of news networks to discourage the use of products which directly compete with smoking cessation products such as nicotine patches and gum produced by large pharmaceutical companies which spend large sums of money to advertise on the networks (and/or produces PR material which attacks the competition)? In other words, keep in mind that corporate media has more self-interested motives besides public safety. Now more than ever we need to question what is reported and think critically about how facts are presented.


text:
A 22-year-old male has been jailed for four years and eight months after he was convicted of incest and sexual connection against his biological sister.
The decision was handed down by Supreme Court Justice Lei'ataualesa Daryl Clarke last week.
He issued a suppression order to protect the identity of the victim. In doing so, the identity of her brother and anything could lead to identifying her has also been suppressed.
Prosecuting the matter was lawyer, Fuifui Ioane, of the Attorney General's Office.
According to Justice Leiataualesa, the defendant faced two charges.
"The first is on the 1st of January, 2016 to 30th November, 2016 you had sexual connection with the victim under 12 years old," he said. "This charge carries a penalty of up to life imprisonment.
"The second charge is on 25th September, 2017, you committed incest with the victim, your biological sister, which carries a maximum penalty of 20 years imprisonment."
According to the Police summary of facts, the first incident occurred between 1st January, 2016 and 30th November, 2016, where the accused told the victim, who was then 10 years old, to meet him at the back of the house.
She then followed him into the bushes. There, he told her to take off her clothes and he sexually harassed her. He also tried having sex with her several times but he could not.
Later on, their father called the victim's name so they both put their clothes on and left.
The second incident occurred on the afternoon of Monday 25th September 2017, where the defendant had been watching television with the victim. He again told her to meet him at the backyard.
The victim refused, but the defendant begged her to follow him. He then grabbed the machete and told his cousins that he was going to do some chores.
Later, the victim went to get ice water from the fridge and she saw him outside begging her to come out.
She did. He wrapped his arms around her and hugged her and then he began to kiss her cheeks and lips.
He then sexually harassed her.
His uncle, who was in the area, saw the defendant and the victim and called out to him.
He fled the area with his machete.
According to Justice Leiataualesa, these types of offending involving young children are unacceptable because the offence has a significant type of psychological trauma on the victims.
"This is a very serious offense especially when they are very young," he told the defendant.
"Young children are young and the younger the child the greater the need for protection. Your action also shows the serious breach of trust towards your sister."
In stating the aggravating features, Justice Leiataualesa took into account the breach of trust.
"The aggravating feature of this matter is the age of the victim during the time of the offense," he said.
"Her vulnerability as she was just 10 years old when this happened, the breach of trust that she had for you as you are her biological brother, the age difference between you and the victim and the offense was premeditated.
"I do not accept your medical condition as a possible mitigating factor when sentencing you."
According to the presentence report, the defendant comes from a loving family.
"Your father addressed the court emotionally expressing his love for his children and the impact that this has caused him and he asks for leniency," said Justice Leiataualesa.
"Presentence report also refers to your mother who spoke highly of you.
"A report from Dr. Sanele was also presented to the probation officer stating that the defendant suffers from epilepsy.
"I accepted that you are remorseful for your actions and this is very clear to the court of your emotional state.
"According to the victim impact report, you had sort lenience from your family as well as your sister.
"The victim is your now 11-year-old sister who is a school student in Year 6.
"You were raised together and the victim impact report refers only to the victim as being embarrassed by what had occurred.
"In terms of mitigating features, I accept that you are generally remorseful, you've apologised to your family and sister and you have reconciled.
"I will also give you a deduction for your youth; I have also taken into account your early guilty plea to the charges."


text:
Europe's top rated Under-21 XI in 2014/15
With just one match to play in the current Serie A campaign, the formalities have all-but been settled across Europe's top 5 leagues. Barcelona, Juventus, Chelsea, Bayern Munich and PSG have all been crowned champions, with the former pairing set to battle it out for European club football's highest honour in a fortnight.
Lionel Messi (8.84 rating) and Cristiano Ronaldo (8.48) have continued to amaze with their unfathomable statistics, while the likes of Robben (8.47), Neymar (7.96) and Hazard (7.95) round off WhoScored.com's top 5 rated players for 2014/15. If said trio are to be expected among Europe's strongest performers this piece celebrates those that have enjoyed sensational seasons at a young age, as we compile our highest rated XI of players aged 21 and under.
First of all, some honourable mentions are in order, as some superb ratings have just fallen short due to the competition in certain positions in particular. Full-backs Wendell (7.42) and Abdul Baba (7.37) of Bayer Leverkusen and Augsburg just miss out. Perhaps more surprisingly, so too does Tottenham's Harry Kane (7.28), but hear us out before you get your pitchforks at the ready!
The following is a rundown of the best XI, starting in goal, of all players with 20 or more league appearances in 2014/15.
Goalkeeper: Sergio Rico – Sevilla
It's been some week for Sevilla's Sergio Rico who, having cemented his place as first choice keeper under Unai Emery at the turn of the year, has been rewarded with a place in Vicente del Bosque's latest Spain squad. As if that wasn't enough he earned a Europa League winners medal on Wednesday night to cap off a superb breakthrough campaign.
Of all keepers to make 20 or more appearances in La Liga only 5 managed a better save success rate than the 21-year old's 70.7%, earning a rating of 6.86 from WhoScored.com in the process.
Right Back: Fabinho – Monaco
At right-back is Monaco's Fabinho, who joined the club on a permanent basis after a two-year loan from Rio Ave this week, with a rating of 7.38 richly deserved after a fantastic season in Ligue 1. The Brazilian has shown his versatility to play in midfield at times but plies his trade as a full-back capable of supporting the attack, with 1.3 dribbles per game, whilst contributing significantly to Monaco's excellent defensive record, with 2.7 tackles and 2.6 interceptions per game.
Centre Back: Aymeric Laporte – Athletic Club
While this wasn't a breakthrough campaign for Athletic's young French defender Aymeric Laporte, he continued to prove why he is so highly-thought of at the club and increasingly across Europe, with a WhoScored.com rating of 7.19. The 21-year old already possesses a fantastic reading of the game and made more interceptions than any other player in La Liga all season (121).
Centre Back: Gimenez – Atletico Madrid
Joining Laporte in a La Liga centre-back pairing is Atleti's Gimenez, who has put real pressure on Miranda's place in Diego Simeone's plans, which is no mean feat considering the Brazilian's successful partnership with Diego Godin in recent years. The young Uruguayan will hope to partner his compatriot next season having made 20 appearances this time around, with no player in Spain averaging more shot blocks per game (1) for a sensational rating of 7.52 from WhoScored.com.
Left Back: Jordan Amavi – Nice
The highest rated player aged 21 or under in Europe's top 5 leagues this season, it's been quite a campaign for Nice's Jordan Amavi, who is one of a number of talented young left-backs in France right now. His rating of 7.74 was enough to rank second only to Zlatan Ibrahimovic in WhoScored's Ligue 1 rankings, courtesy of outstanding figures such as 3.9 tackles, 4.6 interceptions and 1.9 dribbles per game to accompany 4 goals in 36 appearances.
Right Winger: Domenico Berardi – Sassuolo
The on loan Juventus forward was instrumental once more in ensuring Sassuolo's Serie A survival this season and with one game still to play the 20-year old leads the side in both goals (14) and assists (9). Fielded on the right of a front three for his club, Berardi will surely be lined up for a return to the Old Lady before too long, with only Carlos Tevez and Mauro Icardi having a direct hand in more Serie A goals thus far, all for a rating of 7.29.
Central Midfielder: Johannes Geis – Mainz
Geis is another player whose emergence on the scene really came last season following a move to Mainz from Furth, but the midfielder has once again been incredibly consistent for his age this time around. A WhoScored.com rating of 7.33 is borne out of 4 goals and 3 assists along with a league high of 54 chances created from set pieces, and 2.2 key passes per game.
Central Midfielder: Morgan Sanson – Montpellier
A long-term injury may have curtailed the season of Morgan Sanson but the Montpellier midfielder was superb across his 32 appearances for a rating of 7.41 from WhoScored. He added a goal threat to his game from a more advanced position, with 6 goals and 3 assists, as well as averaging 2.5 dribbles per game. However, that didn't come at the expense of his defensive work rate, ranking among the top 10 players in Ligue 1 for tackles, with 102.
Left Winger: Raheem Sterling – Liverpool
His future looks set to lie away from Anfield, with Sterling's time at the club coming to a disappointing end, but there's little doubt that the youngster has been a strong servant to the Reds in the last two seasons. The 20-year old has made 68 league appearances for the club over the past two years and scored 7 goals along with 7 assists in 2014/15. With only 3 players completing more dribbles in the Premier League all season (103), Sterling fully merited a strong rating of 7.27 from WhoScored.
Forward: Paulo Dybala – Palermo
It's little surprise that Juventus acted fast when it came to securing the signature of Palermo's Paulo Dybala, with a host of Europe's top clubs circling after a fantastic return to Serie A from the youngster.
As things stand the Argentine is the only player in the league to register double figures for both goals (13) and assists (10) - the latter is the most in Serie A - and he could have added considerably more to his goal tally had he not rattled the woodwork 5 times.
With averages of 3.4 shots and 2.7 dribbles per game both ranking among the league's top 10 players, Dybala is the man to keep out Kane in the XI.
Forward: Nabil Fekir – Lyon
Joining him up front is Nabil Fekir, who earned his first France call-up this season having turned down the opportunity to represent Algeria. His WhoScored.com rating is bettered only by Amavi here - at 7.57 - providing the perfect foil to Ligue 1's leading scorer Alexandre Lacazette.
Fekir picked up tallies of 13 goals and 9 assists, whilst ranking first in Ligue 1 in terms of penalties won (6). He was the most fouled player in the league, felled 111 times, and averaged 2.8 successful dribbles per game.


text:
Monday, December 26, 2011
Christmas Seat
11 comments:
LOL Tammy, that is how we are feeling too. I hope Santa was good to you. Love this image too beautiful card as always!!!ReplyDelete
Linda xxx
Definitely how I'm feeling today. Yesterday seemed so hectic, but today I can relax and hopefully play in my craft room (or at least start to straighten it up). Cute ribbon too.ReplyDelete
Love your card Tammy,yes I think everyone love Boxing Day for chilling out.xxxReplyDelete
Us too!!! Today is gonna be a LAZY day!!! Adorable card and fabulous coloring Tammy. Hope you had a wonderful Christmas. ~jeni :)ReplyDelete
Isn't this the truth!! Precious card Tammy.ReplyDelete
I feel just about like that too!ReplyDelete
Happy Day!!
Having spent the past few days with a large dalmation and watching with great hilarity as he made himself fit into the small bed of my dogs I can totally relate to your card today Tammy.ReplyDelete
I hope your Christmas was wonderful!
Oh goodness... LOL! What a fun image and yep, that was me last night *Ü* Thanks so much for dropping by my blog and commenting from Digi Doodle Shop's Best!! Have a relaxing day ;)ReplyDelete
We are doing about the same thing....LOL!!! This is adorable, Tammy!!! Hope you had a great Christmas!!!ReplyDelete
I would love to have done that- great image! I had to go to work today...... Great coloring!ReplyDelete
Love it!! This fun image reflects what all at my house are feeling!!ReplyDelete


text:
Berkadia, Berkshire Hathaway's joint venture with Leucadia National Corporation, has arranged $262.5 million in acquisition financing for Key Center, Cleveland's tallest skyscraper—a 1.3 million-square-foot, Class-A office tower and the adjacent Marriott Hotel and parking structure.
The property is located in Cleveland's Public Square. Senior Director Mark Vogel secured the acquisition loan, representing Berkadia's largest conduit loan to date. The deal was completed on January 31, 2017.
Berkadia represented The Millennia Companies, which is headquartered in Cleveland. The seller was Columbia Property Trust, Inc. The 10-year senior mortgage fixed loan lead by Citibank, included Bank of America and Deutsche Bank. Apollo Global Management provided the mezzanine debt financing.
"Key Center is an iconic part of Cleveland's skyline and represents the state of Ohio's tallest building," said Vogel. "The institutions involved in this transaction acted extremely aggressively. They provided a substantial portion of the required capital to facilitate the acquisition and fund future improvements related to the hotel's redevelopment and the building's increased occupancy. Berkadia worked diligently with the entire Millennia team, and it was truly a collaborative effort."
Built in 1991, the integrated, mixed-use complex Key Center comprises a 57-story office tower, a 400-room Marriott Hotel and a parking structure. It also houses the headquarters of both the property's namesake, Key Bank, and law firm BakerHostetler.
At the end of 2016, the office tower was 82 percent leased. A portion of the asset will become Millennia's new headquarters, moving hundreds of employees from Rockside Road to Key Tower over the next year. Millennia's lease, along with the anticipated move of Forest City Realty Trust, Inc. to Key Center, will increase the building's occupancy up to 95 percent.
"We are already in the design phase of a $24 million renovation to the tower lobby, plaza and hotel," said Frank Sinito, president of The Millennia Companies.
About Berkadia
Founded in 2009 as a 50/50 joint venture between Berkshire Hathaway and Leucadia National Corporation, Berkadia is a third-party commercial mortgage servicer, as well as an approved lender for Fannie Mae, Freddie Mac, and HUD/FHA.
The company is among the top Freddie Mac and Fannie Mae multifamily lenders.
Berkadia owes its origins to GMAC Commercial Mortgage Corporation, which was acquired in 2009 by Kohlberg Kravis Roberts & Co., Five Mile Capital Partners LLC, and Goldman Sachs Capital Partners. Christened Capmark Financial, the company had $10 billion of originations in 2008 and a servicing portfolio of more than $360 billion before running into bankruptcy in October 2009.
In a deal approved by the bankruptcy court, Capmark sold its mortgage loan and servicing to the newly formed Berkadia in a deal worth $515 million.
The deal brought Berkshire into the heart of the commercial loan serving business, and the company has one of the largest commercial real estate servicing portfolios.
© 2017 David Mazor
Disclosure: David Mazor is a freelance writer focusing on Berkshire Hathaway. The author is long in Berkshire Hathaway, and this article is not a recommendation on whether to buy or sell the stock. The information contained in this article should not be construed as personalized or individualized investment advice. Past performance is no guarantee of future results.


text:
Pat Robertson accused of Damaging Movement
LJ-SEC: (ORIGINALLY POSTED BY sunfell)
Pat Robertson's peers say his off the wall remarks are damaging the extreme religious right's reputation.
Ya think?
"[Robertson] is in a very visible leadership position and comments such as recent ones related to Mr. Sharon and so many others are misinformed and presumptuous and border on arrogance," said David Dockery, president of Union University, a private college affiliated with the Tennessee Baptist Convention.
Dockery suggested Robertson might want to consult other theologians "before making these pronouncements so quickly."
"It puts the evangelical movement in a bad light when that happens because people make broad generalizations, rightly or wrongly, all the time," said Dockery, who also is chairman of the board for the Council for Christian Colleges and Universities.


text:
Today: [Ecclesiastes 6] How Much is Enough? In Ecclesiastes 6 Solomon speaks of the vanity of riches. Many times we can be distracted by the material things of life to the exclusion of spiritual priorities. We work in pursuit of nicer things for ourselves or our families and our spiritual life suffers because there is only so much time in the day to give over to higher priorities such as living for God. Solomon stands on the other side of attainment and material wealth and declares that the effort we put forth for natural acquisition in the end only produces vanity and vexation of spirit if our heart is not focused in pursuit of a deeper life in God.
[Ecc 6:1-12 KJV] 1 There is an evil which I have seen under the sun, and it [is] common among men: 2 A man to whom God hath given riches, wealth, and honour, so that he wanteth nothing for his soul of all that he desireth, yet God giveth him not power to eat thereof, but a stranger eateth it: this [is] vanity, and it [is] an evil disease. 3 If a man beget an hundred [children], and live many years, so that the days of his years be many, and his soul be not filled with good, and also [that] he have no burial; I say, [that] an untimely birth [is] better than he. 4 For he cometh in with vanity, and departeth in darkness, and his name shall be covered with darkness. 5 Moreover he hath not seen the sun, nor known [any thing]: this hath more rest than the other. 6 Yea, though he live a thousand years twice [told], yet hath he seen no good: do not all go to one place? 7 All the labour of man [is] for his mouth, and yet the appetite is not filled. 8 For what hath the wise more than the fool? what hath the poor, that knoweth to walk before the living? 9 Better [is] the sight of the eyes than the wandering of the desire: this [is] also vanity and vexation of spirit. 10 That which hath been is named already, and it is known that it [is] man: neither may he contend with him that is mightier than he. 11 Seeing there be many things that increase vanity, what [is] man the better? 12 For who knoweth what [is] good for man in [this] life, all the days of his vain life which he spendeth as a shadow? for who can tell a man what shall be after him under the sun?
In chapter 6 Solomon laments the vanity of earthly attainment and this world's goods. Commentators for centuries have read these words and concluded that Solomon was in a backslidden state and therefore not inspired in his observations. Theologians dismiss the book of Ecclesiastes as an inspired record – yes but of uninspired sayings. They cannot read Solomon and think there is any true wisdom here – but only the corrupt and contaminated wisdom of a man out of fellowship with God. It is true that Solomon did not live his entire life in alignment with the heart of God. In his youth when he was small in his own eyes he cried out to God for wisdom and for understanding in order to be a just and godly king. He didn't ask for wealth, or to defeat his enemies, he only asked for more of God in his life. 2 Chron. 1 records an encounter Solomon had in the night seasons where he was granted the wisdom that he drew upon to pen the words in this book that scholars have so blithely dismissed:
[2Ch 1:6-12 KJV] 6 And Solomon went up thither to the brasen altar before the LORD, which [was] at the tabernacle of the congregation, and offered a thousand burnt offerings upon it. 7 In that night did God appear unto Solomon, and said unto him, Ask what I shall give thee. 8 And Solomon said unto God, Thou hast shewed great mercy unto David my father, and hast made me to reign in his stead. 9 Now, O LORD God, let thy promise unto David my father be established: for thou hast made me king over a people like the dust of the earth in multitude. 10 Give me now wisdom and knowledge, that I may go out and come in before this people: for who can judge this thy people, [that is so] great? 11 And God said to Solomon, Because this was in thine heart, and thou hast not asked riches, wealth, or honour, nor the life of thine enemies, neither yet hast asked long life; but hast asked wisdom and knowledge for thyself, that thou mayest judge my people, over whom I have made thee king: 12 Wisdom and knowledge [is] granted unto thee; and I will give thee riches, and wealth, and honour, such as none of the kings have had that [have been] before thee, neither shall there any after thee have the like.
Notice that before God came to Solomon that there was an offering made. Solomon offered 1000 burnt offerings. This is referring to the whole burnt offering of a bullock or a ram upon the altar. The passage tells us that this was not something Solomon allowed someone to offer in his behalf – he actually performed the task himself. A burnt offering had nothing to do with sin. A burnt offering was a consecration offering. It didn't represent God giving a sacrifice foreshadowing Jesus to cover man's transgression. Rather it represented the man, in this case Solomon giving himself to God in wholeness and consecration. Can you imagine the effort that was involved? To personally offer up 1000 head of cattle or sheep on the altar? We have here an example of a gift given moving the hand of God in such a way that Solomon's destiny was changed. If it were not for this one act Solomon's name would have gone down as a mere footnote in the annals of biblical history. What might our own act of giving in such a way bring us to a new place of destiny? Solomon was without doubt completely and totally exhausted at the end of the matter. Yet that night was the night that God came to him.
When God came to Solomon he didn't say "I am going to give you something because you have given so radically of yourself to Me…" Rather he asked Solomon what he wanted. Without equivocating as theologians and scholars often do – God simply asked Solomon "ask what I shall give you…" Without condition or qualification God was offering of Himself to Solomon and what came next out of Solomon's mouth determines the man's destiny. He didn't ask for something for himself. He asked for wisdom and it was granted him – along with everything that he did not ask for. He was granted wisdom along with everything that he dared not ask for. Bear in mind now that he wasn't just asking in faith. He was asking in faith and love demonstrated by an act of worship unparalleled in the biblical record up to this point other than by David himself.
Having received of God the wisdom that so changed his life, Solomon came to grapple with the consequences of the favor, riches and wealth that came along with it. Teachers often teach of the glories of being impoverished and destitute suggesting that God places a premium upon suffering so that you can be more like Jesus. Yet seated at the right hand of the Father Jesus is surrounded by glory and opulence that we find difficult to describe. Heaven is not a place of suffering yet Paul taught in Ephesians that we are now seated with Him and in Him at the right hand of the Father. Jesus Himself taught in this life (Matt. 6:33) that if we seek first the kingdom all things would be added. What wisdom was he drawing from? Remember that Jesus was familiar with the scriptures. No doubt he read of Solomon who in his youth sought the kingdom and as a result all things were added to the degree that Solomon's wealth is unparalleled in human history.
Solomon received of the glory of earthly riches but with that came a burden that caused him to realize that all the riches in the world are without any gratification outside of the higher purpose of God in our lives. It is important to remember when you read of Solomon's "vanity of vanity – all is vexation and vanity…" that it is all stated in a very specific context. The phrase "under the sun" appears 30 times in this very brief book of Ecclesiastes. In 1 Corinthians 15:19 Paul said "if in this life only we have hope we are of all men most miserable…" This is the context of all that Solomon is emphasizing here. Solomon is not questioning God – he is questioning (v. 12) the worth of this life is that is all there is and we are not committed to something beyond ourselves. Speaking as a man who has everything he is declaring that it is as nothing if life is only to be measured by what happens "under the sun" or in this natural existence without giving ourselves wholly over to God and laying up the treasury of a relationship with Him that makes every natural attainment or blessing nothing more than a total vanity by comparison to the depth and fulfillment of fellowship with the one that sits on the throne.
Get Our Latest Book: "Rivers of God" – Click Here
Explore all of Prophet Walden's Titles on Amazon.com – Click Here
ALSO: The Digital Download of 5 hours of Prophetic Soaking with Prophet Russ Walden – Click Here
Show your support for the Daily Prophetic Word::
With a One Time Donation:
To Mail a Donation our Address is:
Father's Heart Ministry
P.O. Box 1915
Branson, Missouri 65615
To Phone in a Donation or to Contact Our Office: 417-593-9802