text:
Patent US7818786 - Apparatus and method for managing session state - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsAn apparatus and method for managing a session state are provided. The apparatus for managing a session state during transmission control protocol (TCP) handshaking includes: a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet;...http://www.google.com/patents/US7818786?utm_source=gb-gplus-sharePatent US7818786 - Apparatus and method for managing session stateAdvanced Patent SearchTry the new Google Patents, with machine-classified Google Scholar results, and Japanese and South Korean patents.Publication numberUS7818786 B2Publication typeGrantApplication numberUS 11/298,114Publication dateOct 19, 2010Filing dateDec 8, 2005Priority dateAug 19, 2005Fee statusPaidAlso published asUS20070044142Publication number11298114, 298114, US 7818786 B2, US 7818786B2, US-B2-7818786, US7818786 B2, US7818786B2InventorsSeung Yong Yoon, Jin Tae Oh, Jong Soo JangOriginal AssigneeElectronics And Telecommunications Research InstituteExport CitationBiBTeX, EndNote, RefManPatent Citations (2), Non-Patent Citations (2), Referenced by (15), Classifications (7), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetApparatus and method for managing session state
US 7818786 B2Abstract
An apparatus and method for managing a session state are provided. The apparatus for managing a session state during transmission control protocol (TCP) handshaking includes: a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet; a detailed information manager generating and managing an entry by extracting state information of a session in which a predetermined time does not pass after the session has been completely established, to respond to an intrusion detection against the input packet when the index is produced; a brief information manager generating and managing an entry including state information, which includes states of session connection and disconnection and directionality of the input packet, of a session in which a predetermined time elapses after the session has been completely established; and a search unit searching an index of the session corresponding to the input packet in the session index unit, and, if an index does not exist, searching the brief information manager after the session has been completely established.
1. A microprocessor based apparatus for managing a session state in the process of transmission control protocol (TCP) handshaking, the apparatus comprising:
a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet;
a detailed information manager generating and managing an entry by extracting state information of a session in which a predetermined time does not elapse after the session has been completely established, to respond to an intrusion detection against the input packet when the index is produced,
wherein the detailed information manager is configured to determine that the session is abnormal when a difference between a current hop count and a previous hop count is greater than a predetermined threshold,
wherein the detailed information manager is configured to determine that the session is abnormal when a sequence number of a packet transmitted from a first host to a second host is smaller than an acknowledge number associated with a last transmitted package from the second host to the first host,
wherein the detailed information manager is configured to determine that the session is abnormal when a sum of the sequence number and a payload size of the packet transmitted from a transmitting host is greater than a last acknowledge window size of the transmitting host;
a brief information manager generating and managing an entry including state information, which includes states of session connection and disconnection and directionality of the input packet, of a session in which a predetermined time elapses after the session has been completely established; and
a search unit searching an index of the session corresponding to the input packet in the session index unit, and, if an index does not exist, searching the brief information manager after the session has been completely established.
2. The apparatus of claim 1, wherein the session index unit uses a least recently used (LRU) algorithm that sequentially stores the indexes and, if the session index unit is full, deletes a least recently used index.
3. The apparatus of claim 1, wherein the detailed information manager uses the LRU algorithm that sequentially stores the entries and, if the detailed information manager is full, deletes a least recently used entry.
4. The apparatus of claim 1, wherein the detailed information manager generates linked lists for each of operations of receiving a SYN packet, transmitting a synchronize sequence number/acknowledge (SYN/ACK) packet, and receiving an ACK packet during TCP 3-way handshaking in addition to an initial linked list, and adds the entries to the linked list corresponding to each of the packets when the packets are input,
wherein, if time required to add the entries to the linked list exceeds a predetermined critical threshold, the entries are inserted into a tail of the initial linked list.
5. The apparatus of claim 1, wherein, if an index of a session corresponding to an input SYN packet does not exist in the search unit, the session index unit generates an index including the 5-tuple information of the session corresponding to the SYN packet.
6. The apparatus of claim 1, wherein the search unit further comprises an update unit, if an index of a session corresponding to an input TCP packet exists in the detailed information manager, updating an entry of the detailed information manager.
7. The apparatus of claim 1, wherein the index points to a memory address of the entry corresponding to the input packet.
8. The apparatus of claim 1, wherein the index points to the entry included in the brief information manager corresponding to the input packet using a hash address generated based on the 5-tuple information of the session.
9. The apparatus of claim 1, wherein the detailed information manager further comprises a time to live (TTL) tracking alert issuer issuing an alert when a difference between TTL values of a current packet and a previous packet exceeds a predetermined threshold in order to determine whether a packet belonging to the session is normal if the session is completely established.
10. The apparatus of claim 1, wherein the detailed information manager further comprises a SEQ/ACK number tracking alert issuer issuing an alert when a sequence number of a packet transmitted after the input packet is received is smaller than a last ACK number of the input packet, or a value obtained by subtracting the last ACK number from a value obtained by summing the sequence number and a payload size is bigger than the size of a window.
11. The apparatus of claim 1, wherein the session index unit is realized in a ternary content addressable memory (TCAM).
12. The apparatus of claim 1, wherein the detailed information manager is realized in a static random access memory (SRAM).
13. The apparatus of claim 1, wherein, when a TCP flag value of the input packet is RST, if the detailed information manager or the brief information manager includes an entry including session state information, the entry is deleted from the detailed information manager or the brief information manager.
14. A non-transitory computer readable recording medium comprising written instructions that specify a method of managing a session state in the process of TCP handshaking, the method comprising:
(a) building an index table by producing and managing an index including 5-tuple information of a session corresponding to an input packet;
(b) generating a first entry table by generating and managing an entry by extracting state information of a session within a predetermined time before and after the session is completely established so as to respond to an intrusion detection against the input packet when the index is produced;
(c) generating a second entry table by generating and managing an entry including state information, which includes directionality of the input packet and states of the session connection and disconnection, of a session after a predetermined time after the session is completely established;
(d) searching an index of the session corresponding to the input TCP packet in the session index unit, and, if an index does not exist, searching the second entry table after the session is completely established;
e) determining that the session is abnormal when a difference between a current hop count and a previous hop count is greater than a predetermined threshold,
f) determining that the session is abnormal when a sequence number of a packet transmitted from a first host to a second host is smaller than an acknowledge number associated with a last transmitted package from the second host to the first host, and
g) determining that the session is abnormal when a sum of the sequence number and a payload size of the packet transmitted from a transmitting host is greater than a last acknowledge window size of the transmitting host.
15. The method of the non-transitory computer readable recording medium of claim 14, wherein the index table uses a LRU algorithm that sequentially stores the indexes and, if a session index unit is full, deletes a longest used index.
16. The method of the non-transitory computer readable recording medium of claim 14, wherein the first entry table uses a LRU algorithm that sequentially stores the entries and, if a detailed information manager is full, deletes a longest used entry.
17. The method of the non-transitory computer readable recording medium of claim 14, wherein generating the first entry table comprises:
generating an initial linked list;
generating linked lists for each of operations of receiving a SYN packet, transmitting a SYN/ACK packet, and receiving an ACK packet in the process of TCP 3-way handshaking;
adding the entries to the linked list corresponding to each of the packets when the packets are input;
determining whether time required to add the entries to the linked list exceeds a predetermined critical threshold; and
inserting the entries into a tail of the initial linked list, if the time is determined to exceed the predetermined critical threshold.
18. The method of the non-transitory computer readable recording medium of claim 14, wherein operation (a) if an index of a session corresponding to an input SYN packet is not searched, generates an index including the 5-tuple information of the session corresponding to the SYN packet.
19. The method of claim 14, further comprising: (h) updating an entry of the first entry table, if an index of a session corresponding to an input TCP packet is searched.
20. The method of the non-transitory computer readable recording medium of claim 14, wherein the first entry table further comprises: issuing an alert when a difference between TTL values of a current packet
and a previous packet exceeds a predetermined threshold in order to determine whether a packet belong to the session is normal if the session is completely established.
21. The method of the non-transitory computer readable recording medium of claim 14, wherein the first entry table further comprises: issuing an alert when a sequence number of a packet transmitted after the
input packet is received is smaller than a last ACK number of the input packet, or a value obtained by subtracting the last ACK number from a value obtained by summing the sequence number and a payload size is bigger than the size of a window.
22. The method of the non-transitory computer readable recording medium of claim 14, wherein the index points to a memory address of the entry corresponding to the input packet.
23. The method of the non-transitory computer readable recording medium of claim 14, wherein the index points to an entry included in a brief information manager corresponding to the input packet using a hash address generated based on the 5-tuple information of the session. Description
This application claims the benefit of Korean Patent Application Nos. 10-2005-0076454, filed on 19 Aug. 2005 and 10-2005-0085591, filed on 14 Sep. 2005 in the Korean Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.
The present invention relates to an apparatus and method for managing a session state for a stateful packet inspection (SPI).
Conventional stateless analysis systems that detect intrusions using a packet at a point generate false positive alerts due to intrusion detection system evasion tools such as Stick or Snot.
A session stateful intrusion detection system such as a stateful packet inspection (SPI) has been introduced to solve the above problem. However, when a session state tracking function is used to perform session stateful intrusion detection, most currently available products cannot properly perform their functions due to rapid performance deterioration in the giga scale Internet.
Therefore, intrusion detection systems employing session stateful intrusion detection are required to increase their performance so as to catch up with the evolution speed of the rapidly developing Internet. To this end, most software-based products are changed into hardware-based products.
The session stateful intrusion detection must maintain and manage information of several hundreds of thousands to several millions sessions and solve lack of hardware resources so that hardware-based products can properly perform the giga scale Internet.
Since intrusion detection systems employing the session stateful intrusion detection maintain and manage information of sessions, they are vulnerable to denial of service (DoS) attacks such as synchronize sequence number (SYN) flooding. To solve this problem, a variety of methods such as Syn Cache, Syn Cookies, SynDefender, Syn Proxying, Synkill, etc. have been suggested. However, it is still quite difficult to solve the problem using these methods.
The present invention provides an apparatus and method for managing a session state that effectively manages sessions and a memory, and to provide a protection mechanism against a denial of service (DoS) attack by reducing an intrusion alert erroneously detected by a stateless analysis system and overcoming a problem of conventional session stateful systems which are not able to properly perform their functions due to rapid performance deterioration.
According to an aspect of the present invention, there is provided an apparatus for managing a session state in the process of transmission control protocol (TCP) handshaking, the apparatus comprising: a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet; a detailed information manager generating and managing an entry by extracting state information of a session in which a predetermined time does not elapse after the session has been completely established, to respond to an intrusion detection against the input packet when the index is produced; a brief information manager generating and managing an entry including state information, which includes states of session connection and disconnection and directionality of the input packet, of a session in which a predetermined time elapses after the session has been completely established; and a search unit searching an index of the session corresponding to the input packet in the session index unit, and, if an index does not exist, searching the brief information manager after the session has been completely established.
The session index unit may use a least recently used (LRU) algorithm that sequentially stores the indexes and, if the session index unit is full, deletes a longest used index.
The detailed information manager may use the LRU algorithm that sequentially stores the entries and, if the detailed information manager is full, deletes a longest used entry.
The detailed information manager may generate linked lists for each of operations of receiving a SYN packet, transmitting a synchronize sequence number/acknowledge (SYN/ACK) packet, and receiving an ACK packet during TCP 3-way handshaking in addition to an initial linked list, and adds the entries to the linked list corresponding to each of the packets when the packets are input, wherein, if time required to add the entries to the linked list exceeds a predetermined critical threshold, the entries are inserted into a tail of the initial linked list.
The detailed information manager may further comprise a time to live (TTL) tracking alert issuer issuing an alert when a difference between TTL values of a current packet and a previous packet exceeds a predetermined threshold in order to determine whether a packet belonging to the session is normal if the session is completely established.
According to another aspect of the present invention, there is provided a method of managing a session state in the process of TCP handshaking, the method comprising: (a) building an index table by producing and managing an index including 5-tuple information of a session corresponding to an input packet; (b) generating a first entry table by generating and managing an entry by extracting state information of a session within a predetermined time before and after the session is completely established so as to respond to an intrusion detection against the input packet when the index is produced; (c) generating a second entry table by generating and managing an entry including state information, which includes directionality of the input packet and states of the session connection and disconnection, of a session after a predetermined time after the session is completely established; and (d) searching an index of the session corresponding to the input TCP packet in the session index unit, and, if an index does not exist, searching the second entry table after the session is completely established.
FIG. 1 is a block diagram of a session stateful intrusion detection system according to an embodiment of the present invention;
FIG. 2 is a block diagram of a session state management apparatus according to an embodiment of the present invention;
FIG. 3 is a block diagram for illustrating a method of managing 2-stage session state information using an apparatus for managing a session state according to an embodiment of the present invention;
FIG. 4 is a table of detailed session state information stored in a detailed information manager illustrated in FIGS. 2 and 3;
FIG. 5 is a table of brief session state information stored in a brief information manager illustrated in FIGS. 2 and 3;
FIG. 6 is a view for illustrating a method of managing a memory using the detailed information manager of FIGS. 2 and 3 to provide a protection mechanism against a denial of service (DoS) attack;
FIG. 7 illustrates a structure of the detailed information manager of FIGS. 2 and 3 according to an embodiment of the present invention;
FIG. 8 is a flowchart of a time to live (TTL) tracking process as an attack detection function performed by the detailed information manager of FIGS. 2 and 3 according to an embodiment of the present invention;
FIG. 9 is a flowchart of a Sequence/Acknowledge number tracking process as an attack detection function performed by the detailed information manager of FIGS. 2 and 3 according to an embodiment of the present invention;
FIG. 10 is a flowchart of a SYN packet processing method using a transmission control protocol (TCP) flag value according to an embodiment of the present invention;
FIG. 11 is a flowchart of a SYN/ACK packet processing method according to an embodiment of the present invention;
FIG. 12 is a flowchart of processing an ACK packet according to an embodiment of the present invention;
FIG. 13 is a flowchart of processing a RST packet according to an embodiment of the present invention;
FIG. 14 is a flowchart of processing a FIN packet according to an embodiment of the present invention; and
FIG. 15 is a flowchart of processing other packets which are not illustrated in FIGS. 10 through 14 according to an embodiment of the present invention.
The present invention will now be described more fully with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. Like reference numerals in the drawings denote like elements, and thus their description will be omitted. The invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art.
FIG. 1 is a block diagram of a session stateful intrusion detection system according to an embodiment of the present invention. Referring to FIG. 1, the session stateful intrusion detection system comprises an IP De-fragmentation module 110, a packet parser 120, a state manager 130, a state information generator 140, a packet forwarder 150, a transmission control protocol (TCP) re-combiner 160, an alert producer, an intrusion detector 101, an alert manager, and an intrusion countermeasurer 102.
When an Internet protocol (IP) packet is input to the session stateful intrusion detection system, the session stateful intrusion detection system reassembles the packet through the IP De-fragmentation module 110 and extracts frequently used information such as a sequence number, an acknowledge number, a window size, TCP flags, etc. from header information of the packet in the packet parser 120.
The state manager 130 generates, manages, and deletes a session corresponding to the input packet. To this end, the state manger 130 effectively manages several hundreds of thousands to several millions sessions and performs a countermeasure against a denial of service (DoS) attack using a 2-stage state table management method with limited resources.
The state information generator 140 generates state information of the session corresponding to the input packet that is managed via the 2 stage state table and transmits the generated state information to the intrusion detector 101.
The packet forwarder 150 forwards the state information of the session to the intrusion detector 101 through the state information generator 140.
The TCP reassembler 160 reassembles the TCP packet using the packet information forwarded to the state manager 130 and the state information of the session forwarded to the state information generator 140 and forwards the reassembled TCP packet to the intrusion detector 101 through the packet forwarder 150.
The intrusion detector 101 detects intrusions based on the information received from the state information generator 140 and the packet forwarder 150.
The state manager 130 tracks the state information of the session during TCP hand shaking, and issues an alert for a packet transited to an abnormal state, so that the intrusion countermeasurer 102 performs the countermeasure against an attack corresponding to the issued alert.
FIG. 2 is a block diagram of an apparatus 200 for managing a session state according to an embodiment of the present invention. Referring to FIG. 2, the apparatus 200 for managing a session state comprises a session index unit 210, a detailed information manager 220, a brief information manager 230, a search unit 240, and an update unit 250.
A TCP attack is made in several seconds immediately after a TCP 3-way handshaking is completed. Therefore, the apparatus 200 for managing a session state manages a lot of detailed state information on a session in which a short amount of time passes after a session connection has been established via the TCP 3-way handshaking, and manages brief state information on a session in which a lot of time passes after the session connection has been established, thereby completing the session state information management with limited resources. A more detailed constitution will now be described.
The session index unit 210 produces and manages an index including 5-tuple information (a protocol, a source IP address, a destination IP address, a source port number, and a destination port number) of a session corresponding to an input packet.
The state information of the session corresponding to the input packet included in the index points to entry addresses stored in the detailed information manager 220 and/or the brief information manager 230.
The detailed information manager 220 manages a lot of detailed state information on the session in which a short amount of time passes after the session connection has been established via the TCP 3-way handshaking, thereby responding to the TCP attack. An embodiment of the detailed information manager 220 is illustrated in FIG. 4.
The brief information manager 230 produces and manages an entry including information on connection and disconnection states of the session corresponding to the input packet and information on directionality of the packet with regard to the session in which a lot of time passes after the session connection has been established.
The brief information manger 230 produces and manages brief state information of the session in which a lot of time passes after the session connection has been established, thereby considerably reducing memory resources and providing information on states of a lot of sessions. An embodiment of the brief information manger 230 is illustrated in FIG. 5.
The search unit 240 searches an index of the session corresponding to the input TCP packet in the session index unit 210, and, if the index is not searched, searches the brief information manager 230 after the session connection is established.
When a synchronize sequence number (SYN) packet requesting the session connection is input to the apparatus 200 for managing a session state, and the search unit 240 fails to search an index of a session corresponding to the input SYN packet, the session index unit 210 determines whether the session index unit 210 is full in producing a new index. If the session index unit 210 is determined to be full, the session index unit 210 deletes the longest used index using a least recently used (LRU) algorithm, and produces a new index including the 5-tuple information of the session. This will be described in detail with reference to FIG. 6.
When the search unit 240 fails to search the index of the session corresponding to the input TCP packet after the session connection is established, it searches the brief information manager 230. In this regard, the index points to the entry included in the brief information manager 230 corresponding to the input TCP packet using a hash address generated based on the 5-tuple information of the session, thereby more quickly searching the entry included in the brief information manager 230.
The hash address is generated by a hash key generator 330 (refer to FIG. 3) based on the 5-tuple information of the session corresponding to the input TCP packet, which serves as a key.
When the search unit 240 has as searched the index of the session corresponding to the input TCP packet, the update unit 250 updates the entry, pointed to by the index, of the detailed information manager 220.
When a SYN/ACK packet is input in response to the SYN packet, the update unit 250 searches the session index unit 210, and, if the index is searched, updates the detailed information manager 220 pointed to by the index. However, when the index is not searched in the session index unit 210, since the SYN packet is not transmitted, the received SYN/ACK packet is an abnormal packet, resulting in the issuance of an alert.
FIG. 3 is a block diagram for illustrating a method of managing 2-stage session state information using an apparatus for managing a session state according to an embodiment of the present invention. More specifically, FIG. 3 is a view illustrating a method of managing 2-stage session state information using an apparatus for managing a session state according to TCP 3-way handshaking. Referring to FIG. 3, when a SYN packet requesting a TCP session is input to the apparatus for managing a session state, a session index unit 310 produces an index including 5-tuple information of the TCP session. The index is used to search a session corresponding to the input SYN packet in a detailed information manager 320 or a brief information manager 340.
When the session index unit 310 produces the index, the detailed information manager 320 is filled with detailed information on states of sessions extracted from each of a plurality of fields of the input SYN packet.
Thereafter, when a SYN/ACK packet is input in response to the SYN packet, the search unit 240 searches the session index unit 310. If an index of the session corresponding to the input SYN/ACK packet exists in the session index unit 310, the update unit 250 updates the detailed information manager 320.
When an acknowledgement (ACK) packet informing of a safe arrival of the SYN/ACK packet is input, the search unit 240 searches the session index unit 310. If an index of the session corresponding to the input ACK packet exists in the session index unit 310, the update unit 250 updates the detailed information manager 320, and produces an entry including brief state information on a session in a hash table of the brief information manager 340.
A hash key generator 330 generates a hash address based on the 5-tuple information on the session included in the index. The hash address points to an entry corresponding to the input session included in the brief information manager 340.
FIG. 4 is a table of detailed session state information stored in the detailed information manager 220 illustrated in FIGS. 2 and 3. Referring to FIG. 4, the detailed session state information stored in the detailed information manager 220 is used to respond to an intrusion detection and more accurately determine a session connection state. That is, the detailed session state information stored in the detailed information manager 220 is used to inspect and track fields of an input packet so as to determine whether the input packet is normal.
The session state information for responding to the intrusion detection is client state information, server state information, extendible connection state information for tracking a session state in an application protocol level, time to live (TTL) tracking information as illustrated in FIGS. 7 and 8, abnormal packet detection information for Seq/Ack number tracking, and other necessary information.
FIG. 5 is a table of brief session state information stored in the brief information manager 230 illustrated in FIGS. 2 and 3. Referring to FIG. 5, the brief session state information stored in the brief information manager 230 is minimum information of core state information used to detect an intrusion such as a TCP attack.
The brief session state information may be information on connection and disconnection states indicating that an input packet is a currently connected session, information on directionality of the input packet, and the like.
The brief information manager 230 may not store a lot of detailed session state information compared to the detailed information manager 220. Therefore, since it is difficult to exactly track a session disconnection process, the brief session state information is half-close information for tracking a brief disconnection process using the number of input FIN (finish) packets.
The above example is one embodiment, and the brief information manager 230 can store extendible information.
FIG. 6 is a view for illustrating a method of managing a memory using the detailed information manager 220 of FIG. 2 or 3 to provide a protection mechanism against a denial of service (DoS) attack.
An apparatus for tracking a session state is vulnerable to a SYN flooding attack. In detail, a very tiny buffer exists to quickly perform handshaking for establishing a session interposed between a TCP client and a server in a network. A packet for establishing the session includes a SYN field for recognizing a sequence of message exchanges.
If a predetermined time passes without any reaction after an attacker very quickly request a plurality of connections, packets that the buffer contains are useless. However, a lot of false connection requests make it difficult to establish a normal connection request session, which requires an adjustment of the elapsed time.
To respond to the SYN flooding attack, the detailed information manager 220 manages sessions using four linked lists, i.e., an IDLE Link 610, a SYN Link 620, a SYN/ACK Link 630, and an EST Link 640.
The detailed information manager 220 generates the linked lists at each of operations of receiving a SYN packet, transmitting a SYN/ACK packet, and receiving an ACK packet during TCP 3-way handshaking. A session entry moves from the IDLE Link 610 to the EST Link 640 by the packets during the TCP 3-way handshaking. This link movement enables to be effectively managed session connection state information to be managed a memory.
More specifically, the IDLE Link 610 that is a list for connecting links to which a session is not assigned, if a new session is generated, assigns a link to a head of the IDLE Link 610, adds the session to a tail of the generated linked list, if the session is deleted due to overtime, and returns the assigned link to a tail of the IDLE Link 610, to manage the memory.
If the input SYN packet requires another session, the IDLE Link 610 assigns a link and adds a session to a tail of the SYN Link 620. Thereafter, if the SYN/ACK packet is input, a session entry moves from the SYN Link 620 to the SYN/ACK Link 630. If the ACK packet is input, the session entry moves from the SYN/ACK Link 630 to the EST Link 640.
In this regard, a network manager can establish a time required to move a session entry from a first link to a second link and add a session to a tail of the second link. In detail, the network manager establishes the movement time as a predetermined threshold value, i.e., a time-out value, and aggressively prevents an entry table of the detailed information manager 220 from being full due to an intended attack of a network attacker.
When an embryonic connection 650 moves from the IDLE Link 610 to the SYN/ACK Link 630 via the SYN Link 620, the network manager establishes the time-out value as a relatively small value, e.g., 3 seconds, since a session is not completely established. When an established connection 660 moves from the SYN/ACK Link 630 to the EST Link 640, the network manager establishes the time-out value as a relatively large value, e.g., 360 seconds, since the session is completely established.
When timeout occurs in each of the links, a session entry of each of the links is returned to a tail of a previous linked list. That is, when the timeout occurs in the SYN Link 620, the session entry is returned to the tail of the IDLE Link 610.
This aggressive aging is used to aggressively prevent the entry table of the detailed information manager 220 from being full to respond to the DoS attack such as the Syn flooding. In addition, session entry information that is returned when the timeout occurs is used to detect a distributed DoS (DDoS) attack or an Internet war.
The link movement enables a session entry to return to a tail, which results in the deletion of a header of the longest used session using a least recently used (LRU) algorithm when the entry table of the detailed information manager 220 is full.
Since the entry table managing sessions has a limited capacity, it is probably full at any given time. When it is necessary to generate another entry when the session entry is full, a least used session entry is deleted using the LRU algorithm and another entry is added. That is because even if the entry table is full, the session stateful intrusion detection system must detect a new attack.
FIG. 7 illustrates a structure of the detailed information manager 220 of FIGS. 2 and 3 according to an embodiment of the present invention. Referring to FIG. 7, the detailed information manager 220 uses 5-tuple information of a session including a protocol, a source IP address, a destination IP address, a source port number, and a destination port number which are contained in an index in order to discriminate session entries.
The index including the 5-tuple information of the session is stored in a ternary content addressable memory (TCAM) 710.
The detailed information manager 220 that includes virtual state information of a session corresponding to an input packet is stored in a static random access memory (SRAM) 720.
The index stored in the TCAM 710 points to a memory address of the entry stored in the SRAM 720. The current embodiment of the present invention is realized as hardware-based session index unit 210 and the detailed information manager 220 and thus can be replaced, modified, and substituted within the scope of the technical idea of the invention.
FIG. 8 is a flowchart of a TTL tracking process as an attack detection function performed by the detailed information manager 220 according to an embodiment of the present invention. Referring to FIG. 9, the detailed information manager 220 comprises a TTL tracking alert issuer (not shown). When a session is completely established, the TTL tracking alert issuer determines whether a packet belonging to the session is normal since packets belonging to the same session do not have a different hop count, and, if a difference between TTL values of a current packet and a previous packet exceeds a predetermined threshold, issues an alert (Operations 910 and 920).
FIG. 8 is a flowchart of a Sequence/Acknowledge number tracking process as an attack detection function performed by the detailed information manager 220 according to an embodiment of the present invention. Referring to FIG. 8, if hosts A and B communicate with each other, a SEQ/ACK number tracking alert issuer (not shown) stores an acknowledge number of a packet transmitted to the host A and window size information (the size of window of the host B) in the detailed information manager 220. If a sequence number of the packet transmitted from the host A to the host B is smaller than a last Ack transmitted from the host B to the host A (Operation 810), or a value obtained by subtracting the last Ack from a value obtained by summing the sequence number and a payload size is bigger than the window size value (Operation 820), the SEQ/ACK number tracking alert issuer (not shown) determines that the packet is abnormal and issues an alert.
FIG. 10 is a flowchart of processing a SYN packet using a TCP flag value according to an embodiment of the present invention. Referring to FIG. 10, a SYN flag is used only when a session is completely established and synchronizes sequence numbers of a client and a server before transmitting data.
When a SYN packet is input (Operation S1010), the detailed information manager 220 searches the SYN Link 620 (Operation S1020). If a session entry corresponding to the SYN packet exists in the SYN Link 620 (Operation S1030), since the SYN packet is retransmitted, the detailed information manager 220 updates a session entry including session state information (Operation S1031), and adjusts the session entry to move from the SYN Link 620 of the linked lists illustrated in FIG. 6 to a tail (Operation S1032).
If a session entry corresponding to the SYN packet does not exist in the SYN Link 620, when the session index unit 210 is not full (Operations S1040), another index is generated (Operation S1050). When the session index unit 210 is full, the longest least frequently used index is deleted using the LRU algorithm, and another index is generated (Operations S1040 and S1041).
FIG. 11 is a flowchart of processing a SYN/ACK packet according to an embodiment of the present invention. Referring to FIG. 11, when the SYN/ACK packet is input (Operation S1110), the detailed information manager 220 searches the SYN Link 620 and the SYN/ACK Link 630 (Operation S1120). If a session entry corresponding to the SYN/ACK packet exists in the SYN Link 620 (Operation S1130), the detailed information manager 220 moves the session entry to the SYN/ACK Link 630 (Operation S1131) and updates session state information of the session entry (Operation S1132).
If the session entry corresponding to the SYN/ACK packet exists in the SYN/ACK Link 630, since the SYN/ACK packet is retransmitted, the detailed information manager 220 updates a session entry including session state information, and adjusts the session entry to move from the SYN/ACK Link 630 to a tail.
FIG. 12 is a flowchart of processing an ACK packet according to an embodiment of the present invention. Referring to FIG. 12, an ACK flag is used to inform of a safe arrival of a packet, and searches the SYN/ACK Link 630 and the EST Link 640 (Operation S1220) when the ACK packet is input (Operation S1210).
If a session entry corresponding to the ACK packet exists in the SYN/ACK Link 630, the session entry is moved to the EST Link 640 and brief session state information is stored in the brief information manager 240 (Operations S1230 through S1234).
If a session entry corresponding to the ACK packet does not exist in the SYN/ACK Link 630, the brief information manager 240 is searched to generate a session entry including the brief session station information, store the session entry, and forward the ACK packet (Operations S1240 through S1242).
FIG. 13 is a flowchart of processing a RST packet according to an embodiment of the present invention. Referring to FIG. 13, a RST (rest) flag that resets connection states of related sessions searches the detailed information manager 220 and the brief information manager 240 (Operations S1320 and S1340) when the RST packet is input (Operation S1310). If an entry of a session corresponding to the RST packet exists in the detailed information manager 220 and the brief information manager 240 (Operations S1330 and S1350), the session entry is deleted from entry tables of the detailed information manager 220 and the brief information manager 240 to generate session state information (Operation S1360), and forward the RST packet.
FIG. 14 is a flowchart of processing a FIN packet according to an embodiment of the present invention. Referring to FIG. 14, a FIN flag that releases a connection state of a session when a TCP has no data to transmit searches the detailed information manager 220 when the FIN packet is input (Operation S1410). If an entry of a session corresponding to the FIN packet exists in the detailed information manager 220, the brief information manager 240 is searched. If a session entry does not exist in the detailed information manager 220, session state information is generated to forward the FIN packet.
FIG. 15 is a flowchart of processing other packets which are not illustrated in FIGS. 10 through 14 according to an embodiment of the present invention. Referring to FIG. 15, if packets other than the SYN, SYN/ACK, ACK, RST, and FIN packets are input, the detailed information manager 220 and the brief information manager 240 are searched to generate detailed information and forward packets.
The present invention can also be; embodied as computer readable code on a computer readable recording medium. The computer readable recording medium is any data storage device that can store data which can be thereafter read by a computer system. Examples of the computer readable recording medium include read-only memory (ROM), random-access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet). The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.
The present invention shows an effective performance of several hundreds of thousands to several millions sessions with limited resources in a giga scale Internet network.
The present invention tracks session state information, generates useful session state information, and transmits the session state information to an intrusion detection engine, thereby reducing a false positive alert and detecting an attack and an abnormal packet using packet information and the session state information.
Also, the present invention uses a memory management method to aggressively respond to a DoS attack such as SYN flooding.
The present invention can more accurately detect an attack by adding the session state information to a conventional hardware-based simple pattern matching intrusion detection function.
The present invention can be applied to a firewall, a virtual private network (VPN), traffic monitoring, traffic load balancing, accounting and charging, and a network intrusion detection system (NIDS).
In particular, the present invention applied to a session stateful NIDS can obtain a very excellent output in terms of function and performance.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS7290283 *Jan 31, 2002Oct 30, 2007Lancope, Inc.Network port profilingUS20040013112 *May 9, 2001Jan 22, 2004Packet Technologies Ltd.Dynamic packet filter utilizing session tracking* Cited by examinerNon-Patent CitationsReference1"Exploiting Stateful Inspection of Network Security in Reconfigurable Hardware," Shaomeng Li et al. Field-Programmable Logic and Applications, vol. 2778/2003, pp. 1153-1157.2 *Brian Dyck; SANS: Malware FAQ: Checkpoint Firewall-1 ACK DOS Vulnerability and Sample Incident. A Collection articles written 1999-2001.* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS8527627Dec 14, 2010Sep 3, 2013At&T Intellectual Property I, L.P.Intelligent mobility application profiling with respect to identified communication burstsUS8744367 *Aug 31, 2010Jun 3, 2014At&T Intellectual Property I, L.P.Tail optimization protocol for cellular radio resource allocationUS8800039 *Aug 10, 2012Aug 5, 2014Electronics And Telecommunications Research InstituteSystem and method for determining application layer-based slow distributed denial of service (DDoS) attackUS8972572Jul 31, 2013Mar 3, 2015At&T Intellectual Property I, L.P.Intelligent mobility application profiling toolUS9220066Jun 20, 2011Dec 22, 2015At&T Intellectual Property I, L.P.Bundling data transfers and employing tail optimization protocol to manage cellular radio resource utilizationUS9264872Jun 20, 2012Feb 16, 2016At&T Intellectual Property I, L.P.Controlling traffic transmissions to manage cellular radio resource utilizationUS9374824 *Apr 21, 2014Jun 21, 2016At&T Intellectual Property I, L.P.Tail optimization protocol for cellular radio resource allocationUS9578441Jan 21, 2015Feb 21, 2017At&T Intellectual Property I, L.P.Intelligent mobility application profiling toolUS9654950Jan 14, 2016May 16, 2017At&T Intellectual Property I, L.P.Controlling traffic transmissions to manage cellular radio resource utilizationUS9699737Jul 16, 2015Jul 4, 2017At&T Intellectual Property I, L.P.Bundling data transfers and employing tail optimization protocol to manage cellular radio resource utilizationUS20100296395 *May 20, 2010Nov 25, 2010Fujitsu LimitedPacket transmission system, packet transmission apparatus, and packet transmission methodUS20120052814 *Aug 31, 2010Mar 1, 2012At&T Intellectual Property I, L.P.Tail optimization protocol for cellular radio resource allocationUS20130042322 *Aug 10, 2012Feb 14, 2013Electronics And Telecommunications Research InstituteSYSTEM AND METHOD FOR DETERMINING APPLICATION LAYER-BASED SLOW DISTRIBUTED DENIAL OF SERVICE (DDoS) ATTACKUS20140059247 *Aug 19, 2013Feb 27, 2014F5 Networks, Inc.Network traffic management using socket-specific syn request cachesUS20140228040 *Apr 21, 2014Aug 14, 2014At&T Intellectual Property I, L.P.Tail optimization protocol for cellular radio resource allocation* Cited by examinerClassifications U.S. Classification726/3, 726/23International ClassificationG06F7/04Cooperative ClassificationH04L63/0254, H04L63/1458European ClassificationH04L63/14D2, H04L63/02B4Legal EventsDateCodeEventDescriptionDec 8, 2005ASAssignmentOwner name: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:YOON, SEUNG YONG;OH, JIN TAE;JANG, JONG SOO;REEL/FRAME:017352/0212Effective date: 20051117Mar 27, 2014FPAYFee paymentYear of fee payment: 4RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services

type: global

value: This website is a search engine provided by Google. Handling over 3.5 billion searches per day, it has a 92% share of the global search engine market.


text:
Refine Price $ to $ Go Top brands NCAA Logo Chair Fathead Coleman Franklin Sports Forever Collectibles Party Animal Store availability Sort Best sellers Price: low to high Price: high to low Highest rating New $69.88 - $89.88 NCAA University of Alabama Bedding Set 4.0 stars (14) ratings Free shipping on orders over $50 Free store pickup $12.96 Russell NCAA Alabama Crimson Tide, Men's Impact T-Shirt Free shipping on orders over $50 Free store pickup Rollback UCLA
$33.93 - $38.40 Franklin Sports NCAA Medium Uniform Set Free shipping on orders over $50 Free store pickup $24.00 NCAA Alabama Crimson Tide Pillow Set, 2pk 4.5 stars (3) ratings Free shipping on orders over $50 Free store pickup $11.81 12oz NCAA Alabama Crimson Tide Game Time Jar Free shipping on orders over $50 Free store pickup $14.96 Russell NCAA Alabama Crimson Tide, Big Men's Impact T-Shirt Free shipping on orders over $50 Free store pickup $14.56 NCAA Window Valance, Alabama Free shipping on orders over $50 Free store pickup $24.88 Alabama Floor Mats - Set of 2 4.0 stars (12) ratings Free shipping on orders over $50 Free store pickup $17.71 NCAA Player 48" x 71" Comfy Throw, Alabama Free shipping on orders over $50 Free store pickup $14.95 Logo Chair NCAA Alabama 50" x 60" Classic Fleece Throw 3.5 stars (2) ratings Free shipping on orders over $50 Free store pickup $12.96 Boelter Brands 22-Ounce NCAA Alabama Straw Tumbler, Pink Free shipping on orders over $50 Free store pickup New $19.96 NCAA University of Alabama Swoosh Kitchen Rug, 1'8" x 2'6" Free shipping on orders over $50 Free store pickup $22.97 NCAA Technique Series 55" x 70" Silk Touch Throw, Alabama 5.0 stars (2) ratings Free shipping on orders over $50 Free store pickup $16.08 NCAA Alabama Crimson Tide Sandwich Container Set, 4pk Free shipping on orders over $50 Free store pickup $29.88 NCAA Alabama Old Glory Tufted Nylon Rug, 3'3" x 4'11" Free shipping on orders over $50 Free store pickup today New $32.88 Alabama Anthem Twin/Full Bedding Comforter Free shipping on orders over $50 Free store pickup today $39.95 Logo Chair NCAA Alabama Big Boy Chair 2.0 stars (1) ratings Free shipping on orders over $50 Free store pickup $16.08 NCAA Alabama Football Shaped Salt and Pepper Shakers Free shipping on orders over $50 Free store pickup $26.88 NCAA 50" x 60" Sherpa Throw, Alabama Free shipping on orders over $50 Free store pickup $44.95 Logo Chair NCAA Alabama UltraSoft Blanket 5.0 stars (2) ratings Free shipping on orders over $50 Free store pickup $19.95 Logo Chair NCAA Alabama Canvas Chair 4.5 stars (2) ratings Free shipping on orders over $50 Free store pickup $21.18 Party Animal Alabama Applique Banner Flag 4.0 stars (2) ratings Free shipping on orders over $50 Free store pickup $6.14 Baby Fanatic NCAA 2-Pack Baby Pacifiers, Alabama Crimson Tide Free shipping on orders over $50 Free store pickup $29.95 Logo Chair NCAA Alabama Deluxe Chair 5.0 stars (1) ratings Free shipping on orders over $50 Free store pickup $21.99 Forever Collectibles NCAA Large Piggy Bank, University of Alabama Crimson Tide Free shipping on orders over $50 Free store pickup $20.14 NCAA 48" x 60" Tapestry Throw Home Field Advantage Series- Alabama Free shipping on orders over $50 Free store pickup Rollback $9.59 Was: $14.88 Saving: $5.29 NCAA 16 oz Alabama Crimson Tide Foldable Water Bottle Set, 2pk Free shipping on orders over $50 Free store pickup $19.70 Coleman 11" x 9" x 13" 24-Can Cooler, Alabama Crimson Tide Free shipping on orders over $50 Free store pickup today $18.88 NCAA 16" Square Pillow, Alabama 5.0 stars (1) ratings Free shipping on orders over $50 Free store pickup New $14.88 NCAA Alabama 46x60 Micro-Raschel Throw Free shipping on orders over $50 Free store pickup today Rollback $20.14 Was: $24.99 Saving: $4.85 NCAA 48" x 60" Commemorative Series Tapestry Throw, Alabama Free shipping on orders over $50 Free store pickup $21.94 Game Time NCAA Kids' University of Alabama Crimson Tide Rookie Series Watch, White Velcro Strap Free shipping on orders over $50 Free store pickup $15.80 Logo Chair NCAA Alabama Houndstooth Classic Fleece 5.0 stars (1) ratings Free shipping on orders over $50 Free store pickup $34.95 Logo Chair NCAA Alabama Cardinal Tent Side Panel Free shipping on orders over $50 Free store pickup $26.99 NCAA - Alabama Crimson Tide Head Rest Covers (2 Pack) Sold & Shipped by Pro Team $38.99 NCAA - Alabama Crimson Tide 26x42 Vinyl Grill Mat Sold & Shipped by Pro Team $13.25 Thematic Gnome, Alabama Crimson Tide Free shipping on orders over $50 Free store pickup $99.99 NCAA - Julio Jones Alabama Crimson Tide Fathead Sold & Shipped by Pro Team $12.95 Logo Chair NCAA Alabama Stadium Cushion Free shipping on orders over $50 Free store pickup $167.71 Out of stock online Coleman 10' x 10' Slant Leg Canopy, Alabama Crimson Tide 1 2 3 4 5 6 14 Next Showing 40 of 549 results Search Options
Departments For the Home Fan Shop Electronics Fan Shop Sports & Outdoor Play Fan Shop Other Fan Shop Outdoor Living Fan Shop Clothing Fan Shop Automotive Fan Shop Baby Fan Shop Luggage Fan Shop Office Fan Shop Party Supplies Fan Shop Toys & Games Fan Shop See all Departments Brand NCAA Logo Chair Fathead Coleman Franklin Sports Forever Collectibles Party Animal Campus Crystal Mounted Memories Coveroo Highland Mint Fan Mats Hot Sauce Harry's Wincraft Boelter Brands That's My Ticket Team Sports America Photo File, Inc. American Logo Products Rico Industries See more brands Price $ to $ Go 0 - $10 $10 - $20 $20 - $50 $50 - $100 $100 - $150 $150 - $200 $200 - $250 $250 - $500 $500 - $750 $750 - $1,000 $3,000+ See more prices Customer rating 4.0 stars & Up 3.0 stars & Up 2.0 stars & Up 1.0 stars & Up Color Multi Clear Red Black White Brown Gold Gray Silver Green Beige Orange Pink Yellow Other Category T-Shirts Fan Shop Throws Fan Shop Mugs & Cups Fan Shop Decorative Magnets, Stickers & Window Clings Jerseys Fan Shop Floor Mats Fan Shop Garden Sculptures & Statues Fan Shop Accent Rugs Fan Shop Beverage Coolers Fan Shop Comforters Throws Fan Shop Water Bottles & Containers Fan Shop Blankets Fan Shop Folding Tables Fan Shop Comforters & Comforter Sets Fan Shop Other Picture, Mirrors & Frames Fan Shop Area Rugs Fan Shop Grill Tools Fan Shop Bath Towels Fan Shop Framed Memorabilia See more categories Type Floor Mats Wall Decals Welcome Mats Wood Special offers New Reduced Price Rollback Clearance Retailer Walmart.com Pro Team ivgStores Tonzof Wayfair PlumStruck Sports league NCAA NFL Product Recommendations Your recently viewed items Clear this list Compute- compute-11031939-20, DC- prod-dal4, ENV- prod-a, Ver- 2.0.4, SHA- 97f9b5b67234233f7cb3dd87b6d4d08cbfb30733 Site Information Be the first to save! Email Address Sign up Privacy policy

value: This website is an American multinational retail corporation that operates a chain of hypermarkets , discount department stores, and grocery stores from the United States, headquartered in Bentonville, Arkansas.


text:
'I'm the real life Jaws': Student, 36, has condition which means his jaw bone won't stop growing | Daily Mail Online
Richard Moore had a two-and-a-half centimetre tumour on his pituitary glandThis causes too much growth hormone to be produced in his brainSo, his jaw has lengthened by 2cm causing his teeth to become misalignedHe had surgery to remove the tumour but this failed to solve the problemHe now takes medication to keep the condition under control By
11:40 EST, 20 June 2014
A 36-year-old man has a rare condition that means his jaw will not stop growing.Just like Richard Kiel, who played the Jame Bond villain Jaws, Richard Moore has acromegaly which occurs when the body produces too much growth hormone.In Mr Moore's case, the condition is caused by a two-and-a-half centimetre tumour on his pituitary gland. Richard Moore has a tumour on his pituitary gland which means too much growth hormone is produced. As a result, his jaw keeps growing. He is pictured (left) in 1999 before the problem developed and (right) in 2011
Now he is facing painful surgery to have his jaw broken and realigned because it has grown by 2cm. Mr Moore said: 'I started noticing facial changes about ten years ago, my jaw was growing outwards and my teeth were becoming misaligned.'I thought I was going mad - nobody else seemed to notice that my face was slowly changing shape.
Yale scientists successfully use arthritis drug to regrow...
'If you look back at photos of me in a timeline you can see the slow facial changes to a horrendous asymmetrical cross bite.'My jaw just kept changing over time.'Mr Moore, from Wigan, started noticing changes to his face shape at 25-years-old when he realised his teeth no longer lined up. Mr Moore (pictured in 2006) had to have surgery to remove the tumour but it failed to solve the problem
Mr Moore has the same condition as Richard Keil (pictured) who played the James Bond villain Jaws in the film The Spy Who Loved Me
He also developed strange sensations in his head and low moods before finally being diagnosed in 2012.Oral drugs and injections failed to control the tumour and eventually it had to be removed during surgery through his nose.WHAT IS ACROMEGALY?Acromegaly develops when the body produces too much growth hormone.This leads to excess growth of body tissues over time.It can cause abnormally large hands and feet, large facial features, an enlarged tongue and abnormally great height.It is caused by a tumour on the pituitary gland.Most patients can be successfully treated - brain surgery will often return hormone levels to normal.When the tumour is too large to be removed, medication can often help normalise hormone levels.Source: NHS Choices
Mr Moore, a student at Salford University studying wildlife conservation and zoo biology, said: 'I was diagnosed in 2012 after I got terrible headaches, broke out in sweats and had other strange symptoms.'It is fair to say that I have always been conscious about my strong jawline - but there have been noticeable changes in my jaw over the last ten years.'I couldn’t believe I’d had the condition for so long without knowing - I should have spent more time looking in the mirror and found a new dentist.'Mr Moore has bee warned by doctors that the condition can result in severe disfigurement, serious complicating conditions, and premature death if left unchecked.Mr Moore's surgery was thought to be successful but in January last year his symptoms returned.He said: 'I’m now on monthly chemical therapy which controls the residual tumour and the hormones it emits.'I
sometimes do feel tired with a loss of energy, but compared to where I was before my operation and treatment it’s massively improved.'I
am out running every weekend but without the amazing care of the NHS healthcare professionals at The Christie, Salford Royal and my GP Dr J D
Seabrook, I would not be where I am today. I am extremely grateful.' Mr Moore (pictured, left, in 2003 and, right, in 2005) was only diagnosed with the tumour when he developed severe headaches and a low mood. He also experienced strange sensations in his head
Mr Moore (pictured in 2011) is now facing painful surgery to have his jaw broken and realigned because his teeth are out of alignment as a result of the bone growth
A spokesperson from The Pituitary Foundation said: 'Acromegaly is a hormonal disorder that results from too much Growth Hormone (GH) in the body.'Acromegaly is caused by a benign tumour of the pituitary gland, which is called an adenoma and this causes the pituitary to produce too much GH.'The nasal bone enlarges and teeth may be spaced out. An overgrowth of bone and cartilage can lead to arthritis and when tissue thickens it may trap nerves, causing carpal tunnel syndrome which results in weakness, numbness or pain in the hands.'Organs in the body, such as the heart can also enlarge.' Share or comment on this article

value: This website is the website of the Daily Mail, a newspaper in the United Kingdom, and of its sister paper The Mail on Sunday. MailOnline is a division of dmg media, which is owned by Daily Mail and General Trust plc.


text:
FamilySearch BlogStay current with genealogy and family history topics by reading the FamilySearch blog. Find out insights into our future and our past. Blog / Archives for 20142014 Indexing Year in Review January 2, 2015 By Spencer Ngatuvai It is hard to believe that 2014 has already come and gone. Did you accomplish the goals you set for last year? Hopefully, you were able to shed those few pounds, find the love of your life, or snorkel at the Great Barrier Reef. Perhaps you finally learned how to make an omelet or, better […]
Filed Under: FamilySearch Indexing 143 Comments Tagged With: 2014, Christmas, FamilySearch Indexing, indexing obituaries, new indexing program, Worldwide Indexing EventHow One Man Writes His Personal History–Three Words at a Time July 31, 2014 By Ellen Bahr It might be an exaggerated figure, but author and blogger Randal Wright estimates that 99.9% of people don’t keep detailed personal histories or journals. Assuming you’re in that majority, why aren’t you writing your life stories down? People offer plenty of excuses: too little time, laziness, the feeling of being so far behind it’s impossible […]
Filed Under: Family Relations, Photos and Stories 9 Comments Tagged With: 2014, Autobiographies, BYU Family History Conference, Personal History, Stories and Memories, Writing Subscribe to RSS Feed

value: This website is a nonprofit organization and website offering genealogical records, education, and software. It is operated by The Church of Jesus Christ of Latter-day Saints , and is closely connected with the church's Family History Department.


text:
Patent US6479155 - Fire-retarding glass which has, in addition to high fire resistance ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsA fire-resistant laminated glass pane assembly comprises a glass-ceramic pane resistant to high temperatures and having rough light-diffusing surfaces, the said pane being joined, on each of its two faces, to a silicate glass pane by means of transparent intermediate layers having a refractive index...http://www.google.com/patents/US6479155?utm_source=gb-gplus-sharePatent US6479155 - Fire-retarding glass which has, in addition to high fire resistance, increased mechanical stability and safety glass properties against injuries caused by splintersAdvanced Patent SearchPublication numberUS6479155 B1Publication typeGrantApplication numberUS 09/109,838Publication dateNov 12, 2002Filing dateJul 2, 1998Priority dateJul 9, 1997Fee statusLapsedAlso published asCA2243038A1, CA2243038C, CN1204628A, CN1307049C, DE19729336A1, DE69835258D1, EP0890431A2, EP0890431A3, EP0890431B1Publication number09109838, 109838, US 6479155 B1, US 6479155B1, US-B1-6479155, US6479155 B1, US6479155B1InventorsUdo Gelderie, Simon FrommeltOriginal AssigneeVetrotech Saint-Gobain International AgExport CitationBiBTeX, EndNote, RefManPatent Citations (9), Referenced by (11), Classifications (24), Legal Events (6) External Links: USPTO, USPTO Assignment, EspacenetFire-retarding glass which has, in addition to high fire resistance, increased mechanical stability and safety glass properties against injuries caused by splinters
US 6479155 B1Abstract
A fire-resistant laminated glass pane assembly comprises a glass-ceramic pane resistant to high temperatures and having rough light-diffusing surfaces, the said pane being joined, on each of its two faces, to a silicate glass pane by means of transparent intermediate layers having a refractive index corresponding to the refractive index of the glass and the glass-ceramic. Transparent intermediate plies consist of a thermoplastic polymer having a high splinter fixation effect, and the silicate glass panes consist of tempered float glass. Fire-retarding glasses of this type not only have a high fire-retarding effect, but also withstand the so-called extinguishing water test and, moreover, have safety glass properties with increased safety in respect of injuries caused by splinters.
What is claimed is: 1. Fire-resistant laminated glass pane assembly consisting essentially of a glass-ceramic pane having first and second surfaces, a first sheet of thermoplastic polymer adhered to the first surface and a second sheet of a thermoplastic polymer adhered to the second surface, and two thermally tempered silicate glass panes, one adhered to the first thermoplastic sheet and one adhered to the second thermoplastic sheet, wherein each of the first and second polymer sheets has a refractive index which is essentially the same as that of the glass-ceramic pane.
2. Fire-resistant laminated glass pane assembly according to claim 1, wherein each of the thermoplastic intermediate layers is polyvinylbutyral, polyurethane, a copolymer of ethylene and vinyl acetate or a fluorinated hydrocarbon copolymer.
3. Fire-resistant laminated glass pane assembly according to claim 1, wherein each thermally tempered silicate glass pane has a coefficient of thermal expansion of >8.5�10−6K−1 and a softening temperature of about 730� C.
4. Fire-resistant laminated glass pane assembly according to claim 3, wherein the thermally tempered glass panes has a coefficient of thermal expansion α20-300 of 6 to 8.5�10−6K−1 and a softening temperature of 750 to 830� C.
5. Fire-resistant laminated glass pane assembly according to claim 4, wherein each thermoplastic intermediate layer is polyvinylbutyral, polyurethane, a copolymer of ethylene and vinyl acetate or a fluorinated hydrocarbon copolymer.
6. A fire-resistant laminated glass pane assembly suitable for mounting in a frame comprising a glass-ceramic pane having first and second surfaces; a first sheet of thermoplastic polymer adhered to the first surface and a second sheet of a thermoplastic polymer adhered to the second surface; a first thermally tempered silicate glass pane having a third and a fourth side, wherein the third side is adhered to the first thermoplastic sheet and the fourth side is exposed; and a second thermally tempered silicate glass pane having a fifth and a sixth side wherein the fifth side is adhered to the second thermoplastic sheet and the sixth side is exposed, and wherein each of the first and second polymer sheets has a refractive index which is essentially the same as that of the glass-ceramic pane.
7. Fire-resistant laminated glass pane assembly according to claim 6, wherein each of the thermoplastic intermediate layers is polyvinylbutyral, polyurethane, a copolymer of ethylene and vinyl acetate or a fluorinated hydrocarbon copolymer.
8. Fire-resistant laminated glass pane assembly according to claim 6, wherein each thermally tempered silicate glass pane has a coefficient of thermal expansion of >8.5�10−6K−1 and a softening temperature of about 730� C.
9. Fire-resistant laminated glass pane assembly according to claim 8, wherein the thermally tempered glass panes has a coefficient of thermal expansion α20-300 of 6 to 8.5�10−6K−1 and a softening temperature of 750 to 830� C.
10. Fire-resistant laminated glass pane assembly according to claim 9, wherein each thermoplastic intermediate layer is polyvinylbutyral, polyurethane, a copolymer of ethylene and vinyl acetate or a fluorinated hydrocarbon copolymer.
The present invention relates to a fire-resistant laminated glass pane assembly comprising a glass-ceramic pane resistant to high temperatures and to thermal shocks and having rough light-diffusing surfaces, the said pane being joined, on each of its two faces, to a silicate glass pane by means of transparent intermediate layers having a refractive index corresponding to the refractive index of the glass-ceramic pane.
A laminated glass pane assembly of this type is known from the document EP-A-O 524, 418. The glass-ceramic pane has a particularly low coefficient of thermal expansion and a relatively high softening temperature and is thereby suitable, to a particular extent, for being used as fire-retarding glass. The glass-ceramic panes, are due to their extremely low coefficient of thermal expansion, so insensitive to rapid temperature variations that they even withstand the so-called extinguishing water test, during which a jet of extinguishing water is projected onto a glass-ceramic pane heated to 800� C.
Owing to the way in which they are manufactured, however, glass-ceramic panes possess a rough surface and do not have clear transparency on account of their light-diffusing effect. So that it can be used, nevertheless, as transparent fire-retardant glazing, without a complicated grinding-down and polishing operation, the glass-ceramic pane in the known fire-retarding glass is combined optically with clear transparent silicate glass panes by means of transparent layers having the same refractive index. The surface roughness originally causing the light-diffusing effect of the glass-ceramic pane therefore does not become apparent.
The transparent intermediate layers between the glass-ceramic pane and the glass panes consist, in the known fire-retarding glass of the type described above, of an inorganic material which foams under a heat effect, in particular of hydrous sodium silicate. These intermediate layers of sodium silicate are made by casting the sodium silicate, in a form suitable for casting, containing 30 to 34% by weight of water, onto the two silicate glass panes and allowing it to dry and by subsequently joining the coated glass panes to the glass-ceramic pane in the autoclave under the effect of heat and pressure.
Fire-retarding glasses of this type have very good fireproof properties. They, nevertheless, do not have safety glass properties in terms of safety against injuries caused by splinters when the fire-retarding pane assembly breaks, for example when a person falls into a fire-retarding pane assembly of this type. In fact, the intermediate sodium silicate there does not, as such, have splinter fixation properties, as do intermediate polymer plies normally used for laminated safety glass. In many cases, however, it is desirable for fire-retarding glasses also to have safety glass properties in addition to their fireproof properties, that is to say preventing serious injuries caused by splinters when the body comes in contact with the fragmented fire-retarding glass.
Moreover, in known fire-retarding glass, the outer silicate glass panes break under shock-induced mechanical stress into large fragments which have sharp edges. Furthermore, both the two glass panes and the glass-ceramic pane have only relatively low bending strength, and this also has an adverse effect on safety glass properties because they break easily under sharp shock-induced stress.
The object of the invention is, by using a glass-ceramic pane, to develop a fire-retarding glass which has, in addition to high fire resistance, increased mechanical stability and safety glass properties against injuries caused by splinters.
According to the invention, this object is achieved in that the transparent intermediate layers between the glass-ceramic pane and the contiguous silicate glass panes consist of a thermoplastic polymer having a high splinter fixation effect, and in that the silicate glass panes are tempered thermally.
Tempered glass panes have, as such, the advantage, as a result of their compressive prestresses in their superficial regions and in the peripheral region, of possessing greatly increased tensile strength in the peripheral region and, overall, substantially higher bending strength than normal, that is to say non-tempered, glass panes. The high compressive stress in the peripheral region results in tempered glass panes having substantially increased durability in the event of fire, because the tensions, which occur in the peripheral region due to the temperature difference between the periphery sealed in the frame and the pane surface exposed to the fire, are first compensated by the compressive prestresses, in such a way that tempered glass panes do not break until much later.
Admittedly, since a polymer is used for the intermediate layer, fireproof protection is reduced, as compared with the known fire-retarding pane assembly, because the thermal insulating capacity of the polymer which carbonizes is lower than the thermal insulating capacity of the sodium silicate layer which foams. In other respects, however, this disadvantage is at least partially compensated by means of the fire-retarding pane according to the invention, due to the fact that the intermediate plies remain intact for longer on account of the longer resistance of the tempered glass panes. By contrast, the non-tempered glass panes of the known fire-retarding glazing normally collapse after fragmentation and take away with them parts of the foaming intermediate layer, so that the latter is weakened to a greater or lesser extent and consequently loses its thermal insulating capacity.
The particular advantages of the fire-retarding glass according to the invention are that, in terms of comparable fire resistance properties, it has substantially greater stability against mechanical shocks and bending stresses and, on the other hand, also pronounced safety glass properties against injuries caused by splinters.
The tempered glass panes used may, for example, be tempered glass panes made from commercial float glass. Commercial float glass has a coefficient of thermal expansion of >8.5�10−6K−1 and, due to this relatively high coeffecient of thermal expansion, it may be tempered by means of conventional tempering installations such that it is capable of achieving bending strengths rising to 200 N/mm2, measured according to DIN 52303 or EN 12150. Such tempered float glass panes divide into small harmless grains of glass when they are fragmented. In other respects, however, float glass panes lose their stability owing to their relatively low softening temperature of about 730� C., so that the thermal insulating effect of the carbonized intermediate ply is lost when float glass panes release the intermediate ply as a result of their softening. It is possible, however, to use tempered glass panes made from glasses which have a coefficient of thermal expansion α20−300 of >8.5�10−6K−1, in particular of 6 to 8.5�, 10−6K−1, and a softening point of 750 to 830� C. These glasses, on the one hand, can be sufficiently tempered by means of existing tempering installations to have the required safety glass properties and, on the other hand, a markedly higher softening temperature, so that their stability is appreciably longer in the event of a fire.
The most varied polymer sheets available on the market may be used as thermoplastic intermediate layers, as long as they have the splinter fixation effect required for safety glass. The intermediate thermoplastic plies may consist either of the same or different materials. Sheets of polyvinyl butyral (PVB), polyurethane (TPU), copolymers of ethylene and vinyl acetate (EVA) or fluorinated hydrocarbons (THV) come under consideration, in particular, for this purpose. The advantage of THV sheets, in particular, is that they are hardly inflammable. In the event of a fire, virtually no inflammable decomposition product is formed when these sheets are used.
Two practical examples of fire-retarding glasses according to the invention are described in more detail below.
A laminated glass pane assembly having surface dimensions of 1.33�0.75 m2 was manufactured from a glass-ceramic pane having a thickness of 5 mm (KERALITE from the company KERAGLASS, France), from two outer glass sheets, each having a thickness of 5 mm, made of thermally tempered float glass, and from two PVP sheets, each having a thickness of 0.38 mm, according to a known autoclave method under the effects of heat and pressure.
The laminated glass pane assembly was mounted in a conventional steel frame, with a surround of 12 mm, and was introduced into an open-flame furnace, in which the fire test was conducted for DIN 4102 or ISO/DIS 834-1 according to the so-called standard temperature curve (ETK).
10 minutes after the start of the fire test, the glass sheet facing the fire crumbled. The PVB, thus released, caught fire and decomposed. The glass-ceramic pane and the tempered glass pane away from the fire did not break and consequently ensured that the furnace chamber was completely leaktight. The fire test was interrupted after 45 minutes. The glass-ceramic pane had a temperature of 805� C. at the end of the fire test. Immediately after the burner stopped, the fire-retarding glazing was cooled violently from outside by means of a strong jet of water. The outer tempered glass pane was immediately fragmented. The glass-ceramic pane, nevertheless, withstood the jet of water without breaking.
A laminated glass pane assembly having surface dimensions of 1.33�0.75 m2 was manufactured from the same glass panes and a glass-ceramic pane as in Example 1, which, however, in this case were joined together by means of thermal plastic sheets having a thickness of 0.5 mm, formed from a fluorinated hydrocarbon polymer (THV product from the company DYNEON, Germany), by means of an autoclave method under the effects of heat and pressure.
This laminated glass pane assembly was subjected, once again, to the fire test in an open-flame furnace, as in Example 1.
About 12 minutes after the start of the fire test, the tempered glass pane facing the fire crumbled, so that the thermoplastic sheet arranged on the same side as the fire was exposed to the latter. However, the material of the sheet did not catch fire, but experienced slow thermal decomposition. No release of gaseous and/or combustible decomposition products outside the furnace in the region of the frame gripping the laminated glass pane assembly was observed. The fire test was interrupted after 95 minutes. At this moment, the glass-ceramic pane and the outer glass pane were still intact and, in the meantime, had reached a temperature of 830� C.
Immediately after the burner stopped, the fire-retarding pane was cooled violently from outside by means of a jet of extinguishing water. The outer glass pane then broke immediately. However, the glass-ceramic pane withstood the jet of water, without breaking, and, from then on, ensured that the chamber was sealed off intact.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS4071649 *May 21, 1976Jan 31, 1978Glaverbel-MecaniverFireproof glassworkUS4104427 *Aug 10, 1976Aug 1, 1978Bfg GlassgroupLaminated light-transmitting fire-screening panelUS4444825 *Aug 23, 1982Apr 24, 1984GlaverbelFire-screening panelUS4762746 *Jul 21, 1987Aug 9, 1988Odenwald-Chemie GmbhCarbon fillersUS5434006 *Apr 25, 1994Jul 18, 1995GlaverbelRadiation transparent fireproof coatings of glassUS5565273 *Aug 5, 1993Oct 15, 1996Vetrotech AgTransparent heat protection elementUS5895721 *Mar 13, 1996Apr 20, 1999Saint-Gobain VitrageLaminated glass and primer used for its productionUS5908704 *Jun 30, 1997Jun 1, 1999Norton Performance Plastics CorporationOptical and firescreening protective glazing laminates comprising fluoropolymer interlayer films and reinforcement layerEP0524418A1Jun 14, 1992Jan 27, 1993Glaverbel S.A.Fire-resistant panel* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS6770375 *Apr 5, 2001Aug 3, 2004Schott GlasGlass contains nucleating agents for at least partially ceramicizing said glass so that a crystal phase forms in said glass body when said glass body is subjected to a thermal stressUS7351468Dec 2, 2005Apr 1, 2008E. I. Du Pont De Nemours And CompanyInterlayers for laminated safety glass with superior de-airing and laminating properties and process for making the sameUS7399525Nov 2, 2004Jul 15, 2008Solutia IncorporatedPolymer sheets comprising a fluoropolymerUS7678441Mar 20, 2007Mar 16, 2010E.I. Du Pont De Nemours And CompanySafety glasses having two glass layes with a thermoplastic interlayer sheet/film of unplasticized polymer of ethylene-acid copolymer or ionomer having embossed surface with a pattern of relatively uninterrupted channels for vacuum deaeration in two non-parallel directions spaced apart; qualityUS8161862 *Oct 11, 2007Apr 24, 2012Corning IncorporatedHybrid laminated transparent armorUS8544376Dec 29, 2011Oct 1, 2013Schott CorporationGlass-ceramic with laminatesUS8758898Sep 30, 2011Jun 24, 2014Liveglass, Inc.Thermoplastic multilayer interlayer polymer film and related glass laminate composite including sameEP2126509A2 *Mar 20, 2008Dec 2, 2009Dynamic Defense Materials, LLCTransparent armor system and method of manufactureEP2259003A2 *Mar 20, 2008Dec 8, 2010Dynamic Defense Materials, LLCTransparent armor system and method of manufactureWO2006050218A1 *Oct 28, 2005May 11, 2006Solutia IncPolymer sheets comprising a fluoropolymerWO2014094845A1 *Dec 19, 2012Jun 26, 2014Schott AgProtective glazing comprising transparent ceramic* Cited by examinerClassifications U.S. Classification428/426, 428/920, 428/421, 428/410, 428/451, 428/442, 428/425.6International ClassificationB32B17/10, C03C27/12, B32B17/00, C03C10/00Cooperative ClassificationY10S428/92, B32B17/10788, B32B17/1055, B32B17/10761, B32B17/10036, B32B17/10045, B32B17/1077European ClassificationB32B17/10G36, B32B17/10C4, B32B17/10C4B, B32B17/10G, B32B17/10G30, B32B17/10G28Legal EventsDateCodeEventDescriptionDec 30, 2014FPExpired due to failure to pay maintenance feeEffective date: 20141112Nov 12, 2014LAPSLapse for failure to pay maintenance feesJun 20, 2014REMIMaintenance fee reminder mailedMay 3, 2010FPAYFee paymentYear of fee payment: 8Apr 14, 2006FPAYFee paymentYear of fee payment: 4Sep 15, 1998ASAssignmentOwner name: VETROTECH SAINT-GOBAIN INTERNATIONAL AG, SWITZERLAFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GELDERIE, UDO;FROMMELT, SIMON;REEL/FRAME:009458/0395;SIGNING DATES FROM 19980803 TO 19980807RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services


text:
and that the Spirits had perhaps sent it late to pro-
tect us from some unknown danger. The snow-
laden northern winds howled at us mercilessly and
stung our eyes to the quick with blinding chunks
of snow, but we kept on. We travelled without a
halt until it broke early the next morning. Then
we all stopped and dug into the snow and pitched
our camp. As we dug our beds into the snow
and curled up to sleep, we wondered if the Crows
had got home alive without their blankets and
When we awoke many hours later we discovered
that one of our warriors. Roving Night Eagle,
was missing. His wife said that he had not been
with us at any time during the storm, but she had
thought that he was with the horses. Roving
Night Eagle was the best marksman in our tribe,
a brave of great renown on the war-path. Now
the Crows had got him. Some of our braves were
angry at this; for, they said. White Dog had told
us that we were going to �take? four of the enemy
and that we were not going to 'give' any of our
number to the Crows, White Dog ordered them
to stop the discussion, saying that the "Spirits
never spoke falsely* to him, and that if they had
told him that, it was right.
It was the first time White Dog had ever given
out a forecast that did not come true! And some
of our older men said that his medicine powers

value: This website is an American digital library with the stated mission of "universal access to all knowledge". It provides free public access to collections of digitized materials, including websites, software applications/games, music, movies/videos, moving images, and millions of books.


text:
BBB Business Profile | Integrity First Automotive, LLC
Home > Utah > West Jordan > Auto Services > Integrity First Automotive, LLC
Integrity First Automotive, LLC
West Jordan, UT 84088-9419
service@integrityfirstauto.com
Business Incorporated: 05/07/2003 in UT
Integrity First Automotive, LLC has received 4.47 out of 5 stars based on 5 Customer Reviews and a BBB Rating of A+.

value: This website is a private, nonprofit organization whose self-described mission is to focus on advancing marketplace trust, consisting of 106 independently incorporated local BBB organizations in the United States and Canada, coordinated under the International Association of Better Business Bureaus  in Arlington, Virginia.The Better Business Bureau is not affiliated with any governmental agency. Businesses that affiliate with the BBB and adhere to its standards do so through industry self-regulation.


text:
Simplify Your Life: Elaine St. James: 9780786880003 - Christianbook.com
Stock No: WW80037
The more complex life becomes, the more people crave simplicity. Whether it's in your work, relationships, health, finances, or leisure time, simplicity expert Elaine St. James can help you learn to unwind and improve the quality of your life. If you're overpowered, overextended, and overwhelmed by the go-go lifestyle of the past decade, Simplify Your Life is your antidote. Providing one hundred proven, practical steps for creating a simple and satisfying way of life.
Dimensions: 6 X 5.38 X 0.63 (inches)
ISBN: 0786880007
ISBN-13: 9780786880003
$11.99 Retail: $21.45 Save 44% ($9.46)
Journey: Disciples, Leader Guide (NIV 1984)
$30.49 Retail: $42.85 Save 29% ($12.36)
I'm the author/artist and I want to review Simplify Your Life.

value:
This website is a Christian catalog and internet retailer.
Christian Book Distributors was started in 1978 by Stephen Hendrickson, 19 years old and a sophomore at Central Bible College in Springfield, Missouri, out of his parents’ home in Lynn, Massachusetts.


text:
Bernie Sanders Has Killer Mike in His Corner - The New York Times
Politics|Bernie Sanders Has Killer Mike in His Corner
https://nyti.ms/1OEKbJb
By JONAH BROMWICH JAN. 8, 2016
Senator Bernie Sanders embraced the rapper Killer Mike after speaking onstage at a campaign event at the Fox Theater in Atlanta in November. Credit David Goldman/Associated Press
In July, the Twitter account of Senator Bernie Sanders of Vermont sent a single tweet that convinced Michael Render that this was the most exciting candidate he had ever seen.
Mr. Render, better known as Killer Mike, is a rapper by trade, one half of the duo Run the Jewels. He is also steeped in political history, particularly that of his native Atlanta. The senator’s statement about the importance of restoring the Voting Rights Act won an immediate endorsement from Killer Mike.
“It’s official, I support @SenSanders” Mr. Render wrote on Twitter, using the senator’s handle. “His call 4 the restoration of the voters rights act sealed the deal for me.”
Since then, Mr. Render, 40, has become one of Mr. Sanders’s most visible advocates. A series of video interviews he recorded with the senator in Atlanta were published on YouTube in December. Collectively, the videos, which range from six to 13 minutes in length, have been viewed well over a million times.
Senator Bernie Sanders spoke during a meeting with local activists and community members in Chicago in December with the rapper Killer Mike, left, and State Representative La Shawn Ford. Credit Joshua Lott/Getty Images
Killer Mike has also traveled with the campaign, appearing at a rally in Chicago in late December just days after having his wisdom teeth removed. On Tuesday, he appeared on “The Late Show With Stephen Colbert,” where he spoke in support of his candidate.
In an interview, Mr. Render repeated the message he delivered to the “Late Show” audience, saying that Mr. Sanders’s politics were directly in line with the ideology of the Rev. Dr. Martin Luther King Jr.
“Bernie Sanders has been the only politician in my lifetime that I have heard talk about reform that was directly out of King-ian organizing philosophy,” he said.
Mr. Render and other hip-hop artists who have voiced support for the senator — including Lil B, Big Boi and Bun B — are potentially important advocates for the Sanders campaign as it attempts to chip away at Hillary Clinton’s lead among black voters. A New York Times/CBS Poll conducted last month found that 82 percent of African-Americans who planned to vote in the Democratic primary supported Mrs. Clinton, while just 8 percent supported Mr. Sanders.
On a call with reporters on Thursday, Ron Lester, a pollster for the Clinton campaign, said that in South Carolina, Mrs. Clinton was supported by 76 percent of black voters, while Mr. Sanders was polling at 10 percent.
A Clinton aide emphasized Mrs. Clinton’s support among African-Americans and named African-American artists who are supporting her campaign, including Snoop Dogg, Usher and Waka Flocka Flame.
But others say Mr. Sanders still has a chance to make up ground. While acknowledging Mrs. Clinton’s firm base of support among African-American voters, the Democratic strategist Donna Brazile said that “there’s enough votes on the table for Bernie.”
“There are voters on the margin in the African-American community who don’t have history with the Clintons,” she said. “When it comes to scripture, Hillary Clinton knows the message and the melody for black voters. But Hillary has to earn the votes.”
She also recalled that in 2007, Mrs. Clinton had been beating Barack Obama in the polls among African-Americans. But in the course of the campaign, black voters began to make a shift to the eventual president, and ended up representing a significant part of the coalition that elected him.
Mr. Render supported Mr. Obama in that election, seeing him as a landmark candidate who would provide inspiration to a generation of African-American children. But he says that from a policy perspective, he is more enthusiastic about Mr. Sanders.
Senator Bernie Sanders with the rapper Killer Mike at the Busy Bee Cafe in Atlanta in November. Credit David Goldman/Associated Press
Mr. Render grew up in a politically engaged family. Raised by his maternal grandparents, one a Democrat, the other a “fierce libertarian,” he became an activist in his community as a teenager. He worked with Black Teens for Advancement, an anti-violence organization in Atlanta, and later with the Atlanta/Fulton Commission on Children and Youth, and its program, Kids 4 a Change.
“They were my passions, rapping and organizing,” he said. “Organizing helped me feel better about being able to affect my community immediately. Organizing gave me an outlet and rap music gave me a voice.”
He started rapping under the pseudonym Skunk, but a local D.J. nicknamed him Killer Mike after he outrapped a room of competitors in high school and the name stuck. He said that he is not concerned about people ignoring his message because of the name, comparing himself to other musicians who have gone by the name “killer.”
“You have to say to yourself, ‘well Jerry Lee Lewis wasn’t a killer and the band The Killers aren’t killers, so let me Google him and see what he’s about,’” he said. If the name holds outsize weight with people, he said, they “want to think badly of me already.”
Mr. Render’s strong advocacy for Mr. Sanders is part of a long marriage between rap and politics. According to the hip-hop historian Shea Serrano, author of “The Rap Year Book” (to which I contributed a blurb), the two have been closely intertwined since the 1980s, when politicians started condemning gangster rappers like N.W.A., and rap groups like Public Enemy were writing explicitly political songs.
Now, a new generation of political rappers, of which Mr. Render is an older representative, has ascended to the national stage. Kendrick Lamar, a rapper from Compton, Calif., who was nominated for eight Grammys this year, turned heads with “Alright,” a cutting song that prominently mentions police brutality. Vince Staples, a younger artist, has also gained notice for his social commentary.
Mr. Render says the rise of his artistic profile has given his political message a boost.
“I was as vocal and as adamant” in past years, he said. “Just more people are tuned in now.”
Mr. Serrano agreed that any political credibility Mr. Render had with audiences was amplified by his artistic credibility.
“You have this very charismatic and powerful presence in Killer Mike. I wasn’t paying attention to Bernie Sanders until Killer Mike put his name next to him. Then I was like, ‘I guess I better pay attention to Bernie Sanders now.’ ”
“I think he’s done a phenomenal job, but he has a lot of ground to make up,” Ms. Brazile said of Mr. Render’s political advocacy. “Bernie Sanders doesn’t have 25 years of what I call attending church. But he has people who know exactly where the churches are, and that’s a good thing.”
A version of this article appears in print on January 10, 2016, on Page A17 of the New York edition with the headline: Rapper’s Support Is Seen as Boon to Sanders Camp. Order Reprints| Today's Paper|Subscribe

value: This website is an American daily newspaper based in New York City with a worldwide readership. Founded in 1851, the Times has since won 132 Pulitzer Prizes, the most of any newspaper, and has long been regarded within the industry as a national "newspaper of record".


text:
Peter Millar 100% Cotton Blue with Micro-Dot Pattern Polo Shirt NWT Medium $98 889724701512 | eBay
Details about Peter Millar 100% Cotton Blue with Micro-Dot Pattern Polo Shirt NWT Medium $98
Peter Millar 100% Cotton Blue with Micro-Dot Pattern Polo Shirt NWT Medium $98
17 Nov, 2018 12:04:52 AEDST
Approximately AU $83.30(including postage)
austen-mayfair (5906 )
142979033325
Last updated on 14 Nov, 2018 14:34:26 AEDST View all revisions
Color: Blue UPC: 889724701512
Visit Store: austen-mayfair
Hickey Freeman Outerwear
Hickey Freeman Sweaters
Peter Millar Striped 100% Cotton Casual Shirts for Men,
Peter Millar 100% Cotton Polo, Rugby Casual Shirts for Men,
Peter Millar 100% Cotton Casual Shirts for Men,
Peter Millar Solid Pattern 100% Cotton Casual Shirts for Men,
Peter Millar Long Sleeve 100% Cotton Casual Shirts for Men,
Peter Millar Plaids & Checks 100% Cotton Casual Shirts for Men

value: This website is an American multinational e-commerce corporation based in San Jose, California, that facilitates consumer-to-consumer and business-to-consumer sales through its website.