Justia Patents Particular Communication Authentication TechniqueUS Patent for Transport layer security session man-in-the-middle attack prevention Patent (Patent # 11,381,595)
Transport layer security session man-in-the-middle attack prevention
Nov 9, 2018 - IBM
Preventing Transport Layer Security session man-in-the-middle attacks is provided. A first security digest generated by an endpoint device is compared with a second security digest received from a peer device. It is determined whether a match exists between the first security digest and the second security digest based on the comparison. In response to determining that a match does not exist between the first security digest and the second security digest, a man-in-the-middle attack is detected and a network connection for a Transport Layer Security session is terminated with the peer device.
Latest IBM Patents:
EMS assisted fault handling in virtual network function components
Reduction of drain leakage in nanosheet device
Chat interaction with multiple virtual assistants at the same time
Determining peripheral device position relative to a primary display
Setting timers based on processing of group communications using natural language processing
BACKGROUND 1. Field
The disclosure relates generally to network security and more specifically to preventing Transport Layer Security session man-in-the-middle attacks between data processing devices connected to a network.
In network security, a man-in-the-middle attack is where an attacker secretly intercepts, relays, and possibly alters data, such as messages or transactions, between two network devices. For example, the man-in-the-middle attacker makes independent connections with both network devices and relays data between them, making the devices believe that they are directly communicating with one another over the network connection. Thus, the attacker is able to intercept, read, and then pass data between the two devices. In addition, the attacker may alter intercepted data and possibly inject new data. However, a man-in-the-middle attack can only succeed when the attacker remains undetected by impersonating each endpoint to their satisfaction.
According to one illustrative embodiment, method for preventing Transport Layer Security session man-in-the-middle attacks is provided. A first security digest generated by an endpoint device is compared with a second security digest received from a peer device. It is determined whether a match exists between the first security digest and the second security digest based on the comparison. In response to determining that a match does not exist between the first security digest and the second security digest, a man-in-the-middle attack is detected and a network connection for a Transport Layer Security session is terminated with the peer device. According to other illustrative embodiments, a computer system and computer program product for preventing Transport Layer Security session man-in-the-middle attacks are provided.
FIG. 1 is a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented;
FIG. 2 is a diagram of a data processing system in which illustrative embodiments may be implemented;
FIG. 3 is a diagram illustrating an example of a Transport Layer Security session man-in-the-middle attack detection system in accordance with an illustrative embodiment;
FIGS. 4A-4B are a flowchart illustrating a process for a Transport Layer Security session endpoint device in accordance with an illustrative embodiment; and
FIGS. 5A-5B are a flowchart illustrating a process for a Transport Layer Security session peer device in accordance with an illustrative embodiment.
The present invention may be a system, a method, and/or a computer program product at any possible technical detail level of integration. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the Figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
With reference now to the figures, and in particular, with reference to FIGS. 1-3, diagrams of data processing environments are provided in which illustrative embodiments may be implemented. It should be appreciated that FIGS. 1-3 are only meant as examples and are not intended to assert or imply any limitation with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made.
FIG. 1 depicts a pictorial representation of a network of data processing systems in which illustrative embodiments may be implemented. Network data processing system 100 is a network of computers, data processing systems, and other devices in which the illustrative embodiments may be implemented. Network data processing system 100 contains network 102, which is the medium used to provide communications links between the computers, data processing systems, and other devices connected together within network data processing system 100. Network 102 may include connections, such as, for example, wire communication links, wireless communication links, and fiber optic cables.
In the depicted example, server 104 and server 106 connect to network 102, along with storage 108. Server 104 and server 106 may be, for example, server computers with high-speed connections to network 102. In addition, server 104 and server 106 may provide one or more services, such as, for example, e-commerce services, financial services, banking services, governmental services, educational services, reservation services, data services, and the like, requiring secure connections with client devices for data security. Also, it should be noted that server 104 and server 106 may each represent clusters of servers in data centers. Alternatively, server 104 and server 106 may each represent computing nodes in cloud environments hosting different services.
Server 104 and server 106 may utilize, for example, Transport Layer Security to provide the secure network connections for data security. Transport Layer Security is a cryptographic protocol designed to provide data communication security over a network. The network connection is secure or private because symmetric cryptography is used to encrypt the transmitted data. Session-specific cryptographic keys for the symmetric cryptographic encryption are uniquely generated for each network connection and are based on a shared secret that was negotiated at the start of the network session during the Transport Layer Security handshake procedure. The involved network devices negotiate the details of which encryption algorithm and cryptographic keys to use before data is transmitted. It should be noted that if one of the handshake procedure steps fails, then the secure connection is not created. Transport Layer Security is the most widely deployed security protocol used today and is used for Web browsers and other applications that require data to be securely exchanged over a network, such as, for example, financial transactions, file transfers, virtual private network connections, email, instant messaging, voice over Internet Protocol, and the like.
To increase network security, server 104 and server 106 may also utilize Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) puzzles. CAPTCHA puzzles are a type of challenge-response test used to determine whether the service requesting user is a human or another computer where human interaction is essential to security. CAPTCHA puzzles require the user to simultaneously use invariant recognition, segmentation, and parsing to correctly answer the puzzle.
Network activities, such as, for example, online e-commerce transactions, search engine submissions, Web polls, Web registrations, free e-mail service registration, and other automated online services, are subject to software programs (e.g., Web bots) that mimic human user behavior in order to skew results of automated tasks or perform malicious activities, such as gathering e-mail addresses for spamming or placing hundreds of orders causing denial-of-service. In order to validate the requesting user, the user is presented with a CAPTCHA puzzle, such as, for example, a distorted word placed on top of a distorted background. The user must input the correct word into a field in order to complete the validation process. Computers have a difficult time decoding the distorted word while humans can readily decipher the text. Some CAPTCHA puzzles utilize pictures or images instead of distorted words. For example, a user may be presented with a series of pictures and asked what is the common element among all of the pictures. By inputting the correct common element, the user is validated and the computer knows it is dealing with a human user and not a Web bot.
Client 110, client 112, and client 114 also connect to network 102. Clients 110, 112, and 114 are client devices of server 104 and/or server 106. In this example, clients 110, 112, and 114 are shown as desktop or personal computers with wire communication links to network 102. However, it should be noted that clients 110, 112, and 114 are examples only and may represent other types of data processing systems, such as, for example, laptop computers, handheld computers, personal digital assistants, smart phones, smart watches, smart televisions, gaming devices, kiosks, and the like. Users of clients 110, 112, and 114 may utilize clients 110, 112, and 114 to access and utilize the services provided by server 104 and/or server 106.
Storage 108 is a network storage device capable of storing any type of data in a structured format or an unstructured format. In addition, storage 108 may represent a plurality of network storage devices. Further, storage 108 may store identifiers and network addresses for a plurality of different client devices, identifiers for a plurality of different users, CAPTCHA puzzles and their corresponding answers, hash functions, and the like. Furthermore, storage unit 108 may store other types of data, such as authentication or credential data that may include user names, passwords, and biometric data associated with client device users, for example.
In addition, it should be noted that network data processing system 100 may include any number of additional server computers, client devices, storage devices, and other devices not shown. Program code located in network data processing system 100 may be stored on a computer readable storage medium and downloaded to a computer or other data processing device for use. For example, program code may be stored on a computer readable storage medium on server 104 and downloaded to client 110 over network 102 for use on client 110.
In the depicted example, network data processing system 100 may be implemented as a number of different types of communication networks, such as, for example, an internet, an intranet, a local area network (LAN), a wide area network (WAN), or any combination thereof. FIG. 1 is intended as an example only, and not as an architectural limitation for the different illustrative embodiments.
With reference now to FIG. 2, a diagram of a data processing system is depicted in accordance with an illustrative embodiment. Data processing system 200 is an example of a computer, such as server 104 in FIG. 1, in which computer readable program code or instructions implementing processes of illustrative embodiments may be located. However, it should be noted that data processing system 200 is not limited to a server. In other words, illustrative embodiments may be implemented in other types of data processing systems, such as, for example, peer devices. In this illustrative example, data processing system 200 includes communications fabric 202, which provides communications between processor unit 204, memory 206, persistent storage 208, communications unit 210, input/output (I/O) unit 212, and display 214.
Processor unit 204 serves to execute instructions for software applications and programs that may be loaded into memory 206. Processor unit 204 may be a set of one or more hardware processor devices or may be a multi-core processor, depending on the particular implementation.
Memory 206 and persistent storage 208 are examples of storage devices 216. A computer readable storage device is any piece of hardware that is capable of storing information, such as, for example, without limitation, data, computer readable program code in functional form, and/or other suitable information either on a transient basis and/or a persistent basis. Further, a computer readable storage device excludes a propagation medium. Memory 206, in these examples, may be, for example, a random-access memory (RAM), or any other suitable volatile or non-volatile storage device. Persistent storage 208 may take various forms, depending on the particular implementation. For example, persistent storage 208 may contain one or more devices. For example, persistent storage 208 may be a hard drive, a flash memory, a rewritable optical disk, a rewritable magnetic tape, or some combination of the above. The media used by persistent storage 208 may be removable. For example, a removable hard drive may be used for persistent storage 208.
In this example, persistent storage 208 stores Transport Layer Security session manager 218. However, it should be noted that even though Transport Layer Security session manager 218 is illustrated as residing in persistent storage 208, in an alternative illustrative embodiment Transport Layer Security session manager 218 may be a separate component of data processing system 200. For example, Transport Layer Security session manager 218 may be a hardware component coupled to communication fabric 202 or a combination of hardware and software components. Transport Layer Security session manager 218 controls the process of establishing a Transport Layer Security session with a peer device connected to a network, such as network 102 in FIG. 1. In addition, Transport Layer Security session manager 218 detects and prevents Transport Layer Security session man-in-the-middle attacks between data processing system 200 and the peer device.
After establishing the Transport Layer Security session with the peer device, Transport Layer Security session manager 218 sends CAPTCHA puzzle 220 to the peer device. CAPTCHA puzzle 220 may represent a plurality of different CAPTCHA puzzles that Transport Layer Security session manager 218 utilizes for data security. Answer 222 represents the correct answer to CAPTCHA puzzle 220. It should be noted that Transport Layer Security session manager 218 may store CAPTCHA puzzle 220 and answer 222 in persistent storage 208 or may alternatively retrieve CAPTCHA puzzle 220 and answer 222 from a remote storage, such as storage 108 in FIG. 1, of a CAPTCHA puzzle service provider.
Further, Transport Layer Security session manager 218 selects segment 226 from Transport Layer Security session data 224, which corresponds to the Transport Layer Security session with the peer device. Segment 226 may be, for example, an initial or first portion of Transport Layer Security session data 224 that includes a predetermined number of bytes, such as the first 20, 30, 40, or 50 bytes of session data. However, it should be noted that segment 226 may consist of any portion or any number of bytes from Transport Layer Security session data 224. Transport Layer Security session data 224 represent information corresponding to the Transport Layer Security session that Transport Layer Security session manager 218 established between data processing system 200 and the peer device. Transport Layer Security session manager 218 sends information regarding the selection of segment 226 to the peer device in addition to CAPTCHA puzzle 220.
Furthermore, Transport Layer Security session manager 218 utilizes hash function 228 to generate security digest 230. Security digest 230 is a hash of answer 222 and segment 226. Hash function 228 may be, for example, one-way cryptographic hash function.
Moreover, Transport Layer Security session manager 218 compares security digest 230 with received security digest 232 to determine whether a match exists between security digest 230 and received security digest 232. Received security digest 232 represents a security digest, which Transport Layer Security session manager 218 received from the peer device, consisting of a hash of a user inputted answer to CAPTCHA puzzle 220 and segment 226. Transport Layer Security session manager 218 determines that a match exists between security digest 230 and received security digest 232 when the hash values contained in security digest 230 are the same as, or are equivalent to, the hash values contained in received security digest 232. Conversely, Transport Layer Security session manager 218 determines that no match exists between security digest 230 and received security digest 232 when the hash values contained in security digest 230 are different from, or are nonequivalent to, the hash values contained in received security digest 232. However, it should be noted that in alternative illustrative embodiments, Transport Layer Security session manager 218 may utilize other criteria to determine whether a match does or does not exist.
If security digest 230 and received security digest 232 match based on the comparison, then Transport Layer Security session manager 218 continues the Transport Layer Security session with the peer device. If security digest 230 and received security digest 232 do not match, then Transport Layer Security session manager 218 determines that a man-in-the-middle attack is occurring and performs mitigation action steps 234. Mitigation action steps 234 may include, for example, Transport Layer Security session manager 218 terminating the Transport Layer Security session with the peer device and/or sending an alert to a security analyst for review and possible action. However, it should be noted that if Transport Layer Security session manager 218 determines that security digest 230 and received security digest 232 do not match, then Transport Layer Security session manager 218 may allow a predefined number of retries, such as, for example, one, two, or three retries, before determining that a man-in-the-middle attack is occurring and performing mitigation action steps 234. Security session manager 218 may allow the predefined number of retries just in case the user, for example, inadvertently inputted a wrong answer to CAPTCHA puzzle 220 during an authentication attempt.
Communications unit 210, in this example, provides for communication with other computers, data processing systems, and devices via a network, such as network 102 in FIG. 1. Communications unit 210 may provide communications through the use of both physical and wireless communications links. The physical communications link may utilize, for example, a wire, cable, universal serial bus, or any other physical technology to establish a physical communications link for data processing system 200. The wireless communications link may utilize, for example, shortwave, high frequency, ultra high frequency, microwave, wireless fidelity (Wi-Fi), Bluetooth® technology, global system for mobile communications (GSM), code division multiple access (CDMA), second-generation (2G), third-generation (3G), fourth-generation (4G), 4G Long Term Evolution (LTE), LTE Advanced, fifth-generation (5G), or any other wireless communication technology or standard to establish a wireless communications link for data processing system 200.
Input/output unit 212 allows for the input and output of data with other devices that may be connected to data processing system 200. For example, input/output unit 212 may provide a connection for user input through a keypad, a keyboard, a mouse, a microphone, and/or some other suitable input device. Display 214 provides a mechanism to display information to a user and may include touch screen capabilities to allow the user to make on-screen selections through user interfaces or input data, for example.
Instructions for the operating system, applications, and/or programs may be located in storage devices 216, which are in communication with processor unit 204 through communications fabric 202. In this illustrative example, the instructions are in a functional form on persistent storage 208. These instructions may be loaded into memory 206 for running by processor unit 204. The processes of the different embodiments may be performed by processor unit 204 using computer-implemented instructions, which may be located in a memory, such as memory 206. These program instructions are referred to as program code, computer usable program code, or computer readable program code that may be read and run by a processor in processor unit 204. The program instructions, in the different embodiments, may be embodied on different physical computer readable storage devices, such as memory 206 or persistent storage 208.
Program code 236 is located in a functional form on computer readable media 238 that is selectively removable and may be loaded onto or transferred to data processing system 200 for running by processor unit 204. Program code 236 and computer readable media 238 form computer program product 240. In one example, computer readable media 238 may be computer readable storage media 242 or computer readable signal media 244. Computer readable storage media 242 may include, for example, an optical or magnetic disc that is inserted or placed into a drive or other device that is part of persistent storage 208 for transfer onto a storage device, such as a hard drive, that is part of persistent storage 208. Computer readable storage media 242 also may take the form of a persistent storage, such as a hard drive, a thumb drive, or a flash memory that is connected to data processing system 200. In some instances, computer readable storage media 242 may not be removable from data processing system 200.
Alternatively, program code 236 may be transferred to data processing system 200 using computer readable signal media 244. Computer readable signal media 244 may be, for example, a propagated data signal containing program code 236. For example, computer readable signal media 244 may be an electro-magnetic signal, an optical signal, and/or any other suitable type of signal. These signals may be transmitted over communication links, such as wireless communication links, an optical fiber cable, a coaxial cable, a wire, and/or any other suitable type of communications link. In other words, the communications link and/or the connection may be physical or wireless in the illustrative examples. The computer readable media also may take the form of non-tangible media, such as communication links or wireless transmissions containing the program code.
In some illustrative embodiments, program code 236 may be downloaded over a network to persistent storage 208 from another device or data processing system through computer readable signal media 244 for use within data processing system 200. For instance, program code stored in a computer readable storage media in a data processing system may be downloaded over a network from the data processing system to data processing system 200. The data processing system providing program code 236 may be a server computer, a client computer, or some other device capable of storing and transmitting program code 236.
The different components illustrated for data processing system 200 are not meant to provide architectural limitations to the manner in which different embodiments may be implemented. The different illustrative embodiments may be implemented in a data processing system including components in addition to, or in place of, those illustrated for data processing system 200. Other components shown in FIG. 2 can be varied from the illustrative examples shown. The different embodiments may be implemented using any hardware device or system capable of executing program code. As one example, data processing system 200 may include organic components integrated with inorganic components and/or may be comprised entirely of organic components excluding a human being. For example, a storage device may be comprised of an organic semiconductor.
As another example, a computer readable storage device in data processing system 200 is any hardware apparatus that may store data. Memory 206, persistent storage 208, and computer readable storage media 242 are examples of physical storage devices in a tangible form.
In another example, a bus system may be used to implement communications fabric 202 and may be comprised of one or more buses, such as a system bus or an input/output bus. Of course, the bus system may be implemented using any suitable type of architecture that provides for a transfer of data between different components or devices attached to the bus system. Additionally, a communications unit may include one or more devices used to transmit and receive data, such as a modem or a network adapter. Further, a memory may be, for example, memory 206 or a cache such as found in an interface and memory controller hub that may be present in communications fabric 202.
Man-in-the-middle attacks are one of the most common attacks for intercepting network session data between two connection endpoints. Man-in-the-middle attacks allow the attackers to eavesdrop and/or modify data content of a network session. A CAPTCHA puzzle can be easily solved by a human, but is more difficult for a machine to solve. However, CAPTCHA puzzles are still vulnerable to some well-articulated man-in-the-middle attacks, which allow the attackers to manipulate the data content of network sessions. Thus, illustrative embodiments also utilize Transport Layer Security on top of CAPTCHA puzzles. For those Transport Layer Security sessions where man-in-the-middle attacks are occurring, the Transport Layer Security session data on one peer device side is different from the other peer device side. Illustrative embodiments utilize a security digest, which consists of a cryptographic hash of a correct answer to a presented CAPTCHA puzzle and a selected Transport Layer Security session data segment, to detect and prevent man-in-the-middle attacks. The selected Transport Layer Security session data segment may be, for example, the first 32 bytes of the Transport Layer Security session data.
Utilizing these two factors (i.e., CAPTCHA puzzle and Transport Layer Security session data segment), a Transport Layer Security session endpoint device and its peer device are both able to generate a security digest during the Transport Layer Security session negotiation between the two network devices. The two network devices generate the security digest using a hash function, such as a one-way cryptographic hash function (e.g., Secure Hash Algorithm 256). If the security digests do not match, then the Transport Layer Security session endpoint device ends the network connection. One reason the security digests do not match is because the Transport Layer Security session data segments do not match, which indicates a man-in-the-middle attack. Another reason the security digests do not match is because of wrong CAPTCHA puzzle answer, which indicates either the user input the wrong answer or a man-in-the-middle attack is occurring. As a result, illustrative embodiments can effectively prevent Transport Layer Security session man-in-the-middle attacks and can be widely applied since Transport Layer Security is commonly used to protect network connections.
With reference now to FIG. 3, a diagram illustrating an example of a Transport Layer Security session man-in-the-middle attack detection system is depicted in accordance with an illustrative embodiment. Transport Layer Security session man-in-the-middle attack detection system 300 may be implemented in a network of data processing systems, such as network data processing system 100 in FIG. 1. Transport Layer Security session man-in-the-middle attack detection system 300 is a system of hardware and software components for detecting and preventing Transport Layer Security session man-in-the-middle attacks between a Transport Layer Security session endpoint device, such as, for example, data processing system 200, and a Transport Layer Security session peer device, such as, for example, client 110 in FIG. 1.
In this example, Transport Layer man-in-the-middle attack detection system 300 includes Transport Layer Security session endpoint device 302 and Transport Layer Security session peer device 304. However, it should be noted that Transport Layer man-in-the-middle attack detection system 300 may include any number and type of Transport Layer Security session endpoint devices and Transport Layer Security session peer devices.
Transport Layer Security session peer device 304 sends Transport Layer Security session request 306 to Transport Layer Security session endpoint device 302 to initiate establishment of a Transport Layer Security session between Transport Layer Security session peer device 304 and Transport Layer Security session endpoint device 302. In response, Transport Layer Security session endpoint device 302 performs a Transport Layer Security handshake procedure with Transport Layer Security session peer device 304. Upon successful completion of the Transport Layer Security handshake procedure, Transport Layer Security session endpoint device 302 establishes a Transport Layer Security session with Transport Layer Security session peer device 304 and sends CAPTCHA puzzle 308 and Transport Layer Security session data segment information 310 to Transport Layer Security session peer device 304. CAPTCHA puzzle 308 and Transport Layer Security session data segment information 310 may be, for example, CAPTCHA puzzle 220 and information regarding selection of segment 226 of Transport Layer Security session data 224 in FIG. 2.
Subsequently, Transport Layer Security session peer device 304 sends security digest 312 to Transport Layer Security session endpoint device 302. Security digest 312 is a hash of a user inputted answer to the CAPTCHA puzzle and the Transport Layer Security session data segment corresponding to the segment selection information sent to Transport Layer Security session peer device 304 by Transport Layer Security session endpoint device 302. Security digest 312 may be, for example, received security digest 232 in FIG. 2. If Transport Layer Security session endpoint device 302 determines that a match exists between security digest 312 and a security digest generated by Transport Layer Security session endpoint device 302, then Transport Layer Security session endpoint device 302 sends security digest validation acknowledgement 314 to Transport Layer Security session peer device 304 and continues the Transport Layer Security session with Transport Layer Security session peer device 304. Alternatively, if Transport Layer Security session endpoint device 302 determines that a match does not exists between security digest 312 and the security digest generated by Transport Layer Security session endpoint device 302, then Transport Layer Security session endpoint device 302 detects a man-in-the-middle attack and discontinues the Transport Layer Security session with Transport Layer Security session peer device 304.
With reference now to FIGS. 4A-4B, a flowchart illustrating a process for a Transport Layer Security session endpoint device is shown in accordance with an illustrative embodiment. The process shown in FIGS. 4A-4B may be implemented in an endpoint data processing system, such as, for example, Transport Layer Security session endpoint device 302 in FIG. 3.
The process begins when the endpoint device receives a request to initiate a Transport Layer Security session with the endpoint device from a peer device (step 402). The peer device may be, for example, Transport Layer Security session peer device 304 in FIG. 3. The endpoint device performs a Transport Layer Security handshake procedure with the peer device (step 404). The endpoint device establishes a network connection with the peer device for the Transport Layer Security session upon successful completion of the Transport Layer Security handshake procedure (step 406).
The endpoint device selects a CAPTCHA puzzle to send to the peer device (step 408). The CAPTCHA puzzle may be, for example, CAPTCHA puzzle 220 in FIG. 2. In addition, the endpoint device retrieves a correct answer to the CAPTCHA puzzle (step 410). The correct answer may be, for example, answer 222 in FIG. 2.
The endpoint device sends the CAPTCHA puzzle to the peer device via the network connection (step 412). Further, the endpoint device selects a segment of Transport Layer Security data corresponding to the Transport Layer Security session (step 414). The segment of Transport Layer Security data may be, for example, segment 226 of Transport Layer Security session data 224 in FIG. 2. The endpoint device sends information regarding the selection of the segment of Transport Layer Security data to the peer device via the network connection (step 416).
Furthermore, the endpoint device, using a one-way cryptographic hash function, generates a first security digest based on a hash of the correct answer to the CAPTCHA puzzle and the selected segment of Transport Layer Security data (step 418). The one-way cryptographic hash function may be, for example, hash function 228 in FIG. 2. The endpoint device also makes a determination as to whether a second security digest was received from the peer device within a defined period of time (step 420). The defined period of time may be, for example, thirty seconds, one minute, two minutes, three minutes, five minutes, or the like.
If the endpoint device determines that a second security digest was not received from the peer device within the defined period of time, no output of step 420, then the process proceeds to step 434. If the endpoint device determines that a second security digest was received from the peer device within the defined period of time, yes output of step 420, then the endpoint device compares the first security digest generated by the endpoint device with the second security digest received from the peer device (step 422).
Afterward, the endpoint device makes a determination as to whether a match exists between the first security digest and the second security digest based on the comparison (step 424). If the endpoint device determines that a match does not exist between the first security digest and the second security digest, no output of step 424, then the endpoint device detects a man-in-the-middle attack (step 426) and the process proceeds to step 434 thereafter. If the endpoint device determines that a match does exist between the first security digest and the second security digest, yes output of step 424, then the endpoint device sends a security digest validation acknowledgement to the peer device (step 428). The security digest validation acknowledgement may be, for example, security digest validation acknowledgement 312 in FIG. 3. In addition, the endpoint device continues the Transport Layer Security session with the peer device (step 430).
Subsequently, the endpoint device makes a determination as to whether an input was received from the peer device to end the Transport Layer Security session (step 432). If the endpoint device determines that an input was not received from the peer device to end the Transport Layer Security session, no output of step 432, then the process returns to step 430 where the endpoint device continues the Transport Layer Security session with the peer device. If the endpoint device determines that an input was received from the peer device to end the Transport Layer Security session, yes output of step 432, then the endpoint device terminates the network connection with the peer device (step 434). Thereafter, the process terminates.
With reference now to FIGS. 5A-5B, a flowchart illustrating a process for a Transport Layer Security session peer device is shown in accordance with an illustrative embodiment. The process shown in FIGS. 5A-5B may be implemented in a peer data processing device, such as, for example, Transport Layer Security session peer device 304 in FIG. 3.
The process begins when the peer device sends a request to initiate a Transport Layer Security session with an endpoint device (step 502). The endpoint device may be, for example, Transport Layer Security session endpoint device 302 in FIG. 3. The peer device performs a Transport Layer Security handshake procedure with the endpoint device (step 504). The peer device establishes a network connection with the endpoint device for the Transport Layer Security session upon successful completion of the Transport Layer Security handshake procedure (step 506).
Afterward, the peer device receives a CAPTCHA puzzle from the endpoint device via the network connection (step 508). Subsequently, the peer device receives an answer to the CAPTCHA puzzle from a user of the peer device (step 510). In addition, the peer device receives information regarding a selection of a segment of Transport Layer Security data corresponding to the Transport Layer Security session from the endpoint device via the network connection (step 512). In other words, the peer device receives the Transport Layer Security session data segment selection information and gets that selected segment of data from the Transport Layer Security session according to the segment selection information.
The peer device, using a one-way cryptographic hash function, generates a security digest based on a hash of the answer inputted by the user to the CAPTCHA puzzle and the segment of Transport Layer Security data corresponding to the segment selection information received from the endpoint device (step 514). Afterward, the peer device sends the security digest to the endpoint device for validation via the network connection (step 516).
The peer device makes a determination as to whether a security digest validation acknowledgement was received from the endpoint device within a defined period of time (step 518). If the peer device determines that a security digest validation acknowledgement was not received from the endpoint device within the defined period of time, no output of step 518, then the peer device detects a man-in-the-middle attack (step 520) and the process proceeds to step 526 thereafter. If the peer device determines that a security digest validation acknowledgement was received from the endpoint device within the defined period of time, yes output of step 518, then the peer device continues the Transport Layer Security session with the endpoint device (step 522).
Subsequently, the peer device makes a determination as to whether an input was received from the user of the peer device to end the Transport Layer Security session (step 524). If the peer device determines that an input was not received from the user of the peer device to end the Transport Layer Security session, no output of step 524, then the process returns to step 522 where the peer device continues the Transport Layer Security session with the endpoint device. If the peer device determines that an input was received from the user of the peer device to end the Transport Layer Security session, yes output of step 524, then the peer device terminates the network connection with the endpoint device (step 526). Thereafter, the process terminates.
Thus, illustrative embodiments of the present invention provide a computer-implemented method, computer system, and computer program product for preventing Transport Layer Security session man-in-the-middle attacks between data processing devices connected to a network. The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.
1. A method for preventing Transport Layer Security session man-in-the-middle attacks, the method comprising:
comparing a first security digest generated by an endpoint device with a second security digest received from a peer device;
determining whether a match exists between the first security digest and the second security digest based on the comparing;
responsive to determining that a match does not exist between the first security digest and the second security digest, detecting a man-in-the-middle attack and terminating a network connection for a Transport Layer Security session with the peer device;
selecting a segment of Transport Layer Security data corresponding to the Transport Layer Security session;
sending information regarding selection of the selected segment of Transport Layer Security data to the peer device via the network connection; and
generating the first security digest based on both a hash of a retrieved correct answer to a CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the Transport Layer Security session.
2. The method of claim 1 further comprising:
responsive to determining that a match does exist between the first security digest and the second security digest, sending a security digest validation acknowledgement to the peer device and continuing the Transport Layer Security session with the peer device.
receiving a request to initiate the Transport Layer Security session with the endpoint device from the peer device;
performing a Transport Layer Security handshake procedure with the peer device; and
establishing the network connection with the peer device for the Transport Layer Security session upon successful completion of the Transport Layer Security handshake procedure.
selecting a CAPTCHA puzzle to send to the peer device; and
sending the CAPTCHA puzzle to the peer device via the network connection.
5. The method of claim 1, wherein the selected segment of Transport Layer Security data is an initial portion of Transport Layer Security data corresponding to the Transport Layer Security session that includes a predetermined number of bytes.
6. The method of claim 1, wherein the second security digest is generated based on a hash of a user inputted answer to the CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the information regarding the selection received from the endpoint device by the peer device.
determining whether the second security digest was received from the peer device within a defined period of time;
responsive to determining that the second security digest was not received from the peer device within the defined period of time, terminating the network connection for the Transport Layer Security session with the peer device; and
responsive to determining that the second security digest was received from the peer device within the defined period of time, comparing the first security digest generated by the endpoint device with the second security digest received from the peer device.
8. A computer system for preventing Transport Layer Security session man-in-the-middle attacks, the computer system comprising:
a bus system;
a storage device connected to the bus system, wherein the storage device stores program instructions; and
a processor connected to the bus system, wherein the processor executes the program instructions to: compare a first security digest generated by the computer system with a second security digest received from a peer device; determine whether a match exists between the first security digest and the second security digest based on comparing the first security digest and the second security digest; detect a man-in-the-middle attack and terminate a network connection for a Transport Layer Security session with the peer device in response to determining that a match does not exist between the first security digest and the second security digest; select a segment of Transport Layer Security data corresponding to the Transport Layer Security session; send information regarding selection of the selected segment of Transport Layer Security data to the peer device via the network connection; and generate the first security digest based on both a hash of a retrieved correct answer to a CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the Transport Layer Security session.
9. The computer system of claim 8, wherein the processor further executes the program instructions to:
send a security digest validation acknowledgement to the peer device and continue the Transport Layer Security session with the peer device in response to determining that a match does exist between the first security digest and the second security digest.
10. The computer system of claim 8, wherein the processor further executes the program instructions to:
receive a request to initiate the Transport Layer Security session from the peer device;
perform a Transport Layer Security handshake procedure with the peer device; and
establish the network connection with the peer device for the Transport Layer Security session upon successful completion of the Transport Layer Security handshake procedure.
11. A computer program product for preventing Transport Layer Security session man-in-the-middle attacks, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
comparing a first security digest generated by the computer with a second security digest received from a peer device;
12. The computer program product of claim 11 further comprising:
receiving a request to initiate the Transport Layer Security session from the peer device;
15. The computer program product of claim 11, wherein the selected segment of Transport Layer Security data is an initial portion of Transport Layer Security data corresponding to the Transport Layer Security session that includes a predetermined number of bytes.
16. The computer program product of claim 11, wherein the second security digest is generated based on a hash of a user inputted answer to the CAPTCHA puzzle and the selected segment of Transport Layer Security data corresponding to the information regarding the selection received from the computer by the peer device.
8321955 November 27, 2012 Feng et al.
9813411 November 7, 2017 Thibadeau et al.
20030226017 December 4, 2003 Palekar
20090210712 August 20, 2009 Fort
20110296509 December 1, 2011 Todorov
20130080769 March 28, 2013 Cha
20140108800 April 17, 2014 Lawrence
20140137224 May 15, 2014 Todorov
20160381080 December 29, 2016 Reddem
20170346851 November 30, 2017 Drake
Karapanos et al., “On the Effective Prevention of TLS Man-in-the-Middle Attacks in Web Applications,” Proceedings of the 23rd USENIX Security Symposium, Aug. 20-22, 2014, San Diego, CA, pp. 671-686.
Filed: Nov 9, 2018
Date of Patent: Jul 5, 2022
Assignee: International Business Machines Corporation (Armonk, NY)
Inventors: Wei-Hsiang Hsiung (Taipei), Sheng-Tung Hsu (Taipei), Kuo-Chun Chen (Taipei), Chih-Hung Chou (Yilan)
Primary Examiner: Farid Homayounmehr
Assistant Examiner: Suman Debnath
Current U.S. Class: Particular Communication Authentication Technique (713/168)
International Classification: H04L 9/40 (20220101); G06F 21/60 (20130101);


Memorable Manitobans: Edwin Elcome “Ted” Dafoe (1894-1981)
Born at Montreal, Quebec on 24 April 1894, son of John Wesley Dafoe and Alice Parmelee (1866-1961), in 1910 he took employment at his father’s workplace at the Manitoba Free Press, starting as a printer’s devil, and worked his way up, becoming a reporter by 1916, and later, a telegrapher, Cable Editor, News Editor, and Managing Editor. He worked with the company for over 50 years. He enlisted with the Lord Strathcona’s Horse during the First World War, and served overseas with the regiment for two years before transferring to the Royal Flying Corps. In the Second World War, he served with the Manitoba Reserve Battalion of the Veterans’ Guard of Canada. He was the Managing Editor of the Regina Leader-Post (1944) and Managing Editor of the Winnipeg Free Press (1944-1952). He retired from the Free Press in 1962. On 17 August 1921, he married Ruth Pauline Williams (1896-?) at Killarney and had two children. He would later move from Winnipeg to London, Ontario where he died on 30 September 1981.
Birth and marriage registrations, Manitoba Vital Statistics.
Attestation papers, Canadian Expeditionary Force, Library and Archives Canada.
“Former Free Press editor dies at 87,” Winnipeg Free Press, 1 October 1981, page 2.
This page was prepared by Nathan Kramer.
Page revised: 6 September 2014


Education System in Bengaluru and Opportunities
Bangalore officially Bengaluru, the IT Capital of India is a mega city and the Capital of the State of Karnataka. Its location is on the Deccan Pleatue 3000 ft above sea level which is highest for any Indian city. In the ancient times education system was in the hands of religious leaders and not accessible to all. This was the Maharaja Krishnaraja Wadiyar-III who first introduced western system of education in Bangalore.
Later in 1832 first English school named Wesleyan Canarese School was established. Subsequently, Bangalore High School and Bishop Cotton Boy’s School was started in 1858 and 1865 respectively. The World War ended in 1945 and King George VI established King George Royal Indian Military College also popularity called Bangalore Military School.
After India become free from British in 1947 Play Schools also called Nursery Schools or Kindergarten were established for the education of small children in the age group 16 months to 5 years. With the growth of IT industries in Bangalore the number of Play Schools risen significantly.
Formal education in Bangalore comes under the administrative control of Ministry of Education of the Government of Karnataka. Children get enrolled in formal schools at the age of 5. Bangalore follows 10 2 3/4 system of Education. Broadly speaking, Bangalore has three types of educational institutions; Government, Private and Semi-Government. Schools are affiliated with different school boards like;
Indian Certificate of Secondary Education (ICSE)
Central Board for Secondary Education (CBSE)
International General Certificate of Secondary Education (IGCSE)
National Institute of Open Schooling (NIOS)
Karnataka Secondary Education Examination Board
Department of Pre-University Education, Karnataka
After completion of 10 years of school education students chose for either Pre University (PUC) of Senior Secondary education in one the three disciplines arts, science or commerce. Also many chose to study diploma programmes.
Bangalore has many International Schools due to presence of expats and vast IT industry.
After completion of 12 year of formal education students go for college programme. At this stage they study either General Degree Course of 3 years duration or chose for technical / professional qualification which takes 4 or more years to complete. The students who acquire Diploma qualification get choice to study technical / professional under graduate programme through Lateral Entry Scheme.
Many colleges in Bangalore are affiliated with Bangalore University. However, presence of other university colleges and autonomous institutions is also obvious. College programmes are delivered acording to guidelines of University Grants Commission while professional programmes also have to follow guidelines of technical /professional regulatory bodies. For exclusive details about technical / professional regulatory bodies please see our Apex Body Hub.
Many students after completion of Under Graduate programme chose for Post Graduate programmes like Masters and PhD etc. Bangalore attracts students from all across India and other parts of world too. Due to huge presence of higher education institutions and industrial houses students consider Bangalore as one the Hot Bed of Education.


Security sweeps netting illegals
This month 105 foreign workers were arrested near Seattle, part of a crackdown on sensitive sites.
By Daniel B. Wood Staff writer of The Christian Science Monitor
November 22, 2005 | LOS ANGELES
In October, three illegal immigrants were arrested at Fort Bragg in North Carolina using false IDs. In August, six Mexican nationals were arrested at Fort Irwin, Calif. In July, six more illegal immigrants were found at Homestead Air Reserve Base in Homestead, Fla.
A division of the Department of Homeland Security has continued to ramp up post-9/11 investigations of what it considers key strategic sites across America: airports, power plants, and military installations. These investigations are routinely turning up so many illegal workers that concern is mounting - from Congress to terror watch-groups - that serious security breaches are possible at some of the most strategic and critical sites in the country.
In the light of such arrests, immigration groups also complain that illegal workers are once again being unfairly singled out as terror risks.
Government officials counter that they are more concerned that if illegal immigrants can so easily and regularly gain access to so many sites, the opening for possible terrorists to do so as well must be wide indeed.
"The main concern in all this is that we are looking for any potential vulnerabilities that could be exploited by terrorists or others with ill intent," says Jamie Zuieback, head spokeswoman for the US Immigration and Customs Enforcement (ICE) in Washington, the largest investigative arm in Homeland Security. "If we are seeing these egregious violations at our sites of highest strategic value, we need to find out how it is happening and shut it down."
Numbers of arrests mount
Less than two weeks ago, 105 foreign nationals were arrested in Seattle at a customs warehouse work site. In the past 12 months, more than 150 illegal immigrants have been discovered at sensitive installations in Mississippi, Arizona, New Mexico, Texas, and Iowa - among several other states. The illegal workers had jobs as building contractors, teachers, chefs, and custodians. From 2004 to 2005, the number of ongoing ICE investigations has increased from 465 to 511.
Over that time, such investigations netted nine illegal workers at Boeing's helicopter plant in Phoenix, which manufactures US military aircraft. Nine more were found working at the Army Ammunition Plant in Middletown, Iowa. Nine others were performing contract work at a facility in Winston-Salem, N.C., that refits the US Navy's P-3 Orion aircraft. Many have been deported. Others face criminal charges and have been released on bond pending court hearings.
"When I see how many of these illegals are being caught and with such regularity, I feel the US has not learned one of the key lessons of our recent terrorist past," says Bruce Hoffman, a senior researcher at the RAND Corp.'s Center for Terrorism and Risk Management Policy in Washington.
He cites the case of Ali Mohamed, who was not an illegal immigrant but who was a key Al Qaeda operative of Osama bin Laden who served as an instructor on the US Army base at Fort Bragg. It shows how terrorist groups have been able to infiltrate US military bases, he says. In 1998, Mr. Mohamed was convicted for his role in the 1998 US Embassy bombing in Kenya.
"My main question is why, four years after 9/11 and a decade after Mohamed was unmasked, are the credentials of [those who have] routine access to military bases not more closely scrutinized," says Mr. Hoffman. "One of the most successful tactics of insurgents in Iraq is to infiltrate military and police operations."
New security measures
ICE officials say they are working closely with military installations to improve security, including the identification and background-check procedures of personnel both at the bases and of contract workers the bases use.
Though Congress has not focused its attention on the string of security breaches, individual representatives are conducting further review in their own districts. One is North Carolina Rep. Robin Hayes (R), whose district includes Fort Bragg, home to the US Army's Special Operations Command.
"This is extremely disturbing to us that the three arrested here were giving language instruction to some of our most trained special forces," says Carolyn Hern, communications director for Representative Hayes.
Hayes is working with military officials at Fort Bragg to design new pilot programs for security measures. Some include new mobile technology, implemented at other US bases, to instantly verify someone's identification.
Others include ways to instantly query for IDs on federal, state, and local "most wanted" lists as well as military law enforcement databases.
Some objections to searches
Though ICE and military officials say their investigations are not specifically targeting illegal workers, some immigrant and civil libertarian groups say the continued crackdown fits a pattern of unfair suspicion of immigrants.
"This has to be put in the context of this administration's action over the past four years in which the war on terror has become a war on immigrants," says Ahilan Arulanantham, an attorney at the American Civil Liberties Union who works on security and immigration issues.
"Their actions have resulted in the deportation of thousands but no terrorists. This makes good headlines but doesn't make the US any safer," he says.
Others say the reason so many illegal immigrants are repeatedly found at military bases and other strategic sites is not because of security breaches but because of the country's heavy reliance on undocumented workers in every industry.
"There are 11 million undocumented [workers] laboring in every sector of the US economy, so of course they are going to be found at bases too," says Anjelica Salas, director of the Coalition for Humane Immigrant Rights of Los Angeles.
"We are zeroing in on cooks and cleaners and not really paying attention to terrorist elements. We are using resources in the wrong way," she says.
Cut defense to fund a border wall? How a US military town weighs the choice.
Why House Republicans blocked 'military amnesty' for illegal immigrants
Fear of being deported turns immigrant hurricane victims to churches for help
https://www.csmonitor.com/2005/1122/p01s01-ussc.html


Marc Viquez
United Center – Chicago Bulls
United Center 1901 W Madison St Chicago, IL 60612
Chicago Bulls website
United Center website
Year Opened: 1994
Bulls Fans Stand United
The Chicago Bulls moved into the United Center for the beginning of the 1994/1995 NBA season, at the time Michael Jordan was still retired and playing baseball but would rejoin the team later on that year and help usher in a string of three more NBA championships from 1996 to 1998. Twenty years later after his retirement, it is hard not to notice MJ’s accomplishments throughout the building and how magnetic that era was to the fans in Chicago.
The United Center replaced the iconic Chicago Stadium which debuted in 1929 and had been the home to the Bulls since its inaugural year of 1966. The plan to build the multipurpose arena was created by Chicago Blackhawks owner Bill Wirtz and Bulls owner Jerry Reinsdorf. The cost of construction was $175 million and would have a capacity of 23,129 for basketball. The arena was also designed with an Art Deco style much like its predecessor providing a nod to the past and progress towards the future.
The United Center introduced an 8,600-square feet of screen display giving it the most high-definition space of any NBA arena. It is four times larger than the previous one that was installed in 2005. Fans on the 100-section level will be able to see videos and stats on a continuous LED inner ring underneath the main screens.
The outer concourse of the arena is somewhat narrow and gives off a feeling of an airport terminal, which would make sense in a building named after United Airlines. However, recent upgrades to the area have created stands offering Chicago-style menu items, hang out areas, and upscale areas for fine food and beer.
The local favorites include Italian beef, Maxwell Street Polish, gyros, deep-dish pizza, and Vienna beef hot dogs dragged through the garden. Giordano’s has a stand-alone area that bakes pizza and offers tabletops to enjoy your meal. Chicago’s own Goose Island is also served on tap and is featured at many concession spots or at its own bar area on the lower concourse where tabletop stools and TVs are available.
Big Star is another concession area offering tabletops and Mexican-style food that is somewhat more premium. Here you can get carne asada tacos, marinated chicken fajitas, and margaritas. If you still are hungry for Mexican cuisine there are other spots serving chicken and steak nacho grande and steak and chicken tinga tacos.
The United Center also features pulled pork nachos, pulled pork platters, tri-tip smoked beef, carved turkey, and smoked brisket sandwiches. They’re also single and double all-beef grilled burgers and plenty of other options to satisfy your cravings. There is even an item called the garbage salad.
The Bulls are still a popular draw at the United Center and many games are filled at or near capacity. The main concourse aisles are usually buzzing with commerce, folks grabbing something to eat or checking out many of the interactive video screens that highlight the history of the team including those six NBA titles between 1991 and 1998.
There are also various areas such as the Goose Island Bar and Giordano’s where patrons can relax and enjoy a few drinks and Chicago-style eats while being away from their seats in the main bowl. The upper concourse also offers four social area bars at each corner that open up to the seating area for views of the game.
The attention grabber at the United Center is definitely the championship banners that hang from the rafters of both the Bulls and the Blackhawks. One only has to gaze at the six championship banners by the Bulls and the retired jersey numbers of Michael Jordan and Scottie Pippen to breathe in the rich history of the team from two decades ago.
The massive seating bowl is large and never feels too steep or cramped. The main aisles open up in the middle resulting in a very easily accessible way to your seat. You never feel as if you’re hiking up a mountain to get to your seat. The same goes for the lower concourse where you feel almost on top of the action taking place on the hardwood.
The Madhouse Team Store, located in the east addition to the arena, is a 10,000-square foot retail store offering official team merchandise and exclusive Madhouse apparel. Fans have the opportunity to make play-by-play calls via interactive touchscreens located inside repurposed CTA train cars. They can also insert themselves into iconic team photos to share on social media. There are also special sale prices on certain gear and giant-size replicas of both the Stanley Cup and Larry O’Brien Trophy for more photo ops.
However, the main spot for photo opportunities is just outside the store at the Michael Jordan statue. The 12-foot high bronze and black granite is now located indoors inside the atrium and is a work of art.
When there is an event at the United Center the surrounding neighborhood is buzzing with fans heading to the game and grabbing a bite to eat and drink before a Bulls game. The West End of Chicago does have a reputation, but just like the South Side where the Sox play, the neighborhood is fine during hockey and basketball games.
Hawkeye’s is known for its homemade chili and $1.50 hamburger specials. There is also an array of wine, spirits, and beers. On warmer days, the sidewalk patio makes for a nice choice before a game. Park Tavern serves $3 drafts before every Bulls game, a savings of 70% off the price of beer at the arena, and The Ogden and WestEnd offer incredible food, chef-driven dishes, and plenty of flat-screen TVs.
If you are looking for a popular spot in all of Chicago, The Billy Goat on Madison is a few blocks away and is known for its “cheezborgers,” made popular from Saturday Night Live. The restaurant is also part of Chicago lore as being the architect of the Billy Goat Curse that saw the Chicago Cubs go 108 years between World Series victories.
The Bulls are still one of the top drawing clubs in the league averaging well over 20,000 as of last season with the NBA lead in overall attendance. You would have to go back to 2009 to the last time Chicago did not finish on top of average attendance figures.
CTA buses are the best option for public transportation – either the #20 Madison or the #19 United Center Express. After the game, a fleet of #20 buses will be lined up on Madison heading back to the Loop. Buses run past CTA elevated and subway lines as well as Ogilvie Station for connections via Metra rail to the Chicago suburbs.
The #9 Ashland and #50 Damen buses are options for travelers heading north/south instead. CTA elevated trains are within walking distance via the Ashland/Lake station (Green/Pink Lines).
Once inside, the seating areas are divided evenly to make for easy access to all sections of the seating area. The upper and lower concourses are somewhat narrow in certain parts but large enough to keep traffic flowing smoothly.
Ticket prices usually begin around $45 online or at the box office and can differ depending on who the Bulls are playing and if it is a weekend night. There are tickets on the secondary market and you can find prices around $22 against less popular opponents or on weekday evenings. With that being said, a little research and flexible time would be beneficial for finding the most affordable ticket.
Concession prices are somewhat high but not anything different from other NBA arenas, expect to pay around $10 for sandwiches, $9-$11 for beers, and up to $18 for premium food items. Parking lots are $24 to park a car, a definite steal in Chicago, or park along Wood Street under the elevated train line for free–if available.
The United Center gets an extra point for its design that pays homage to the old Chicago Stadium that existed from 1929 to 1994. The signage inside the concourse aisles all have Art Deco fonts and there are plenty of other nods to this design in the interior and exterior of the building.
The second point goes to all those championship banners that hang from the rafters and provide a defiant exclamation point and wow factor to any first-time visitor walking to their seats.
The third point goes to the atrium that houses the Michael Jordan statue, Queenie’s Supper Club, and the Madhouse Team Store. There will be further additions to the atrium in the future and perhaps creating a festive vibe just outside the building and underneath the roof.
The final point goes to the extensive video screens located on the lower concourse that showcase team history, player profiles, and photo opportunities for fans. There is also a trophy case that displays all six NBA championship trophies.
The United Center has enough of what you need for an enjoyable evening of professional basketball. The history of the Bulls is on display all over the building, the social areas are great for spending time away from the game, and there is always an energetic crowd to liven up the mood of the building.
Illinois USA
United Center
United Center – Chicago Blackhawks


Sony is breaking its camera section into a separate company
Sean Berry
Sony has just announced it’s moving its entire camera business section into an intermediate holding company named “Sony Electronics Corporation.”
Starting April 1st, the entire “Electronics Products & Solutions” (EP&S) segment, which includes Sony imaging and mobile business, will be held by Sony Electronics Corporation. The company has stated that its Imaging Products & Solutions, Home Entertainment & Sound, and Mobile Communications businesses would all now be run under the new name.
“Through the establishment of Sony Electronics Corporation, Sony will not only accelerate the integrated operation of the EP&S businesses,” the release reads, “but also aim to optimize its organizational structure, talent and business portfolio, while further enhancing competitiveness and creating new business.”
How to Make a
DIY Green Screen
Thanks! We will email your free eBook.
Sony is shedding some businesses
Company investor Daniel Loeb recently said he was increasing his substantial stake in the company to “push for changes that include shedding some businesses.” Now, we aren’t sure if Loeb did in fact influence the company’s decision to move its camera business into a separate company. However, he has been a huge advocate for the company to break apart into separate businesses for a while now.
For instance, last year, he called on Sony to split off its image sensor business. The company has refused to listen to Loeb’s demands in the past. However, it seems the company’s stance on the matter has changed.
While it is impossible to tell what kind of effect this will have on Sony’s Imaging Division, it is likely not to have any effect on consumers. Things like this happen all the time in business and it isn’t something that will likely hurt user experience. However, this is in regards to one of the largest camera manufacturers in the world. It’s still a huge deal.
Image courtesy: CE Pro
Sean Berry is Videomaker's Managing Editor.
Laowa launches Proteus 2x anamorphic lens series
Sony will release a new 300 mm G Master prime lens
Apple launches new MacBook Pro line with M2 Pro and M2 Max chips
Apple reveals new Mac mini with M2 and M2 Pro
Fujifilm releases X-H2S update to improve its autofocus
Hal Fisher April 4, 2020 At 6:14 AM
Hmm. This reminds me of the time a few years ago when SONY decided to sell off all their software (Vegas, Sound Forge, etc.) and leave its user base gasping for air.


Home On-Campus Parking Restrictions
On-Campus Parking Restrictions
The university discourages all students from bringing vehicles to the Foggy Bottom or Mount Vernon campuses. Freshmen and sophomores in particular are prohibited from bringing vehicles and parking them in the Foggy Bottom/West End area other than in exceptional circumstances where an exception is documented and granted by the university. For those few granted exceptions, the vehicle must be parked in a university parking facility.
This policy is needed because of the limited number of parking spaces on the streets around the Foggy Bottom and Mount Vernon campuses, the availability of public transportation, and the need to limit the impact of parked vehicles on the surrounding residential neighborhoods. This policy is also needed to effectuate campus plan zoning requirements and other obligations of the university.
Foggy Bottom Campus Parking Restrictions
Due to the limited number of parking spaces on the streets in and around the Foggy Bottom Campus and the availability of public transportation, the D.C. Zoning Commission imposed a condition in the 2007 Foggy Bottom Campus Plan restricting student parking.
Pursuant to this condition, the university discourages all students from bringing vehicles to the Foggy Bottom Campus. Freshmen and sophomores are prohibited from bringing vehicles and parking them in the Foggy Bottom/West End area, except in exceptional circumstances. Exceptional circumstances may include, for example, transportation needs related to a disability or health condition of the student or member of his/her family. Requests by freshmen and sophomores for a policy exception due to exceptional circumstances must be submitted via the Parking Requirement Exemption Request Form. Students seeking an exception due to disability or health condition should visit Disability Support Services for further assistance. Any exemptions will be granted in consultation with Business and Auxiliary Services & Disability Support Services. If an exception is granted, the vehicle must be parked in a university parking facility.
Mount Vernon Campus Parking Restrictions
Pursuant to the 1999 Mount Vernon Campus Plan zoning order, students, faculty and staff who bring vehicles to the Mount Vernon campus are required to park on the campus itself. Parking is prohibited on the streets adjacent to and surrounding the Mount Vernon campus.
All freshmen and sophomores living in GW housing must confirm by their signature of the George Washington University Undergraduate Housing License Agreement that they have read and understood this parking policy, regardless of whether the student drives to the university or is eligible to have a car on campus. Student violations of this policy are subject to disciplinary action pursuant to the university's Code of Student Conduct.
Foggy Bottom/West End area: The area bounded by 19th Street on the east, E Street on the south, Rock Creek Park on the west, and N Street on the north.
Students seeking an exception due to disability or health condition should visit Disability Support Services for further assistance.
Parking Requirement Exemption Request Form
Housing License Agreement
SmarTrip Card
Zoning Commission of the District of Columbia, Zoning Commission Order No. 06-11/06-12, regarding the Foggy Bottom Campus Plan, dated March 12, 2007, effective October 26, 2007.
Zoning Commission of the District of Columbia, Zoning Commission Order No. 09-19, regarding the Mount Vernon Campus Plan, dated April 26, 2010.
Parking Services Office 202-994-7199 [email protected]
Disability Support Services 202-994-8250 [email protected]
Division for Student Affairs 202-994-6555 [email protected]
Faculty and Staff Service Center 202-994-8500 [email protected]
Campus Planning [email protected]
Responsible University Official: AVP & Dean of the Student Experience; and Senior Associate Vice President for Operations
Responsible Office: Office of the Student Experience; & Division of Operations
Last Reviewed: December 22, 2021


First foal a filly for Taylor Made Stallions’ Knicks Go
click here for larger
Taylor Made Stallions’ Horse of the Year Knicks Go, a five-time Grade 1 winner and two-time Breeders’ Cup winner, sired his first reported foal when a filly bred by Alex and Kendra Penn was born on Thursday evening, Jan. 12. The filly is produced from the Pioneerof the Nile mare Seeking a Star, a half-sister to 2-year-old stakes winner Miss Interpret and out of a half-sister to multiple Grade 1 winner Paulassilverlining, the dam of Artorius, impressive winner of the 2022 Curlin S. at Saratoga.
As a 5-year-old in 2021, Knicks Go was in a class by himself. Gate-to-wire winner of the $6,000,000 Breeders’ Cup Classic (G1) at Del Mar in a final time of 1:59.57 for the 1 ¼ miles—just two clicks off Candy Ride’s (ARG) 18-year track record—Knicks Go also annexed that year’s $3,000,000 Pegasus World Cup Invitational S. (G1) at Gulfstream Park, and the prestigious $1,000,000 Whitney S. (G1) at Saratoga en route to being named Longines World’s Best Racehorse and Eclipse Award Horse of the Year, as well as Champion Older Male at year’s end.
At four, Knicks Go became the fastest miler in Keeneland history after winning the 2020 Breeders’ Cup Mile (G1) in a new track record time of 1:33.85. He demonstrated his precocity at two, winning the $500,000 Breeders’ Futurity (G1) at Keeneland by a dominating 5 ½ lengths. All told, Knicks Go banked $9,258,135 in a stellar racing career and was a Grade 1 winner at two, four, and five. Knicks Go recorded eight triple-digit Beyers, including a 113—ranking as the fastest stakes winner of 2021.
With 151 mares in his first book, Knicks Go ranked as a Top 5 Freshman Sire by 2022 CI and CPI and he saw his first in-foal mares sell for up to $480,000 last year. His stud fee is $15,000 S&N for 2023. For more information on Knicks Go, contact Travis White at (859) 396-3508 or Brock Martin at (270) 498-3722.


Alone Among Senate Democrats, Kirsten Gillibrand Is Standing Against Trump’s Cabinet
By Christina Cauterucci
Jan 26, 20172:51 PM
Sen. Kirsten Gillibrand was the only senator to vote against retired Gen. James Mattis, right, for secretary of defense.
Aaron P. Bernstein/Getty Images
Sen. Kirsten Gillibrand is getting all kinds of props this week for being the only Democrat to vote against all Donald Trump’s appointments besides Nikki Haley for United Nations ambassador. High school student and Democratic activist Rachel Gonzalez tweeted out the news on Tuesday afternoon, imploring readers to remember Gillibrand’s votes “in 2020.” The tweet has been liked 81,000 times as of Thursday afternoon.
Insofar as hearts on a tweet can offer insight into the conventional wisdom of a political party, it seems like Gillibrand’s principled stance is setting her up as a recognizable Trump opponent if she decides to run for president, as many have speculated she might, in two years or so. The Senate, with its filibuster, is one of the only bulwarks the country has left against an authoritarian administration that is already following through on its most damaging campaign promises. Massive marches, like the ones that went down in hundreds of communities around the world the day after Trump’s inauguration, are good for keeping the people engaged and energized. But without leaders in office who will turn progressive, humane values into votes, the worst those people can imagine of a Trump regime will likely come to fruition.
That’s why liberals were incensed to learn that Sen. Elizabeth Warren, another oft-proposed 2020 presidential candidate, gave Ben Carson her vote to lead the Department of Housing and Urban Development. Carson has never worked in government, knows not one thing about housing nor urban development, and has repeatedly expressed contempt for the marginalized and low-income Americans he’d be tasked with serving as HUD secretary. Thanks to the likes of Warren and fellow progressive darling Sen. Sherrod Brown, who claim Carson is better than any likely alternative because he’s never literally threatened to demolish the department he may lead, Carson now has a unanimous mandate from the Senate’s banking committee.
Gillibrand, meanwhile, is proving that she won’t back down from her beliefs, even if her vote is symbolic. She was the only senator, period, to vote against retired Gen. James Mattis for secretary of defense, on the grounds that federal law prevents a military leader from taking that civilian leadership post until she or he has been retired for seven years. (Mattis retired in May 2013.) The Senate had to pass a special waiver to allow Mattis to take on the role; Gillibrand and 16 other Democrats voted against it. When the waiver passed anyway, Gillibrand was the only one of the 17 who stood her ground.
“Our American democracy was built around the concept of civilian control of the military,” she wrote in a New York Times op-ed about her opposition to Mattis’ appointment. “New presidents are typically allowed latitude to appoint their cabinet members. But President-elect Trump is not entitled to ignore our laws and change the fundamental government constructs that have enabled our country’s success.”
Gillibrand has also promised to oppose Betsy DeVos, Trump’s zealot of an education secretary pick. Haley, Gillibrand’s one “yes” vote so far, is far from an ideal candidate for a U.N. representative. She’s spoken against the Black Lives Matter movement and helped restrict women’s access to health care by signing unconstitutional abortion laws in her state. But she’s also been humble enough to give credit to Hillary Clinton’s leadership and firm-footed enough to oppose Trump’s nativism in her State of the Union response. For a position Trump would like to eliminate, Haley seems like the best person he’s capable of putting forward.
Since Gillibrand’s Cabinet votes attracted applause from the left, a spokesman for the senator has assured the Washington Post that “the only race [Gillibrand] is interested in is her reelection to the Senate in 2018.” But anti-Trump dedication promises to be a major plus for any 2020 candidate, and the senator is already setting herself up as a beacon of principle in unprincipled times. Gillibrand has already made a name for herself as a fierce advocate for equal pay, women’s health care, and accountability for sexual assault perpetrators and their apologists. And since Trump and the new Congress took office, she’s registered her opposition to their agenda with a proposed amendment that would have protected the no-cost birth control, maternity care coverage, and gender-neutral premiums guaranteed by the Affordable Care Act.
Sen. Cory Booker of New Jersey, another name often mentioned in whispers of the Democratic presidential pipeline, has also been laying breadcrumbs for good anti-Trump publicity in recent weeks. (Booker voted against John F. Kelly for secretary of homeland security and Mike Pompeo for CIA director, as well as against the Mattis waiver, but ended up voting for Mattis and Haley.) Booker made a grand to-do about going against Senate conventions to testify directly against Sen. Jeff Sessions for the U.S. attorney general gig. “In a choice between standing with Senate norms and standing up for what my conscience tells me is best for our country, I will always choose conscience and country,” he said. The stump speech writes itself.


December 4, 2019 Fascinating Politics
Dewey Short: Hillbilly Intellectualism
In 1928, a young man gave a stunning speech before the Republicans of Springfield, Missouri called “Republicanism and Americanism”, in which he stated: “Republicanism is Americanism. It is part of my religion and if I can convert any democrat, I will have served God as well as my country…(We), with unflinching courage and unswerving loyalty, will march together under the united, inspiring and intrepid banner of Republicanism to victory next November” (Rafferty, 95). This speech was so well-received that he was frequently demanded for speaking engagements. Richard Nixon himself would refer to this man as the finest orator he had ever heard. This man was Dewey Jackson Short (1898-1979).
Short the Congressman
In 1928, Herbert Hoover won the presidential election by a landslide and with him came many Republicans on his coattails. Of the 43 newly elected House Republicans, only 11 would be in Washington after the 1932 election, Short among them. Although he lost reelection in 1930 in the wake of the stock market crash and the Great Depression, he was not done yet. In the meantime, he traveled through Europe and visited the Soviet Union. In 1934, he was elected to the much safer 7th district and his Congressional career truly got its start. Short quickly gained a reputation as the finest orator in the Republican Party and peppered his speeches with alliteration, insults and wit. One of the finest examples of his speeches was his reaction to the Roosevelt Administration’s request for work relief in 1935, which can be read on a previous post:
https://fascinatingpolitics.com/2018/12/19/the-abdication-of-congressional-responsibility/
Some Shortisms include:
“Mr. Jefferson founded the Democratic Party, President Roosevelt has dumfounded it”.
“He is not exactly like some men I know who care no more for their word than a tomcat cares for a marriage license in a back alley on the blackest night”. – Referring to Postmaster General Jim Farley.
“I have always been old-fashioned enough to believe it is much better to ‘git up and get’ than it is to ‘sit down and set.’ The only animal I know which can sit and still produce dividends is the old hen”.
(Wiley)
Short was a frequent critic of New Deal legislation as he thought its use of federal power went too far and was uncompromising in his opposition save for Social Security and flood control legislation. He was also a staunch foe of getting the United States involved in European affairs and in 1940 non-interventionists sought to nominate him Vice President. Instead, the nomination went to the moderate Senate Minority Leader Charles McNary of Oregon. That year, Short was one of the leading opponents of the peacetime draft and after World War II he led the opposition to the concept of universal military training. He would similarly oppose the Truman Doctrine and the Marshall Plan. Short was at times lonely in his state in opposition to the Democrats: from 1935 to 1941 and from 1949 to 1951 he was the only Republican representative from the state.
Short liked to play up his origins, stating in a Chicago speech, “Really, I am just a plain, ordinary country boy, a native hillbilly from the Ozarks in southwest Missouri, where we still cover our houses with bull hides and use their tails for lightning rods” (Wiley). However, this “ordinary country boy” also earned a Bachelor’s in Divinity from Boston College, attended Harvard Law School, and studied at the universities of Heidelberg and Oxford. He thereafter became a Professor of Philosophy and Psychology at Southwestern College in Winfield, Kansas before pursuing his political career.
Short on Other Issues
On civil rights, Short has a mixed record. He voted for anti-lynching bills and early anti-poll tax measures, but after World War II, he mostly voted against as he feared the concentration of federal power, an echo of his opposition to the New Deal. Short also staunchly opposed the Eisenhower Administration’s approach on foreign policy as he continued to oppose foreign aid. Most domestic policy that even smelled slightly of Harry S. Truman’s Fair Deal was out as well. In 1956, he was defeated for reelection in an otherwise Republican district on account of a regional issue. Despite Short’s disagreements on foreign policy with the Eisenhower Administration, he was appointed Assistant Secretary of the Army, a post he served in until 1961.
Rafferty, M.D. (2001). Ozarks: Land and life. Fayetteville, AR: University of Arkansas Press.
Wiley, R.S. Dewey S. Short: The Silver Tongued Orator from Galena. The History of Stone County, Vol. 1, 236-237.
http://stone.mogenweb.org/biography/dshort.html
Previous PostA Tale of Two ThanksgivingsNext PostHusband E. Kimmel and Walter Short: Scapegoats for Pearl Harbor


posted January 2nd, 2023 at 7:01 AM
It's always the same. I don't speak it out loud. I don't even silently think the words in my head but the same thoughts are always there. I'm sitting across from someone, but it won't ever happen again in real life , and a decade ago when it did it never went the way I hoped anyway.
Yes 47 year old here
posted January 1st, 2023 at 6:36 PM
Internet 12 hours a day ...tv 7 hours a day.....twitter & tik Tok most of the time....on my iPhone all the time looking for likes & stupid shit...watched porn too as I ate my Christmas dinner at my house..... pretty pathetic.....but hey....at least I wear deodorant every day.
Take Your Medicine Peter Pan
I often thought Pan refused to grow up and was obsessed with death. Then I learned what medicine constituted in his time. Alcohol and morphine. Tonics to lull children into submission and slumber. What happens to children who are neglected and learn not to express their needs? Nothing good. Isn't medication better now though? Every drug has its all healing heyday in culture. Medicine could also mean bitter truths to take in. What did Pan need to process in order to heal?
Life can be cruel
When my daughter was born in 2000 I so wished for her to be a strong intelligent young woman, like Greta Thurnberg. Instead I got this; "Dad,you know that show "Pretty Little Liars"?" "No" "Well that's what mom and me are." "Mom and I" "What?"
posted January 1st, 2023 at 3:18 AM
Kinda hypocritical all the people in government against guaranteed income getting paid it. Pathetic reasoning, securing their lofty lifestyle at low incomes expense. Maybe its time to bring back that musical chairs game, to the tune of Talking Heads, watch them go around in circles for a change, fight for scraps, the way the majority do, taking away the last left chairs until none's left. Resolutions.
Loyal to a fault
posted December 31st, 2022 at 11:59 PM
I’ve been a member of a social club for12 years and it is feeling really stale. They don’t invest in the future. With a new year, I think, can I endure the same boredom, mismanagement and egos for an other yrar? Time to leave for a change of scenery.
posted December 31st, 2022 at 2:03 PM
I had a dream last night, a nightmare really ! In my dream no one would rent me an apartment and no one would even help me find one, people were being mean and uncaring and shifty. In my dream I couldn't understand why I was being left to the wayside and overlooked. Then I woke up and realized it wasn't a dream at all.
We’re Still Here
posted December 30th, 2022 at 7:48 PM
Remember that once again we lived through history this year. Looking back, our lives have been filled with change, intrigue, and adventurous uncertainties. I’ll take it as a win and will drink a cup of kindness for auld lang syne. Cheers to us.
I remember damage. Then escape.
I hear and read the phrase narcissist thrown around a lot. Admittedly I’m afraid. What if that’s me? The intention is to do no harm, but what if I am? How do you find out if you’re what you fear the most. And what things can be done to mitigate.
posted December 29th, 2022 at 11:06 AM
There's a story on repeat in the back of my mind. If I pay attention I notice something - It influences every decision I make. But what is the truth of that story. How to go about rewriting the unseen controls that manage this life.