Patent US5983350A successfully refreshed from Google Patents.
US5983350A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure firewall supporting different levels of authentication based on address or encryption status
Assignee: McAfee LLC
•
Filing: 1996-09-18
•
Granted: 1999-11-09
•
Expires: 2016-09-18
Abstract
Abstract A system and method for regulating the flow of messages through a firewall having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising establishing a security policy, determining, at the IP layer, if a message is encrypted, if the message is not encrypted, passing the unencrypted message up the network protocol stack to an application level proxy, and if the message is encrypted, decrypting the message and passing the decrypted message up the network protocol stack to the application level proxy, wherein decrypting the message includes executing a process at the IP layer to decrypt the message.
Inventors
- 👤 Spence Minear
- 👤 Edward B. Stockwell
- 👤 Troy de Jongh
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 07:50
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/04; H04L63/0428; H04L63/0485; H04L69/00; H04L69/16; H04L69/161; H04L63/12; H04L63/126; H04L63/16; H04L63/164
Claims Analysis
Total Claims: 27
Claim 1
Independent Claim
181 words
A method of regulating the flow of messages between an external network and an internal network through a firewall having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: establishing a security policy; determining, at the IP layer, if a message to an IP address is encrypted; if the message to the IP address is not encrypted, passing the unencrypted message up the network protocol stack to an application level proxy; if the message to the IP address is encrypted, decrypting the message and passing the decrypted message up the network protocol stack to the application level proxy, wherein decrypting the message includes executing a procedure at the IP layer to decrypt the message; determining at the application level proxy and based on the security policy if the message to that IP address is one that can be forwarded, wherein the decision whether to forward is a function of whether the message was encrypted when received; and passing the message from the application level proxy to its destination through the IP layer.
Claim 2
Independent Claim
181 words
A method of regulating the flow of messages between an external network and an internal network through a firewall having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: establishing a security policy; determining, at the IP layer, if a message to an IP address is encrypted; if the message to the IP address is not encrypted, passing the unencrypted message up the network protocol stack to an application level proxy; if the message to the IP address is encrypted, decrypting the message and passing the decrypted message up the network protocol stack to the application level proxy, wherein decrypting the message includes executing a procedure at the IP layer to decrypt the message; determining at the application level proxy and based on the security policy if the message to that IP address is one that can be forwarded, wherein the decision whether to forward is a function of whether the message was encrypted when received; and passing the message from the application level proxy to its destination through the IP layer.
Claim 3
Independent Claim
161 words
A method of authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; determining, at the IP layer, if the message is encrypted; if the message is encrypted, decrypting the message, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; passing the decrypted message up the network protocol stack to an application level proxy; selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the message, wherein the authentication protocol selected is a function of whether the message was encrypted when received; executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and passing the decrypted message through the IP layer to its destination.
Claim 4
Independent Claim
161 words
A method of authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; determining, at the IP layer, if the message is encrypted; if the message is encrypted, decrypting the message, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; passing the decrypted message up the network protocol stack to an application level proxy; selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the message, wherein the authentication protocol selected is a function of whether the message was encrypted when received; executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and passing the decrypted message through the IP layer to its destination.
Claim 5
Dependent Claim
36 words
The method according to claim 2 wherein determining an authentication protocol appropriate for the message includes: determining a source IP address associated with the message; and determining the authentication protocol associated with the source IP address.
Claim 6
Independent Claim
183 words
A method of authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: determining, at the IP layer, if the message is encrypted; if the message is encrypted, decrypting the message, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; passing the decrypted message up the network protocol stack to an application level proxy; determining an authentication protocol appropriate for the message wherein the message includes a security parameters index and wherein determining an authentication protocol appropriate for the message includes: determining the authentication protocol associated with a dynamic IP address, wherein determining the authentication protocol includes looking up a security association based on the security parameters index; determining a current address associated with the dynamic source IP address; and binding the current address to the security parameters index; executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and passing the decrypted message through the IP layer to its destination.
Claim 7
Independent Claim
183 words
A method of authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the method comprising: determining, at the IP layer, if the message is encrypted; if the message is encrypted, decrypting the message, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; passing the decrypted message up the network protocol stack to an application level proxy; determining an authentication protocol appropriate for the message wherein the message includes a security parameters index and wherein determining an authentication protocol appropriate for the message includes: determining the authentication protocol associated with a dynamic IP address, wherein determining the authentication protocol includes looking up a security association based on the security parameters index; determining a current address associated with the dynamic source IP address; and binding the current address to the security parameters index; executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and passing the decrypted message through the IP layer to its destination.
Claim 8
Dependent Claim
22 words
The method according to claim 4 wherein the authentication protocol selected is a function of whether the message was encrypted when received.
Claim 9
Dependent Claim
156 words
A firewall, comprising: a first communications interface; a second communications interface; a network protocol stack connected to the first and the second communications interfaces, wherein the network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a decryption procedure, operating at the IP layer, wherein the decryption procedure decrypts encrypted messages received at one of said first and second communications interfaces and outputs decrypted messages; and an application layer proxy, connected to the transport layer of said network protocol stack, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols as a function of content of the decrypted message and whether the message was encrypted when received, executes the selected authentication protocol, and returns the message to the IP layer.
Claim 10
Dependent Claim
156 words
A firewall, comprising: a first communications interface; a second communications interface; a network protocol stack connected to the first and the second communications interfaces, wherein the network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a decryption procedure, operating at the IP layer, wherein the decryption procedure decrypts encrypted messages received at one of said first and second communications interfaces and outputs decrypted messages; and an application layer proxy, connected to the transport layer of said network protocol stack, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols as a function of content of the decrypted message and whether the message was encrypted when received, executes the selected authentication protocol, and returns the message to the IP layer.
Claim 11
Dependent Claim
216 words
A firewall, comprising: a first communications interface; a second communications interface; a first network protocol stack connected to the first communications interface, wherein the first network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a second network protocol stack connected to the second communications interface, wherein the second network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a security policy; a decryption procedure, operating at the IP layer of the first network protocol stack, the decryption procedure receiving encrypted messages received by said first communications interface and outputting decrypted messages; and an application layer proxy, connected to the transport layers of said first and second network protocol stacks, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols based on content of the decrypted message and whether the message was encrypted when received, and executes the selected authentication protocol; and wherein the application layer proxy determines based on the security policy whether the message is to be forwarded, and wherein the message is returned to the IP layer if the message is to be forwarded.
Claim 12
Dependent Claim
216 words
A firewall, comprising: a first communications interface; a second communications interface; a first network protocol stack connected to the first communications interface, wherein the first network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a second network protocol stack connected to the second communications interface, wherein the second network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a security policy; a decryption procedure, operating at the IP layer of the first network protocol stack, the decryption procedure receiving encrypted messages received by said first communications interface and outputting decrypted messages; and an application layer proxy, connected to the transport layers of said first and second network protocol stacks, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols based on content of the decrypted message and whether the message was encrypted when received, and executes the selected authentication protocol; and wherein the application layer proxy determines based on the security policy whether the message is to be forwarded, and wherein the message is returned to the IP layer if the message is to be forwarded.
Claim 13
Dependent Claim
264 words
A firewall, comprising: a first communications interface; a second communications interface; a first network protocol stack connected to the first communications interface, wherein the first network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a second network protocol stack connected to the second communications interface, wherein the second network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a security policy; a decryption procedure, operating at the IP layer of the first network protocol stack, the decryption procedure receiving encrypted messages received by said first communications interface and outputting decrypted messages; and an application layer proxy, connected to the transport layers of said first and second network protocol stacks, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols based on the content of the decrypted message, and executes the selected authentication protocol and wherein the application layer proxy determines based on the security policy whether the message is to be forwarded, and wherein the message is returned to the IP layer if the message is to be forwarded; a third communications interface; and a third network protocol stack connected to the third communications interface and to the application layer proxy, wherein the third network protocol stack includes an Internet Protocol (IP) layer and a transport layer and wherein the second and third network protocol stacks are restricted to first and second burbs, respectively.
Claim 14
Dependent Claim
264 words
A firewall, comprising: a first communications interface; a second communications interface; a first network protocol stack connected to the first communications interface, wherein the first network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a second network protocol stack connected to the second communications interface, wherein the second network protocol stack includes an Internet Protocol (IP) layer and a transport layer; a security policy; a decryption procedure, operating at the IP layer of the first network protocol stack, the decryption procedure receiving encrypted messages received by said first communications interface and outputting decrypted messages; and an application layer proxy, connected to the transport layers of said first and second network protocol stacks, wherein the application layer proxy includes a plurality of authentication protocols, wherein each authentication protocol provides a different level of security, wherein the application layer proxy receives decrypted messages from the decryption procedure, selects an authentication protocol from the plurality of authentication protocols based on the content of the decrypted message, and executes the selected authentication protocol and wherein the application layer proxy determines based on the security policy whether the message is to be forwarded, and wherein the message is returned to the IP layer if the message is to be forwarded; a third communications interface; and a third network protocol stack connected to the third communications interface and to the application layer proxy, wherein the third network protocol stack includes an Internet Protocol (IP) layer and a transport layer and wherein the second and third network protocol stacks are restricted to first and second burbs, respectively.
Claim 15
Dependent Claim
21 words
The firewall according to claim 8 wherein the authentication protocol is also based on whether the message was encrypted when received.
Claim 16
Independent Claim
233 words
A method of establishing a virtual private network between a first and a second network, wherein each network includes an application level gateway firewall which uses a proxy operating at the application layer to process traffic through the firewall, wherein each firewall includes a network protocol stack and wherein each network protocol stack includes an Internet Protocol (IP) layer, the method comprising: providing a plurality of authenication protocols, wherein each authentication prtocol provides a different level of security; transferring a connection request from the first network to the second network; determining, at the IP layer of the network protocol stack of the second network's firewall, if the connection request is encrypted; if the connection request is encrypted, decrypting the request, wherein decrypting the request includes executing a procedure at the IP layer of the second network's firewall to decrypt the message; passing the connection request up the network protocol stack to an application level proxy; selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the connection request, wherein the authentication protocol selected is a function of whether the message was encrypted when received; executing the authentication protocol at the application level proxy to authenticate the connection request; and if the connection request is authentic, establishing an active connection between the first and second networks and returning the connection request to the IP layer.
Claim 17
Independent Claim
233 words
A method of establishing a virtual private network between a first and a second network, wherein each network includes an application level gateway firewall which uses a proxy operating at the application layer to process traffic through the firewall, wherein each firewall includes a network protocol stack and wherein each network protocol stack includes an Internet Protocol (IP) layer, the method comprising: providing a plurality of authenication protocols, wherein each authentication prtocol provides a different level of security; transferring a connection request from the first network to the second network; determining, at the IP layer of the network protocol stack of the second network's firewall, if the connection request is encrypted; if the connection request is encrypted, decrypting the request, wherein decrypting the request includes executing a procedure at the IP layer of the second network's firewall to decrypt the message; passing the connection request up the network protocol stack to an application level proxy; selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the connection request, wherein the authentication protocol selected is a function of whether the message was encrypted when received; executing the authentication protocol at the application level proxy to authenticate the connection request; and if the connection request is authentic, establishing an active connection between the first and second networks and returning the connection request to the IP layer.
Claim 18
Dependent Claim
36 words
The method according to claim 10 wherein executing the authentication protocol includes executing program code within the firewall of the second network to mimic a challenge/response protocol executing on a server internal to the second network.
Claim 19
Dependent Claim
25 words
The method according to claim 10 wherein executing the authentication protocol includes executing program code to execute the authentication protocol in line to the session.
Claim 20
Dependent Claim
197 words
A computer-readable medium having computer-executable instructions for regulating the flow of messages between an external network and an internal network through a firewall having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP), layer the instructions comprising: instructions for establishing a security policy; instructions for determining, at the IP layer, if a message to an IP address is encrypted; instructions for passing the unencrypted message up the network protocol stack to an application level proxy if the message to the IP address is not encrypted; instructions for decrypting the message and passing the decrypted message up the network protocol stack to the application level proxy if the message to the IP address is encrypted, wherein decrypting the message includes executing a procedure at the IP layer to decrypt the message; instructions for determining at the application level proxy and based on the security policy if the message to that IP address is one that can be forwarded, wherein the decision whether to forward is a function of whether the message was encrypted when received; and instructions for passing the message from the application level proxy to its destination through the IP layer.
Claim 21
Dependent Claim
197 words
A computer-readable medium having computer-executable instructions for regulating the flow of messages between an external network and an internal network through a firewall having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP), layer the instructions comprising: instructions for establishing a security policy; instructions for determining, at the IP layer, if a message to an IP address is encrypted; instructions for passing the unencrypted message up the network protocol stack to an application level proxy if the message to the IP address is not encrypted; instructions for decrypting the message and passing the decrypted message up the network protocol stack to the application level proxy if the message to the IP address is encrypted, wherein decrypting the message includes executing a procedure at the IP layer to decrypt the message; instructions for determining at the application level proxy and based on the security policy if the message to that IP address is one that can be forwarded, wherein the decision whether to forward is a function of whether the message was encrypted when received; and instructions for passing the message from the application level proxy to its destination through the IP layer.
Claim 22
Dependent Claim
179 words
A computer-readable medium having computer-executable instructions for authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer the instructions comprising: instructions for providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; instructions for determining, at the IP layer, if the message is encrypted; instructions for decrypting the message if the message is encrypted, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; instructions for passing the decrypted message up the network protocol stack to an application level proxy; instructions for selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the message, wherein the authentication protocol selected is a function of whether the message was encrypted when received; instructions for executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and instructions for passing the decrypted message through the IP layer to its destination.
Claim 23
Dependent Claim
179 words
A computer-readable medium having computer-executable instructions for authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer the instructions comprising: instructions for providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; instructions for determining, at the IP layer, if the message is encrypted; instructions for decrypting the message if the message is encrypted, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; instructions for passing the decrypted message up the network protocol stack to an application level proxy; instructions for selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the message, wherein the authentication protocol selected is a function of whether the message was encrypted when received; instructions for executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and instructions for passing the decrypted message through the IP layer to its destination.
Claim 24
Dependent Claim
250 words
A computer-readable medium having computer-executable instructions for establishing a virtual private network between a first and a second network, wherein each network includes an application level gateway firewall which uses a proxy operating at the application layer to process traffic through the firewall, wherein each firewall includes a network protocol stack and wherein each network protocol stack includes an Internet Protocol (IP) layer, the instructions comprising: instructions for providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; instructions for transferring a connection request from the first network to the second network; instructions for determining, at the IP layer of the network protocol stack of the second network's firewall, if the connection request is encrypted; instructions for decrypting the request if encrypted, wherein decrypting the request includes executing a procedure at the IP layer of the second network's firewall to decrypt the message; instructions for passing the connection request up the network protocol stack to an application level proxy; instructions for selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the connection request, wherein the authentication protocol selected is a function of whether the message was encrypted when received; instructions for executing the authentication protocol at the application level proxy to authenticate the connection request; and instructions for establishing, if the connection request is authentic, an active connection between the first and second networks and for returning the connection request to the IP layer.
Claim 25
Dependent Claim
250 words
A computer-readable medium having computer-executable instructions for establishing a virtual private network between a first and a second network, wherein each network includes an application level gateway firewall which uses a proxy operating at the application layer to process traffic through the firewall, wherein each firewall includes a network protocol stack and wherein each network protocol stack includes an Internet Protocol (IP) layer, the instructions comprising: instructions for providing a plurality of authentication protocols, wherein each authentication protocol provides a different level of security; instructions for transferring a connection request from the first network to the second network; instructions for determining, at the IP layer of the network protocol stack of the second network's firewall, if the connection request is encrypted; instructions for decrypting the request if encrypted, wherein decrypting the request includes executing a procedure at the IP layer of the second network's firewall to decrypt the message; instructions for passing the connection request up the network protocol stack to an application level proxy; instructions for selecting an authentication protocol from the plurality of authentication protocols, wherein selecting includes determining an authentication protocol appropriate for the connection request, wherein the authentication protocol selected is a function of whether the message was encrypted when received; instructions for executing the authentication protocol at the application level proxy to authenticate the connection request; and instructions for establishing, if the connection request is authentic, an active connection between the first and second networks and for returning the connection request to the IP layer.
Claim 26
Dependent Claim
196 words
A computer-readable medium having computer-executable instructions for authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the instructions comprising: instructions for determining, at the IP layer, if the message is encrypted; instructions for decrypting the message if encrypted, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; instructions for passing the decrypted message up the network protocol stack to an application level proxy; instructions for determining an authentication protocol appropriate for the message wherein the message includes a security parameters index and wherein determining an authentication protocol appropriate for the message includes: determining the authentication protocol associated with a dynamic IP address, wherein determining the authentication protocol includes looking up a security association based on the security parameters index; determining a current address associated with the dynamic source IP address; and binding the current address to the security parameters index; instructions for executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and instructions for passing the decrypted message through the IP layer to its destination.
Claim 27
Dependent Claim
196 words
A computer-readable medium having computer-executable instructions for authenticating the sender of a message within a computer system having a network protocol stack, wherein the network protocol stack includes an Internet Protocol (IP) layer, the instructions comprising: instructions for determining, at the IP layer, if the message is encrypted; instructions for decrypting the message if encrypted, wherein decrypting the message includes executing a process at the IP layer to decrypt the message; instructions for passing the decrypted message up the network protocol stack to an application level proxy; instructions for determining an authentication protocol appropriate for the message wherein the message includes a security parameters index and wherein determining an authentication protocol appropriate for the message includes: determining the authentication protocol associated with a dynamic IP address, wherein determining the authentication protocol includes looking up a security association based on the security parameters index; determining a current address associated with the dynamic source IP address; and binding the current address to the security parameters index; instructions for executing, at the application level proxy, the authentication protocol to authenticate the sender of the message; and instructions for passing the decrypted message through the IP layer to its destination.
References Cited (Backward Citations)
US4177510A
Cited
US3956615A
Cited
US4104721A
Cited
US4442484A
Cited
US4648031A
Cited
US4870571A
Cited
US4584639A
Cited
US4621321A
Cited
US4701840A
Cited
US4713753A
Cited
US4885789A
Cited
US5093914A
Cited
US5204961A
Cited
US5303303A
Cited
US5124984A
Cited
US5153918A
Cited
US5263147A
Cited
US5272754A
Cited
US5228083A
Cited
US5355474A
Cited
US5305385A
Cited
EP0554182A1
Cited
US5583940A
Cited
US5333266A
Cited
US5276735A
Cited
US5311593A
Cited
US5644571A
Cited
US5329623A
Cited
US5586260A
Cited
US5414833A
Cited
US5606668A
Cited
US5530758A
Cited
US5511122A
Cited
US5416842A
Cited
US5615340A
Cited
US5485460A
Cited
US5604490A
Cited
US5548646A
Cited
WO1996013113A1
Cited
US5623601A
Cited
US5720035A
Cited
US5619648A
Cited
US5550984A
Cited
US5566170A
Cited
WO1996031035A1
Cited
US5699513A
Cited
EP0743777A2
Cited
US5636371A
Cited
US5706507A
Cited
WO1997013340A1
Cited
US5689566A
Cited
WO1997016911A1
Cited
US5671279A
Cited
WO1997023972A1
Cited
WO1997026735A1
Cited
WO1997026731A1
Cited
WO1997026734A1
Cited
US5781550A
Cited
WO1997029413A2
Cited
US5684951A
Cited
US5673322A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-11-08 | 2003-05-10 | 2003-11-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-11-08 | 2007-05-10 | 2007-11-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-11-08 | 2011-05-10 | 2011-11-09 | $7700.00 | Window Closed / Lapsed |