US6044155A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for securely archiving core data secrets
Assignee: Microsoft Technology Licensing LLC
•
Filing: 1997-12-23
•
Granted: 2000-03-28
•
Expires: 2017-12-23
Abstract
Abstract The invention provides central storage for core data secrets, referred to as data items. The data items are encrypted by a client computer using a client key that is derived from a logon secret, such as a password, supplied by a user during a network logon procedure. The client key is escrowed with the participation of a network supervisory computer such as a domain controller. The client sends the client key to the domain controller. The domain controller appends a user identification corresponding to the currently authenticated user of the client computer, and encrypts the resulting combination. The encrypted combination is sent back to and stored locally by the client. To recover the client key, the encrypted combination is sent to the domain controller, which decrypts the combination to obtain the data item. However, the data item is returned to the client computer only if the decrypted user identification corresponds to the currently authenticated user of the client computer.
Inventors
- 👤 Matthew W. Thomlinson
- 👤 Scott Field
- 👤 Allan Cooper
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-09 14:07
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6245; H04L63/06; H04L63/08; H04L63/12; G06F2211/00; G06F2211/007; G06F2211/008; G06F2221/00; G06F2221/21; G06F2221/2149
Claims Analysis
Total Claims: 70
Claim 1
Independent Claim
180 words
A method of securely storing and recovering data protection keys, comprising the following steps: deriving a client key from a user secret that is supplied by a user during network logon procedures; securing user data on a client computer with the client key; sending the client key to a network supervisory computer that authenticates network users during user logon procedures; encrypting a data combination at the network supervisory computer, the data combination including the client key and a user identification corresponding to a currently authenticated current user of the client computer; returning the encrypted data combination to the client computer; storing the encrypted data combination at the client computer; sending the encrypted data combination to the network supervisory computer in order to recover the client key; decrypting the data combination at the network supervisory computer to obtain the client key and the user identification in response to receiving the encrypted data combination from the client computer; returning the client key to the client computer only if the obtained user identification corresponds to the currently authenticated user of the client computer.
Claim 2
Independent Claim
180 words
A method of securely storing and recovering data protection keys, comprising the following steps: deriving a client key from a user secret that is supplied by a user during network logon procedures; securing user data on a client computer with the client key; sending the client key to a network supervisory computer that authenticates network users during user logon procedures; encrypting a data combination at the network supervisory computer, the data combination including the client key and a user identification corresponding to a currently authenticated current user of the client computer; returning the encrypted data combination to the client computer; storing the encrypted data combination at the client computer; sending the encrypted data combination to the network supervisory computer in order to recover the client key; decrypting the data combination at the network supervisory computer to obtain the client key and the user identification in response to receiving the encrypted data combination from the client computer; returning the client key to the client computer only if the obtained user identification corresponds to the currently authenticated user of the client computer.
Claim 3
Dependent Claim
25 words
A method as recited in claim 1, further comprising an additional step of encrypting the client key before sending it to the network supervisory computer.
Claim 4
Dependent Claim
42 words
A method as recited in claim 1, further comprising the following additional steps: encrypting the client key before sending it to the network supervisory computer; decrypting the client key at the client computer after returning the client key to the client computer.
Claim 5
Dependent Claim
40 words
A method as recited in claim 1, further comprising an additional step of creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code.
Claim 6
Dependent Claim
67 words
A method as recited in claim 1, further comprising an additional step of creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code, wherein the step of returning the client key is conditioned upon a successful authentication of the client key and the user identification using the message authentication code.
Claim 7
Dependent Claim
58 words
A method as recited in claim 1, wherein the encrypting step is performed using an encryption key that is derived from a master key and a random key, the method further comprising the following additional steps: returning the random key with the encrypted data combination to the client computer; and storing the random key at the client computer.
Claim 8
Dependent Claim
77 words
A method as recited in claim 1, wherein the encrypting step is performed using an encryption key that is derived from a master key and a random key, the method further comprising the following additional steps: returning the random key with the encrypted data combination to the client computer; storing the random key at the client computer; sending the random key to the network supervisory computer from the client computer in order to recover the client key.
Claim 9
Dependent Claim
83 words
A method as recited in claim 1, further comprising the following additional steps: creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; returning the random key with the encrypted data combination to the client computer; storing the random key at the client computer.
Claim 10
Dependent Claim
130 words
A method as recited in claim 1, further comprising the following additional steps: creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; returning the random key with the encrypted data combination to the client computer; storing the random key at the client computer; sending the random key to the network supervisory computer from the client computer in order to recover the client key; wherein the step of returning the client key is conditioned upon a successful authentication of the client key and the user identification using the message authentication code.
Claim 11
Dependent Claim
124 words
A method as recited in claim 1, further comprising the following additional steps: encrypting the client key before sending it to the network supervisory computer; creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; wherein the encrypting step is performed using an encryption key that is derived from a master key and a second random key; returning the first and second random keys with the encrypted data combination to the client computer; storing the first and second random keys at the client computer.
Claim 12
Dependent Claim
174 words
A method as recited in claim 1, further comprising the following additional steps: encrypting the client key before sending it to the network supervisory computer creating a message authentication code based at least in part on the client key and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; wherein the encrypting step is performed using an encryption key that is derived from a master key and a second random key; returning the first and second random keys with the encrypted data combination to the client computer; storing the first and second random keys at the client computer; sending the first and second random keys to the network supervisory computer from the client computer in order to recover the client key; wherein the step of returning the client key is conditioned upon a successful authentication of the client key and the user identification using the message authentication code.
Claim 13
Dependent Claim
64 words
A network supervisory computer that is programmed to perform steps comprising: authenticating a current user of a network client through a network logon procedure; receiving a data item from the network client; encrypting a data combination that includes the data item and a user identification corresponding to the currently authenticated user of the network client; returning the encrypted data combination to the client computer.
Claim 14
Dependent Claim
64 words
A network supervisory computer that is programmed to perform steps comprising: authenticating a current user of a network client through a network logon procedure; receiving a data item from the network client; encrypting a data combination that includes the data item and a user identification corresponding to the currently authenticated user of the network client; returning the encrypted data combination to the client computer.
Claim 15
Dependent Claim
20 words
A network supervisory computer as recited in claim 12, wherein the data item is derived from a user logon secret.
Claim 16
Dependent Claim
45 words
A network supervisory computer as recited in claim 12, being further programmed to perform an additional step of creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code.
Claim 17
Dependent Claim
55 words
A network supervisory computer as recited in claim 12, wherein the encrypting step is performed using an encryption key that is derived from a master key and a random key, the network supervisory computer being programmed to perform an additional step of returning the random key with the encrypted data combination to the client computer.
Claim 18
Dependent Claim
79 words
A network supervisory computer as recited in claim 12 being further programmed to perform additional steps comprising: creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; returning the random key with the encrypted data combination to the client computer.
Claim 19
Dependent Claim
105 words
A network supervisory computer as recited in claim 12 being further programmed to perform additional steps comprising: creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; wherein the encrypting step is performed using an encryption key that is derived from a master key and a second random key; returning the first and second random keys with the encrypted data combination to the client computer.
Claim 20
Dependent Claim
15 words
A computer network having a plurality of network supervisory computers as recited in claim 12.
Claim 21
Dependent Claim
32 words
A computer network as recited in claim 18, wherein the network supervisory computers each perform the encrypting step using one or more encryption secrets that are replicated between the network supervisory computers.
Claim 22
Dependent Claim
29 words
A computer network as recited in claim 18, wherein each network client alternatively selects one of the network supervisory computers to perform the authenticating, receiving, encrypting, and returning steps.
Claim 23
Dependent Claim
19 words
A computer network as recited in claim 18, wherein the data item is derived from a user logon secret.
Claim 24
Dependent Claim
48 words
A computer network as recited in claim 18, each network supervisory computer being further programmed to perform an additional step of creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code.
Claim 25
Independent Claim
77 words
A method of securely storing a data item for an authenticated user of a client computer, comprising the following steps: sending the data item to a network supervisory computer; encrypting a data combination at the network supervisory computer, the data combination including the data item and a user identification corresponding to an authenticated current user of the client computer; returning the encrypted data combination to the client computer; storing the encrypted data combination at the client computer.
Claim 26
Independent Claim
77 words
A method of securely storing a data item for an authenticated user of a client computer, comprising the following steps: sending the data item to a network supervisory computer; encrypting a data combination at the network supervisory computer, the data combination including the data item and a user identification corresponding to an authenticated current user of the client computer; returning the encrypted data combination to the client computer; storing the encrypted data combination at the client computer.
Claim 27
Dependent Claim
21 words
A method as recited in claim 23, comprising an additional step of deriving the data item from a user logon secret.
Claim 28
Dependent Claim
29 words
A method as recited in claim 23, wherein the network supervisory computer performs a step of authenticating the current user of the client computer during a network logon procedure.
Claim 29
Dependent Claim
25 words
A method as recited in claim 23, further comprising an additional step of encrypting the data item before sending it to the network supervisory computer.
Claim 30
Dependent Claim
40 words
A method as recited in claim 23, further comprising an additional step of creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code.
Claim 31
Dependent Claim
58 words
A method as recited in claim 23, wherein the encrypting step is performed using an encryption key that is derived from a master key and a random key, the method further comprising the following additional steps: returning the random key with the encrypted data combination to the client computer; and storing the random key at the client computer.
Claim 32
Dependent Claim
83 words
A method as recited in claim 23, further comprising the following additional steps: creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; returning the random key with the encrypted data combination to the client computer; storing the random key at the client computer.
Claim 33
Independent Claim
179 words
A method of securely storing a data item for an authenticated user of a client computer, the method comprising the following steps: deriving the data item from a user logon secret; encrypting the data item; sending the encrypted data item to a network supervisory computer that authenticates users of the client computer; creating a message authentication code based at least in part on the data item and a user identification corresponding to the authenticated user of the client computer, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; encrypting a data combination at the network supervisory computer using an encryption key that is derived from a master key and a second random key, the data combination including the encrypted data item, the user identification, and the message authentication code; returning the encrypted data combination, the first random key, and the second random key to the client computer; storing the encrypted data combination, the first random key, and the second random key at the client computer.
Claim 34
Independent Claim
179 words
A method of securely storing a data item for an authenticated user of a client computer, the method comprising the following steps: deriving the data item from a user logon secret; encrypting the data item; sending the encrypted data item to a network supervisory computer that authenticates users of the client computer; creating a message authentication code based at least in part on the data item and a user identification corresponding to the authenticated user of the client computer, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; encrypting a data combination at the network supervisory computer using an encryption key that is derived from a master key and a second random key, the data combination including the encrypted data item, the user identification, and the message authentication code; returning the encrypted data combination, the first random key, and the second random key to the client computer; storing the encrypted data combination, the first random key, and the second random key at the client computer.
Claim 35
Dependent Claim
25 words
A method as recited in claim 30, wherein the first random key is returned to the client computer as part of the encrypted data combination.
Claim 36
Independent Claim
85 words
A method of restoring a data item for an authenticated user of a client computer, comprising the following steps: sending an encrypted data combination to a network supervisory computer from the client computer, the data combination including the data item and a user identification; decrypting the encrypted data combination at the network supervisory computer to obtain the data item and the user identification; returning the data item to the client computer only if the user identification corresponds to the authenticated user of the client computer.
Claim 37
Independent Claim
85 words
A method of restoring a data item for an authenticated user of a client computer, comprising the following steps: sending an encrypted data combination to a network supervisory computer from the client computer, the data combination including the data item and a user identification; decrypting the encrypted data combination at the network supervisory computer to obtain the data item and the user identification; returning the data item to the client computer only if the user identification corresponds to the authenticated user of the client computer.
Claim 38
Dependent Claim
18 words
A method as recited in claim 32, wherein the data item is derived from a user logon secret.
Claim 39
Dependent Claim
42 words
A method as recited in claim 32, wherein the data item is encrypted within the data combination, the method further comprising a step of decrypting the data item at the client computer after returning the encrypted data item to the client computer.
Claim 40
Dependent Claim
38 words
A method as recited in claim 32, wherein: the data combination includes a message authentication code; the returning step is conditioned upon a successful authentication of the data item and the user identification using the message authentication code.
Claim 41
Dependent Claim
45 words
A method as recited in claim 32, further comprising: sending a locally stored key to the network supervisory computer from the client computer; wherein the decrypting step is performed using a decryption key that is derived from a master key and the locally stored key.
Claim 42
Dependent Claim
80 words
A method as recited in claim 32, wherein: the data combination includes a message authentication code; the method further comprises a step of sending a locally stored key to the network supervisory computer from the client computer; the returning step is conditioned upon a successful authentication of the data item and the user identification using the message authentication code, wherein the authentication is based on an authentication key that is derived from a master key and the locally stored key.
Claim 43
Independent Claim
128 words
A method of restoring a data item for an authenticated user of a client computer, comprising the following steps: sending an encrypted data combination to a network supervisory computer from the client computer, the data combination including the data item, a user identification, and a message authentication code, the data item being encrypted within the data combination; decrypting the encrypted data combination at the network supervisory computer to obtain the encrypted data item and the user identification; returning the encrypted data item to the client computer only if (a) the user identification corresponds to an authenticated current user of the client computer and (b) the encrypted data item and the user identification are successfully authenticated using the message authentication code; decrypting the data item at the client computer.
Claim 44
Independent Claim
128 words
A method of restoring a data item for an authenticated user of a client computer, comprising the following steps: sending an encrypted data combination to a network supervisory computer from the client computer, the data combination including the data item, a user identification, and a message authentication code, the data item being encrypted within the data combination; decrypting the encrypted data combination at the network supervisory computer to obtain the encrypted data item and the user identification; returning the encrypted data item to the client computer only if (a) the user identification corresponds to an authenticated current user of the client computer and (b) the encrypted data item and the user identification are successfully authenticated using the message authentication code; decrypting the data item at the client computer.
Claim 45
Dependent Claim
18 words
A method as recited in claim 38, wherein the data item is derived from a user logon secret.
Claim 46
Dependent Claim
49 words
A method as recited in claim 38, further comprising an additional step of sending a locally stored key to the network supervisory computer from the client computer, wherein the decrypting step is performed using a decryption key that is derived from a master key and the locally stored key.
Claim 47
Dependent Claim
48 words
A method as recited in claim 38, further comprising an additional step of sending a locally stored key to the network supervisory computer from the client computer, wherein the authentication is based on an authentication key that is derived from a master key and the locally stored key.
Claim 48
Dependent Claim
89 words
A method as recited in claim 38, further comprising the following additional steps: sending a first locally stored key to the network supervisory computer from the client computer; sending a second locally stored key to the network supervisory computer from the client computer; wherein the authentication is based on an authentication key that is derived from a master key and the first locally stored key; and wherein the decrypting step is performed using a decryption key that is derived from a master key and the second locally stored key.
Claim 49
Independent Claim
176 words
A system for storing and recovering data items and for protecting them from unauthorized access, comprising: a network supervisory computer that authenticates users of client computers; a client computer that communicates with the network supervisory computer, the client computer being programmed to send a data item to the network supervisory computer; the network supervisory computer being programmed to encrypt a data combination comprising the data item and a user identification corresponding to an authenticated current user of the client computer, and to return the encrypted data combination to the client computer; the client computer being programmed to store the encrypted data combination and to send the encrypted data combination to the network supervisory computer to recover the data item; the network supervisory computer being programmed to decrypt the data combination to obtain the data item and the user identification in response to receiving the encrypted data combination from the client computer, and to return the data item to the client computer only if the user identification corresponds to the currently authenticated user of the client computer.
Claim 50
Independent Claim
176 words
A system for storing and recovering data items and for protecting them from unauthorized access, comprising: a network supervisory computer that authenticates users of client computers; a client computer that communicates with the network supervisory computer, the client computer being programmed to send a data item to the network supervisory computer; the network supervisory computer being programmed to encrypt a data combination comprising the data item and a user identification corresponding to an authenticated current user of the client computer, and to return the encrypted data combination to the client computer; the client computer being programmed to store the encrypted data combination and to send the encrypted data combination to the network supervisory computer to recover the data item; the network supervisory computer being programmed to decrypt the data combination to obtain the data item and the user identification in response to receiving the encrypted data combination from the client computer, and to return the data item to the client computer only if the user identification corresponds to the currently authenticated user of the client computer.
Claim 51
Dependent Claim
19 words
A system as recited in claim 43, wherein client computer derives the data item from a user logon secret.
Claim 52
Dependent Claim
26 words
A system as recited in claim 43, wherein the client computer is programmed to encrypt the data item before sending it to the network supervisory computer.
Claim 53
Dependent Claim
40 words
A system as recited in claim 43, wherein the client computer is programmed to encrypt the data item before sending it to the network supervisory computer and to decrypt the data item upon receiving it from the network supervisory computer.
Claim 54
Dependent Claim
42 words
A system as recited in claim 43, wherein the network supervisory computer is programmed to create a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code.
Claim 55
Dependent Claim
77 words
A system as recited in claim 43, wherein: the network supervisory computer is programmed to create a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code the network supervisory computer is programmed to condition the return of the data item to the client computer upon a successful authentication of the data item and the user identification using the message authentication code.
Claim 56
Dependent Claim
46 words
A system as recited in claim 43, wherein the network supervisory computer encrypts the data combination using an encryption key that is derived from a master key and a random key, and to return the random key with the encrypted data combination to the client computer.
Claim 57
Dependent Claim
65 words
A system as recited in claim 43, wherein: the network supervisory computer encrypts the data combination using an encryption key that is derived from a master key and a random key, and to return the random key with the encrypted data combination to the client computer; the client computer sends the random key to the network supervisory computer in order to recover the client key.
Claim 58
Dependent Claim
81 words
A system as recited in claim 43, wherein: the network supervisory computer is programmed to create a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; the network supervisory computer returns the random key with the encrypted data combination to the client computer.
Claim 59
Dependent Claim
135 words
A system as recited in claim 43, wherein: the network supervisory computer is programmed to create a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; the network supervisory computer returns the random key with the encrypted data combination to the client computer. the client computer sends the random key to the network supervisory computer in order to recover the data item; the network supervisory computer is programmed to condition the return of the data item to the client computer upon a successful authentication of the data item and the user identification using the message authentication code.
Claim 60
Dependent Claim
71 words
A computer-readable storage medium containing instructions that are executable by a network supervisory computer to perform steps comprising: authenticating a current user of a network client through a network logon procedure; receiving a data item from the network client; encrypting a data combination that includes the data item and a user identification corresponding to the currently authenticated user of the network client; returning the encrypted data combination to the client computer.
Claim 61
Dependent Claim
71 words
A computer-readable storage medium containing instructions that are executable by a network supervisory computer to perform steps comprising: authenticating a current user of a network client through a network logon procedure; receiving a data item from the network client; encrypting a data combination that includes the data item and a user identification corresponding to the currently authenticated user of the network client; returning the encrypted data combination to the client computer.
Claim 62
Dependent Claim
24 words
A computer-readable storage medium as recited in claim 53, data item is derived from a user logon secret supplied during the network logon procedure.
Claim 63
Dependent Claim
44 words
A computer-readable storage medium as recited in claim 53, containing instructions for performing an additional step of creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code.
Claim 64
Dependent Claim
53 words
A computer-readable storage medium as recited in claim 53, wherein the encrypting step is performed using an encryption key that is derived from a master key and a random key, the instructions being executable to perform an additional step of returning the random key with the encrypted data combination to the client computer.
Claim 65
Dependent Claim
79 words
A computer-readable storage medium as recited in claim 53 containing further instructions for performing additional steps comprising: creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a random key; returning the random key with the encrypted data combination to the client computer.
Claim 66
Dependent Claim
105 words
A computer-readable storage medium as recited in claim 53 containing further instructions for performing additional steps comprising: creating a message authentication code based at least in part on the data item and the user identification, the data combination further including the message authentication code, wherein the message authentication code is created using an authentication key that is derived from a master key and a first random key; wherein the encrypting step is performed using an encryption key that is derived from a master key and a second random key; returning the first and second random keys with the encrypted data combination to the client computer.
Claim 67
Dependent Claim
121 words
A computer-readable storage medium containing instructions that are executable by a network client to perform steps comprising: deriving a client key from a user secret that is supplied by a user during network logon procedures; securing user data with the client key; sending the client key to a network supervisory computer that authenticates network users during user logon procedures; in response to sending the client key, receiving an encrypted data combination from the network supervisory computer, the encrypted data combination being decryptable by the network supervisory computer to obtain the client key, wherein the encrypted data combination is not decryptable by the network computer; storing the encrypted data combination for use in recovering the client key when the user secret changes.
Claim 68
Dependent Claim
121 words
A computer-readable storage medium containing instructions that are executable by a network client to perform steps comprising: deriving a client key from a user secret that is supplied by a user during network logon procedures; securing user data with the client key; sending the client key to a network supervisory computer that authenticates network users during user logon procedures; in response to sending the client key, receiving an encrypted data combination from the network supervisory computer, the encrypted data combination being decryptable by the network supervisory computer to obtain the client key, wherein the encrypted data combination is not decryptable by the network computer; storing the encrypted data combination for use in recovering the client key when the user secret changes.
Claim 69
Dependent Claim
35 words
A computer-readable storage medium as recited in claim 59 containing further instructions for performing an additional step of sending the encrypted data combination to the network supervisory computer in order to recover the client key.
Claim 70
Dependent Claim
30 words
A computer-readable storage medium as recited in claim 59 containing further instructions for performing an additional step of encrypting the client key before sending it to the network supervisory computer.
References Cited (Backward Citations)
US4933969A
Cited
EP0442839A2
Cited
EP0456386A2
Cited
US5555304A
Cited
US5870477A
Cited
US5432851A
Cited
US5509074A
Cited
US5495533A
Cited
US5530758A
Cited
US5748735A
Cited
EP0717339A2
Cited
US5870468A
Cited
EP0820017A2
Cited
US5889860A
Cited
US5953422A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-03-28 | 2003-09-27 | 2004-03-28 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-03-28 | 2007-09-27 | 2008-03-28 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-03-28 | 2011-09-27 | 2012-03-28 | $7700.00 | Window Closed / Lapsed |