Thomas Haynes Email and Phone Number

Understand the current IMS/VoLTE environment, including the strengths and weaknesses. Understand the roaming standards and how the VZW direction applies to the current design. Work with HQ Planning on the design of the PGW to mitigate some of the risks posed by the current system such as moving traffic off of the MSC FW so that Internet-based attacks cannot effect the voice service. Also working with HQ Planning to implement a SIP ALG to mitigate the risk of peer2peer covert communication channels. Worked with the Device Team and NNO to mitigate a possible DoS/fraud channel by blocking peer-to-peer (P2P) signaling traffic.

Security Gateway design and planning for the femto and other inbuilding cell solutions (Small Cells, CBRS, Pico, etc.) that use IPSec over the Internet as backhaul. Tasks include capacity planning, endpoint authentication methods, certificate processes. Developed the IPSec test plan used by third party security consultants, and directed security consultants to "areas of interest" in particular products. Designed backend support systems for the SeGW using a AAA server to calculate AKA vectors, and certificate whitelist validation. Working the VZW Security Review team to ensure that projects from HQ Planning are designed securely to minimize disruption in the review process, or to point out areas of interest that should be thoroughly investigated in the review. Occasionally, work directly with third party security consultants and the reviewer to ensure the product is tested to satisfaction.

Collaborate with network, device teams and SIM vendors to develop a new secure mobile device provisioning process for use with all LTE devices. This repeatable process utilizes multiple UICC or SIM card vendors and network provisioning systems to securely load mobile device profiles. This ensures that all keys on the card are properly secured on all network elements for each subscription. Work with the Fraud team to ensure that no entity with VZW has enough access to provision a device outside of normal provisioning channels. Ensure that downloaded profiles through Dynamic Provisioning (eSIM/eUICC) are stored and transmitted securely so that there is a remote chance of fraud.Encryption key custodian for all wireless provisioning, including UICC/eUICC, HSS, and OTA. This includes key generation and usage methodologiesWork with the FW and network team to understand the security requirements for the SAP locations and the purpose of the MSC FW. Make recommendations on how to improve the performance of the FW by moving unnecessary traffic off of the MSC FW to save resources. This traffic includes the mobile access to the local caching DNS servers and all IMS/VoLTE traffic. Understand current Internet-based attack patterns to ensure that the RAN only processes necessary traffic.Understand each element in the 3GPP EPC core and their capabilities in securing the traffic that passes through it. Each element can add a layer of security minimizing the network security infrastructure required in the 3GPP SGI interface to secure the EPC.

Work with existing firewall and network teams to manage legacy VPN infrastructure, design and implement a geographic, fault-tolerant VPN environment for employee VPN access. Design secure third party VPN access to replace legacy point to point circuits. Normal operations included working with third parties and internal customers to understand the requirements of the VPN connection including the appropriate firewall rules, as well as submit and work the change controls to implement the connections. Design, implement and manage a desktop proxy solution for all VZW IT users which included silent authentication, and virus scanning and web site filters. Build tools to support the VZW IT Firewall team to quickly perform some job functions.