IETF ANIMA implementation, IoT onboarding

2016 to 2022

With support from several major router vendors, co-led IETF ANIMA WG secure bootstrap design team, resulting in RFC8366 (vouchers), RFC8995 (BRSKI), as well as open source reference implementation at: Minerva ANIMA reference implementation. This is the BRSKI effort. Worked through record setting 9 month long IESG review, resulting in the base document finally being approved in April, 2020, with publication in May 2021. Lead weekly multistakeholder BRSKI Design Team to work on multiple extensions to BRSKI, constrained-BRSKI, updates to multiple other dependant RFCs. Lead regular Remote ATtestation proceedureS (RATS) Architecture design team. Helped create IOTOPS IETF Working group focused on IoT operations and security.

CIRA Secure Home Gateway project

2018 to 2021

In order to prepare for the defense of critical Internet infrastructure against the next "Murai"-style Distributed Denial of Service attack, the Canadian Internet Registration Authority (cira.ca) started the Secure Home gateway project The project is to defend IoT devices from Internet attacks, and defend the Internet from IoT devices. The use of RFC8520 standard Manufacturer Usage Description files was a critical part of the October 2018 proof of concept. After some struggles in direction, the project will go into an Alpha test in 2020 as soon as lockdown ends. Led the security stance for the project, introducing and mentoring a number of junior programmers into their first OpenWRT work, using lua, python, shell, Android Java and C. Wrote IETF Internet Drafts to document the parts that the project felt should be industry best practices, leading to the RIPE IoT WG starting a Best-Current Operating Practice (BCoP), which is underway. Throughout this project, have been the OpenWRT (and Turris OS) wrangler, producing the "MEDKIT" to flash new devices. Designed a customized version of IETF BRSKI protocol ("smartkaklink") to accomodote onboarding of the home router without Internet.

IETF Roll implemenator

2009 to 2020

Wrote an open source implementation of the IETF ROLL RPL protocol for the Linux platform, called unstrung. Release 1.0 is yet to come, but have collaboration from one UK company.

Worked with RPL implementation in Contiki-OS.

IETF Roll co-chair

2012 to 2016

Was asked in 2011 to become the IETF ROLL working group co-chair. Was given a mandate to finish off the security aspects of the ROLL protocol, and many of the related security problems. Trained a new co-chair in late 2013. As part of this work, liased with the Zigbee IP specification writers, became involved with 802.15.4e mode of 802.15.4, leading the security design team of the IETF 6tisch working group, and co-lead for the IETF ANIMA secure bootstrap design team.

President

1996 to present

Formed Sandelman Software Works as a contract programming and internet security consulting firm. Projects include: device driver development, embedded Linux (PowerPC405, x86, ARM), VPN/IPsec internals /kernel architecture (FreeS/WAN project), BGP setup (both IPv4 and IPv6) and configuration, gForge/Savannah deployment, corporate security policy creation, network design and architecture, firewall evaluation, securing web servers, secure database replication, Virtual Private Network design, project management, Unix systems management, and cryptographic programming (IPsec).

Thomas Watson project

December 2009 to Summer 2010

worked on a new Android phone. Bring up of phone (embedded Linux), debugging, project management. The CREDIL team worked on an H.264 video calling application requiring real time embedded Linux programming, and working with hardware encoders.

Operations Developer: Solid Name Service (SNS)

January 2014 to October 2014

Took over development and maintenance of anycast based DNS service called SNS. Care and feeding of FreeBSD and Linux based infrastructure, with sh, perl, awk, javascript, Catalyst, PostgresQL and MongoDB components. Took system from all-in-one physical server to easily replicatable and testable VMware vSphere based virtual machines in a more typical front/middle/backend stack.

Updated the DNSSEC Lookaside Validator (dlv.isc.org), from a ruby 1.8/rails 2/postgresql 8 system, running on FreeBSD 7 hardware, to a ruby 1.9/rails 3/bundler/capistrano/postgresql 9 platform, based upon Linux and FreeBSD 10 virtual platforms.

Participated in some day-to-day activities around f-root server operation and planning.

Director, Consumer Desktop Development

April 2007 to August 2009

Consumer Desktop Unit (CDU), In charge of overall technical direction for the business unit. Manage people, projects, schedules, and write code. The CDU unit provides virtualized desktops to end-customers using XEN and VMware machine virtualization. Backend management was done by IPv6. Custom software provides provisioning, monitoring, and sign up. Software is written in C, Ruby (on Rails), PHP5/Drupal5, Perl, Java and Visual Basic, using XEN, VMware-server and ESXi APIs.

VP Research and Development

August 2003 to 2007

Formed Xelerance Corporation. Xelerance Corporation is the Open Source security specialists. Xelerance was the home of Openswan: IPsec for Linux (and continuation of Linux FreeS/WAN). Xelerance also dealt with DNSSEC, producing a product, dnsX. Xelerance practiced Test Driven Development, and geographically dispersed agile methods. As a hands-on VP of R&D, I was in charge of all software development, costing and scheduling for projects. Worked with a number of partners to bring hardware accelerated cryptographic operations to IPsec.

Technical manager, System Software

October 1994 to October 1996

Responsible for multiplatform development environment, project schedule, functional specification and assignment of work. Majority of Unix kernel work. C/CVS/Perl under Unix (BSDI/386 and SunOS). Maintenance of ongoing product. Porting to SVR4. Liason to IETF, advanced product research: IPsec, Kerberos, customization. Some VxWorks and ObjecTime. Milkyway Networks (now defunct) made the world's first transparent application layer firewall, originally called the BlackHole.

April to October 1994

Work group administrator in FiberWorld Products division. Internal telephone support for computing environment including day-to-day system management, and problem resolution. 1000+ user population on heterogeneous Unix networks (NCD,Sun,HP,Apollo,Mac).

(BNR + Northern Telecom merged to become Nortel and then Nortel Networks)