SCION (Scalability, Control, and Isolation On Next-Generation Networks) is a

Future Internet Future Internet is a general term for research activities on new architectures for the Internet. History While the technical development of the Internet was an extensive research topic from the beginning, an increased public awareness of severa ...

architecture that aims to offer high availability and efficient point-to-point packet delivery with network path selection, even in the presence of actively malicious network operators and devices. It has been developed by researchers at

ETH Zurich ETH Zurich (; ) is a public university in Zurich, Switzerland. Founded in 1854 with the stated mission to educate engineers and scientists, the university focuses primarily on science, technology, engineering, and mathematics. ETH Zurich ran ...

since 2009, is deployed in production networks, and is currently being explored by the

IETF The Internet Engineering Task Force (IETF) is a standards organization for the Internet standard, Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster ...

Path Aware Networking Research Group.

Goals

* ''Availability in the presence of distributed adversaries:'' As long as an attacker-free path between endpoints exists, it should be discovered and utilized with guaranteed bandwidth. * ''Transparency and Control:'' Separation of control and data planes by encoding paths as ''packet-carried forwarding state (PCFS)'' in the packet header, as well as enabling of multipath communication for enhanced availability and defense against network attacks. * ''Efficiency, Scalability, and Extensibility:'' Packet forwarding is at least as efficient in latency and throughput as current IP in common cases and more scalable with respect to

BGP Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous system (Internet), autonomous systems (AS) on the Internet. BGP is classified as a path-vect ...

and the size of routing tables. Achieved by storing state in packet headers and protecting them cryptographically, using modern block ciphers such as AES that can be computed very efficiently (within 10ns on a modern CPU ). * ''Support for Global but Heterogeneous Trust:'' Scale the authentication of entities to a global environment and utilizing trust agility so each end host or user can know the complete set of trust roots for the validation of a certificate. *''Deployability'': Deployment should only require installation or upgrade of a few border routers, thus requiring minimal added complexity to the existing infrastructure. In addition, it should not disrupt current Internet topology and business models/relationships (e.g., should still support peering).

Isolation domains and autonomous systems

SCION introduces the concept of an ''isolation domain (ISD)'' which is a logical grouping of ''autonomous systems'' ''(ASes)'', administered by a smaller subset of the ASes that constitute the ISD core. The ISD is governed by a policy, called the ''trust root configuration (TRC)'', which is negotiated by the ISD core and defines the roots of trust that are used to validate bindings between names and public keys or addresses. ASes within an ISD can be connected by core links, customer-provider links, or peering links, representative of the relationship between the ASes. Within an AS there are several services such as: * ''Beacon Servers'' - responsible for ''beaconing'' which is a process to generate, receive, and propagate messages called ''path-segment construction beacons (PCBs)'' to construct path segments and explore routing paths. * ''Path Servers'' - storage for mappings of AS to path that were discovered during beaconing. * ''Name Servers'' - perform name translation similar to DNS by using RAINS to retrieve (ISD, AS) tuple that can be used to find and construct end-to-end paths. * ''Certificate Servers'' - cache for copies of TRCs retrieved from the ISD core, AS certificates, and key management for securing inter-AS communication. * ''Border Routers'' - used for SCION packet forwarding to the next SCION border router or to the destination host within the destination AS.

Control plane

The control plane is responsible for discovering networking paths and making those paths available to end hosts. Inter-domain beaconing connects ISDs by enabling core ASes to learn paths to other core ASes while intra-domain beaconing allows non-core ASes to learn path segments to core ASes. The SCION control plane operates at the AS level, while communication within an AS is governed by existing intra-domain communication technologies and protocols (e.g. OSPF, SDN,

MPLS Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on labels rather than network addresses. Whereas network addresses identify endpoints, the labels identi ...

). To reach a remote destination, a host performs a path lookup at its local path server to obtain up-segments (from source AS to the core), down segments (from core AS to destination AS), and core segments (between core ASes) in the case these up and down segments end at different core ASes. Paths can be combined as desired, possibly using peering links where available.

Data plane

A SCION packet minimally contains a path and the data plane ensures packet forwarding using the provided paths. Forwarding utilizes a split of locator (AS-level path) and identifier (the destination address), like in the Locator/Identifier Separation Protocol (LISP). As a result, SCION border routers forward packets based on the AS-level path in the packet header without inspecting the destination address and also without consulting an inter-domain routing table. The destination address can have any format that the destination AS can interpret because only the border router at the destination AS needs to inspect the destination address to forward it to the appropriate local host. The destination can respond to the source by inverting the end-to-end path from the packet header, or it can perform its own path lookup and path-segment construction.

Security

Similar to BGPsec, each AS signs the PCBs it forwards. This signature enables PCB validation by all entities. To ensure path correctness, the forwarding information within each packet is also cryptographically protected. Each AS uses a secret symmetric key that is shared among beacon servers and border routers and is used to efficiently compute a

message authentication code In cryptography, a message authentication code (MAC), sometimes known as an authentication tag, is a short piece of information used for authentication, authenticating and Data integrity, integrity-checking a message. In other words, it is used t ...

(MAC) over the forwarding information. The per-AS information includes the ingress and egress interfaces, an expiration time, and the MAC computed over these fields, which is (by default) all encoded within an 8-byte field referred to as a ''hop field (HF)''.

Specifications

Internet Drafts submitted to the

Internet Engineering Task Force The Internet Engineering Task Force (IETF) is a standards organization for the Internet standard, Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster ...

Independent Submission process include:
SCION Control Plane PKI

SCION Control Plane

SCION Data Plane

Deployment and commercial operations

SCION is running on a number of nodes around the world. It is utilized for th

th
SCION Education, Research and Academic Network
the SwissIX, and is being deployed on th
Swiss Health Info Net (HIN)
In 2017, Adrian Perrig together with fellow professors David Basin and Peter Müller at the Department of Computer Science at ETH Zurich, founded the spin-of
Anapaya Systems
to develop a commercial implementation of SCION. In 2022, th
SCION Association
was founded by the

Swiss National Bank The Swiss National Bank (SNB; ; ; ; ) is the central bank of Switzerland, responsible for the nation's monetary policy and the sole issuer of Swiss franc banknotes. The primary goal of its mandate is to ensure price stability, while taking econ ...

, SIX,

and

Uli Sigg Uli Sigg (born 1946) is a Swiss businessman, diplomat and art collector. He served as the Swiss Ambassador to China, North Korea and Mongolia from 1995 to 1998. He serves as the vice chairman of Ringier, the largest media company in Switzerland. H ...

to promote SCION and develo
SCION Proto
the open source implementation of SCION. The SCION Association is a non-profit organization whose members include Anapaya Systems,

Swisscom Swisscom is a major telecommunications provider in Switzerland. Its headquarters are located in Worblaufen near Bern. The Swiss government owns 51% of Swisscom. According to its own published data, Swisscom holds a market share of 56% for mob ...

SWITCH In electrical engineering, a switch is an electrical component that can disconnect or connect the conducting path in an electrical circuit, interrupting the electric current or diverting it from one conductor to another. The most common type o ...

, Cyberlink,

Sunrise Sunrise (or sunup) is the moment when the upper rim of the Sun appears on the horizon in the morning, at the start of the Sun path. The term can also refer to the entire process of the solar disk crossing the horizon. Terminology Although the S ...

, AXPO, DIDAS, Eraneos, libC Technologies, OVGU Magdeburg, and the Swiss Finance + Technology Association. 2023 SCION was rolled out on Sui blockchain testnet to secure the validator network and reduce latenc
SCION Day 2024: SUI

References

External links

SCION Official Website

SCION Project Website

IETF Path-Aware Networking Research Group
Network layer protocols Routing protocols Internet layer protocols