| Internet-Draft | SCION I-D | September 2023 |
| de Kater, et al. | Expires 10 March 2024 | [Page] |
The Internet has been successful beyond even the most optimistic expectations and is intertwined with many aspects of our society. But although the world-wide communication system guarantees global reachability, the Internet has not primarily been built with security and high availability in mind. The next-generation inter-network architecture SCION (Scalability, Control, and Isolation On Next-generation networks) aims to address these issues. SCION was explicitly designed from the outset to offer security and availability by default. The architecture provides route control, failure isolation, and trust information for end-to-end communication. It also enables multi-path routing between hosts.¶
This document discusses the motivations behind the SCION architecture and gives a high-level overview of its fundamental components, including its authentication model and the setup of the control- and data plane. A more detailed analysis of relationships and dependencies between components is available in [I-D.rustignoli-scion-components]. As SCION is already in production use today, the document concludes with an overview of SCION deployments.¶
This note is to be removed before publishing as an RFC.¶
The latest revision of this draft can be found at https://scionassociation.github.io/scion-overview_I-D/draft-dekater-panrg-scion-overview.html. Status information for this document may be found at https://datatracker.ietf.org/doc/draft-dekater-panrg-scion-overview/.¶
Discussion of this document takes place on the WG Working Group mailing list (mailto:panrg@irtf.org), which is archived at https://datatracker.ietf.org/rg/panrg. Subscribe at https://www.ietf.org/mailman/listinfo/panrg/.¶
Source for this draft and an issue tracker can be found at https://github.com/scionassociation/scion-overview_I-D.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 10 March 2024.¶
Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶
The Introduction section explores the motivation to develop SCION, followed by a short description of SCION's main elements. The sections after the Introduction provide further insight into SCION's key concepts and deployment scenarios. The document concludes with some concrete case studies where SCION has been successfully deployed in production.¶
Since its inception, the Internet has continued to expand, encompassing new uses over time. The continuous expansion has brought many issues to light, including a lack of control, limitations in scalability, performance and security, occurrences of severe outages, weak fault isolation, and energy consumption. With the core focus on functionality and operation, the current Internet offers little protection against attacks such as spoofing, IP-address hijacking, denial-of-service, and combinations of these. For more background information, see [SCHUCHARD2011], [LABOVITZ2000], [GRIFFIN1999], [SAHOO2009], and [RFC4264].¶
There have been numerous initiatives to address the above issues. Although these initiatives have brought many improvements, concerns regarding security and scalability still remain. For more details, see, e.g., [RFC4033], [RFC6480], [RFC8205], and [RFC8446], as well as [LYCHEV2013], [LI2014], [COOPER2013], [ROTHENBERGER2017], [MORILLO2021], and [KING2022].¶
As a consequence, today's Internet fails to fulfil many users' requirements. This especially pertains to the demands of enterprises globally exchanging sensitive information, such as financial institutions, healthcare providers, universities, multinationals, governments, critical and transportation infrastructure operators. These users require the Internet to be highly available at all times. They expect reliable operation of the global network also in case of failures. They need availability guarantees across multiple routing domains, even in the presence of attacks. They further want to rely on an Internet that can be multilaterally governed and is free from global kill-switches.¶
SCION has been developed in order to meet the above-mentioned requirements. SCION aims to reach the following goals:¶
The above section describes SCION's aspiration to improve inter-AS routing and to focus on providing end-to-end connectivity. However, SCION does not solve intra-AS routing issues, nor does it provide end-to-end payload encryption, and identity authentication. These topics, which are equally important for the Internet to perform well, lie outside the scope of SCION.¶
SCION has been designed to address the fundamental issues of today's Internet depicted in Why SCION - Motivation (Section 1.1). The following section gives a high-level overview of SCION's main elements, providing a basic understanding of this next-generation inter-network architecture.¶
SCION's main goal is to offer highly available and efficient inter-domain packet delivery—even in the presence of actively malicious entities. To achieve scalability and sovereignty, SCION organizes existing ASes into groups of independent routing planes, called Isolation Domains (ISD). An AS can be a member of multiple ISDs. All ASes in an ISD agree on a set of trust roots, called the Trust Root Configuration (TRC). The ISD is governed by a set of core ASes, which provide connectivity to other ISDs and manage the trust roots. Typically, a few distinguished ASes within an ISD form the ISD’s core.¶
Isolation domains serve the following purposes:¶
ISDs provide natural isolation of routing failures and misconfigurations, provide meaningful and enforceable trust, enable endpoints to optionally restrict traffic forwarding to trusted parts of the Internet infrastructure only, and enable scalable routing updates with high path-freshness.¶
There are three types of links in SCION: core links, parent-child links, and peering links.¶
See Figure 1 for a high-level overview of the SCION network structure.¶
...............................
: :
: [TRC] :
: (::::::::::::::) : ......................
: (::::: ISD core :::::) : : :
: (:: +---+ ::::::::: +---+ ::) : : [TRC] :
: (::::: |CAS|===+---+ : |CAS| :::::) : : (: ISD core :) :
: (:: +---+ : |CAS|===+---+====)===:==:=====(=+---+ :: +---+ :) :
: /(:::::: +---+ ::::::) \ : : (: |CAS| == |CAS| :) :
: / (::::::: | :::::::) \ : : ( +---+ :: +---+ ) :
: / | o : : /(::::::::::::) :
: o | +---+ : : / \ :
: +---+ | /|ASb| : : / \ :
: |ASa| | / +---+ : : o o :
: +---+ | / | : : +---+ +---+ :
: | | / | : : |ASx| ---------|ASy| :
: | | / o : : +---+ +---+ :
: o o / +---+ : : | :
: +---+ +---+ / |ASe| : : o :
: |ASc|---------|ASd| o +---+ -:--:--+---+ :
: +---+ +---+ : : |ASz| ISD 2 :
: : : +---+ :
: ISD 1 : ........................
.................................
Legend:
|
|
Parent AS - child AS: o
Peering link: ----
Core link: ===
Core AS: CAS
SCION operates on two routing levels: intra-ISD and inter-ISD. Both levels use path-segment construction beacons (PCBs) to explore network paths. A PCB is initiated by a core AS and then disseminated either within an ISD (to explore intra-ISD paths) or among core ASes (to explore core paths across different ISDs). The PCBs accumulate cryptographically protected path and forwarding information on AS-level, and store this information in the form of hop fields (HFs). Endpoints use information from these hop fields to create end-to-end forwarding paths for data packets, who carry this information in their packet headers. This concept is called packet-carried forwarding state (PCFS). The concept also supports multi-path communication among endpoints.¶
The process of creating an end-to-end forwarding path consists of the following steps:¶
Figure 2 below shows the SCION routing process in a nutshell.¶
+------------------+ +------------------+
| Path Exploration | | |
| (Beaconing) |------------>|Path Registration |
| | | |
+------------------+ +--------+---------+
|
+-----------------+
|
+------------------v-----------------------+
| Path Resolution |
|+--------------+ +-------------------+|
|| Path Lookup |---->| Path Combination ||
|+--------------+ +-------------------+|
+------------------------------------------+
SCION decouples endpoint addressing from inter-domain routing. Routing is based on the <ISD, AS> tuple, agnostic of endpoint addressing. Existing AS numbers are inherited from the current Internet, but a 48-bit namespace allows for additional SCION AS numbers beyond the 32-bit space in use today. The endpoint local address is not used for inter-domain routing or forwarding, does not need to be globally unique, and can thus be an IPv4, IPv6, or MAC address, for example. A SCION address is therefore composed of the <ISD, AS, local address> 3-tuple.¶
The control service is responsible for the path exploration and registration processes in the control plane. It is the main control-plane infrastructure component within each SCION AS. The control service of an AS has the following tasks:¶
Note: The control service of an AS must not be confused with a border router. The control service of a specific AS is part of the control plane and responsible for finding and registering suitable paths. It can be deployed anywhere inside the AS. A border router belongs to the data plane; its main task is to forward data packets. Border routers are deployed at the edge of an AS.¶
An additional feature of SCION is its formal verification. The SCION network system consists of a variety of components such as routers, servers, and edge devices. Such a complex system eludes the mental capacities of human beings for considering all possible states and interactions. That is why SCION includes a formal verification framework developed by the Department of Computer Science of the ETH Zurich [KLENZE2021]. This guarantees that packet forwarding as well as SCION's authentication mechanisms and implementations are correct and consistent.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
This section explains the SCION key concepts, including authentication, control- and data plane.¶
SCION's control plane relies on a public-key infrastructure called the control-plane PKI (CP-PKI), which is organized on ISD-level. Each ISD can independently build its own roots of trust, defined in a file called trust root configuration (TRC).¶
Note: This section describes the SCION authentication concept on a very high level. A much more detailed description of SCION's authentication is available in [I-D.dekater-scion-pki].¶
Trust within each isolation domain is anchored in the trust root configuration (TRC) file. Each TRC contains a collection of signed root certificates, which are used to sign CA certificates, which are in turn used to sign AS certificates. The TRC also includes ISD-policies that specify, for example, the TRC's usage, validity, and future updates. A TRC is a fundamental component of an CP-PKI.¶
The initial TRC in an ISD is called the base TRC. This base TRC constitutes the ISD's trust anchor. It is signed during a signing ceremony and then distributed throughout the ISD. All entities within the ISD obtain the initial TRC with an offline mechanism such as a USB flash drive provided by a trusted AS, like the relevant ISP, or with an online mechanism that relies on a trust-on-first-use (TOFU) approach. However, all updates to the base TRCs are performed in a straightforward process that does not require any manual or out-of-band action (such as a software update), see TRC Update and Verification (Section 2.1.2).¶
Figure 3 shows the TRC trust chain and associated certificates. TRC 1 is the base TRC, and TRC 2 and 3 constitute updates to this base TRC. TRC 2 must be verified using the voting certificates in TRC 1. Control-plane (CP) root certificates are used to verify other CP certificates (which are in turn used to verify path-segment construction beacons PCBs).¶
Each SCION AS must hold a private key (to sign PCBs) and a certificate attesting that it is the rightful owner of the corresponding public key. One of the main roles of the TRC is thus enabling the verification of AS certificates and PCBs.¶
TRC 2
+--------------------------------------+
|+------------------------------------+|
||- Version - Core ASes ||
+--------+ ||- ID - Description || +--------+
| TRC 1 | ||- Validity - No Trust Reset || | TRC 3 |
| (Base |---->||- Grace Period - Voting Quorum ||--->| |
| TRC) | ||- ... || | |
+--------+ |+------------------------------------+| +--------+
|+----------------+ +----------------+|
|| Regular Voting | |Sensitive Voting||
|| Certificate | | Certificate ||
|+----------------+ +----------------+|
|+----------------+ +----------------+|
|| Votes | | Signatures ||
|+----------------+ +----------------+|
|+------------------------------------+|
|| CP Root Certificates ||
|+----------+-------------+-----------+|
| | | |
+-----------+-------------+------------+
| |
| |
v v
+-----------+ +-----------+
| CP CA | | CP CA |
|Certificate| |Certificate|
+-+-------+-+ +-----+-----+
| | |
| | |
v v v
+-----------+ +-----------+ +-----------+
| CP AS | | CP AS | | CP AS |
|Certificate| |Certificate| |Certificate|
+-----------+ +-----------+ +-----------+
With a base TRC as trust anchor, TRCs can be updated in a verifiable manner. There are two kinds of TRC updates: regular and sensitive updates. A regular TRC update happens when the TRC's validity period expires. This period is defined by the validity parameter in the TRC. The default is one year. A TRC update is sensitive if and only if critical sections of the TRC are affected (for example, if the set of core ASes is modified). For both regular and sensitive TRC updates, a number of votes (in the form of signatures) must be cast to approve the update. This number of votes is dictated by the voting quorum and set in each TRC with the voting quorum parameter.¶
Information about a TRC update is disseminated via the SCION’s beaconing process, through the path-segment constructions beacons. Each PCB contains the version number of the currently active TRC. If an AS receives a PCB with a TRC version number higher than the locally stored TRC, it requests the PCB-sending AS for the new TRC. The new TRC is verified on the basis of the current one, and is accepted if it contains at least the required quorum of correct signatures by trust roots defined in the current TRC. This simple dissemination mechanism has two advantages: It is very efficient (as fresh PCBs rapidly reach all ASes), and it avoids circular dependencies with regard to the verification of PCBs and the beaconing process itself (as no server needs to be contacted over unknown paths in order to fetch the updated TRC).¶
At most two TRCs per ISD can be active at the same time. The TRC parameter grace period indicates for how long the currently active TRC can still be active after a new TRC is disseminated. This so-called grace period starts at the beginning of the validity period of the new TRC. An older TRC can only be active until either (1) the grace period has passed, or (2) yet a newer TRC is announced. AS certificates are validated by following the chain of trust up to an active TRC.¶
The TRC dissemination mechanism also enables rapid revocation of trust roots. When a trust root is compromised, the other trust roots can remove it from the TRC and disseminate a new TRC alongside a PCB with a new version number.¶
In case of a catastrophic event—such as several private root keys being disclosed due to a critical vulnerability in a cryptographic library—SCION is equipped with a recovery procedure called trust reset. This procedure consists of creating a new TRC with fresh, trustworthy keys (and potentially new algorithms), and redistributing this TRC out-of-band. A trust reset effectively establishes a new base TRC for the ISD. It is possible for ISDs to disable trust resets by setting the no trust reset Boolean parameter to "true" in their TRC, with the effect that the entire ISD would have to be abandoned in the event of such a catastrophic compromise (this abandonment would also have to be announced out-of-band).¶
The partition of the SCION network into ISDs guarantees that no single entity can take down the entire network. Even if several entities formed a coalition to carry out an attack, the effects of that attack would be limited to one or a few ISDs.¶
The SCION control plane is responsible for discovering path segments and making them available to endpoints.¶
Note: This section describes the SCION control plane on a very high level. A much more detailed description of SCION's control plane will follow in a separate internet draft.¶
In SCION, the path segment construction process is referred to as beaconing. The control service of each AS is responsible for the beaconing process. The control service generates, receives, and propagates the path-segment construction beacons (PCBs) on a regular basis, to iteratively construct path segments.¶
There are three types of path segments (note that all path segments can be used to send data traffic in both directions):¶
All path segments are invertible: A core-path segment can be used bidirectional, and an up-path segment can be converted into a down-path segment, or vice versa, depending on the direction of the end-to-end path.¶
Path segment construction is conducted hierarchically on two levels:¶
On its way down, a PCB accumulates cryptographically protected path- and forwarding information per traversed AS. At every AS, metadata as well as information about the AS's ingress and egress interfaces (i.e., link identifiers) is added to the PCB. The ingress and egress interface IDs identify connections to neighboring ASes. These IDs only need to be unique within each AS. Therefore, they can be chosen and encoded by each AS independently and without any need for coordination.¶
SCION also supports shortcuts and peering links. In a shortcut, a path only contains an up-path and a down-path segment, which can cross over at a non-core AS that is common to both paths. Peering links can be added to up- or down-path segments, resulting in an operation similar to today’s Internet.¶
To reduce beaconing overhead and prevent possible forwarding loops, PCBs do not traverse peering links. Instead, peering links are announced along with a regular path in a PCB. If the path segments of both ASes at the end of a peering link contain this peering link, then it is possible to use the peering link to shortcut the end-to-end path (i.e., without going through the core). SCION also supports peering links that cross ISD boundaries, according to SCION’s path transparency property.¶
Figure 4 shows how intra-ISD PCB propagation works, from the ISD's core AS down to child ASes. For the sake of illustration, the interfaces of each AS are numbered with integer values. In practice, each AS can choose any encoding for its interfaces; in fact, only the AS itself needs to understand its encoding. Here, AS F receives two different PCBs via two different links from core AS X. Moreover, AS F uses two different links to send two different PCBs to AS G, each containing the respective egress interfaces. AS G extends the two PCBs and forwards both of them over a single link to a child AS.¶
.-----.
; Core :
+-----+ : AS X ;
|PCB | \ 2 1 / +-----+
|Core | `+-+' |pcb |
|Out:2| | | |core |
+--+--+ +-+ | |out:1|
| | | +--+--+
v | | |
.-+---+. v
.---. / 2 3 \ .---.
( J )- - -; 1 4 :- - - - - -( H )
`---' : AS F ; `---'
+--\7 /
+----------+ +----------+ <-+ 6 5
|PCB | |pcb | `+--+'
|Core | |core | | |
|Out:2 | |out:1 | | |
|----------| |----------| | |
|AS F | |as f | | |
|In:2 Out:7| |in:3 out:7| | |
|Peer J:1 | |peer j:1 | | | +----------+ +----------+
|Peer H:4 | |peer h:4 | | | |PCB | |pcb |
| | | | | | |Core | |core |
+--+-------+ +--+-------+ | | |Out:2 | |out:1 |
| | | | |----------| |----------|
<+ <+ | | |AS F | |as f |
| | |In:2 Out:5| |in:3 out:5|
+----------+ +----------+| | |Peer J:1 | |peer j:1 |
|PCB | |pcb || | |Peer H:4 | |peer h:4 |
|Core | |core || | | | | |
|Out:2 | |out:1 || | +----+-----+ +----+-----+
|----------| |----------|| | | |
|AS F | |as f || | v v
|In:2 Out:6| |in:3 out:6|| |
|Peer J:1 | |peer j:1 || |
|Peer H:4 | |peer h:4 || |
| | | || |
+----+-----+ +----+-----+| |
| | .+--+-.
v v ,' 5 1 `.
; :
: AS G ;
\ /
+---` 4 3 ,'
<-+ `--+'
| +----------+ +----------+
| |PCB | |pcb |
| |Core | |core |
| |Out:2 | |out:1 |
+----------+ +----------+ | |----------| |----------|
|PCB | |pcb | | |AS F | |as f |
|Core | |core | | |In:2 Out:5| |in:3 out:5|
|Out:2 | |out:1 | | |Peer J:1 | |peer j:1 |
|----------| |----------| | |Peer H:4 | |peer h:4 |
|AS F | |as f | | |----------| |----------|
|In:2 Out:6| |in:3 out:6| | |AS G | |as g |
|Peer J:1 | |peer j:1 | | |In:1 Out:3| |in:1 out:3|
|Peer H:4 | |peer h:4 | | | | | |
|----------| |----------| | +----+-----+ +----+-----+
|AS G | |as g | | | |
|In:5 Out:3| |in:5 out:3| v v v
| | | |
+----+-----+ +----+-----+
| |
v v
Each PCB contains signatures of all on-path ASes. Every time a control service receives a PCB, it validates the PCB's authenticity. During this process, the control service can query the control service of the sending AS, for example, when it lacks an intermediate certificate.¶
Each AS can independently set policies dictating which PCBs are sent in which time intervals, and to which neighbors. In particular, PCBs do not need to be propagated immediately upon arrival. However, during bootstrapping and if the AS obtains a PCB containing a previously unknown path, the AS should forward the PCB immediately, to ensure quick connectivity establishment.¶
Path registration is the process where an AS transforms selected PCBs into path segments, and adds these segments to the relevant path databases, thus making them available to other ASes.¶
As mentioned previously, a non-core AS typically receives several PCBs representing several path segments to the core ASes of the ISD the AS belongs to. Out of these PCBs, the non-core AS selects those down-path segments through which it wants to be reached, based on AS-specific selection criteria (see also Path-Segment Selection (Section 2.2.2.1)). The next step is to register the selected down-segments with the control service of the relevant core ASes, according to a process called intra-ISD path-segment registration. As a result, a core AS's control service contains all intra-ISD path segments registered by the non-core ASes of its ISD. In addition, each core AS control service also stores preferred core-path segments to other core ASes, in the core-segment registration process.¶
Among the received PCBs, the control service of an AS must choose (1) a set of PCBs to propagate further, and (2) a set of path segments to register. The selection of these PCBs and path segments is based on a path quality metric. This metric aims at identifying consistent, diverse, efficient, and policy-compliant paths:¶
Based on past PCBs, the AS control service assigns scores to the current set of candidate path segments, and sends the best segments in the next beaconing interval.¶
Core beaconing operates similarly to intra-ISD beaconing, except that core PCBs only traverse core ASes. The same path selection metrics apply, where a core AS attempts to forward the set of most desirable paths to its neighbors.¶
A host (source) who wants to start communication with another host (destination), requires up to three path segments: An up-path segment to reach the ISD core, a core-path segment to reach the destination ISD, and a down-path segment to reach the destination AS. The source host queries the control service in its AS for such segments. The control service has up-path segments stored in its database and furthermore checks if it has appropriate core- and down-path segments in its cache; in this case it returns them immediately.¶
If not, the control service in the source AS queries core control services (using locally stored up-path segments) in the source ISD for core-path segments to the destination ISD. Then, it combines up-path segments with the newly retrieved core-path segments, and queries core control services in the remote ISD to fetch remote down-path segments. To improve overall efficiency, the local control service caches the returned path segments and uses parallelism when requesting path segments from core control services. Finally, the local control service returns all path segments to the source host.¶
This recursive lookup significantly simplifies the process for endpoints (which only have to send a single query, similar to stub DNS resolvers). The caching strategy ensures that path lookups are fast for frequently used destinations (similar to caching in recursive DNS resolvers).¶
Unlike in the current Internet, link failures are not automatically resolved by the network, but require active handling by endpoints. Since SCION forwarding paths are static, they break when one of the links fails. Link failures are handled by a two-pronged approach that typically masks link failures without any outage to the application and rapidly re-establishes fresh working paths:¶
While the control plane is responsible for providing end-to-end paths, the data plane ensures that packets are forwarded on the selected path. SCION border routers forward packets to the next AS based on the AS-level path in the packet header (which is extended with ingress and egress interface identifiers for each AS), without inspecting the destination address and also without consulting an inter-domain forwarding table. Only the border router at the destination AS needs to inspect the destination address to forward it to the appropriate local endpoint.¶
Because SCION splits the information about the locator (the path towards the destination AS) and the identifier (the destination address), the identifier can have any format that the destination AS can interpret--only the destination needs to consider that local identifier (see also [RFC6830]). In other words, an AS can select an arbitrary addressing format for its hosts, e.g., a 4-byte IPv4, 6-byte media access control (MAC) address, 16-byte IPv6, or any other up to 16-byte addressing scheme. A valuable consequence is that hosts with different address types can directly communicate.¶
The next two sections describe how an endpoint combines path segments into an end-to-end forwarding path, and how border routers forward packets efficiently.¶
Note: This section describes the SCION data plane on a very high level. A much more detailed description of SCION's data plane will follow in a separate internet draft.¶
Through the path lookup, the endpoint obtains path segments that must be combined into an end-to-end path. A valid SCION forwarding path can be created by combining up to three path segments, in the following ways:¶
Once a forwarding path is chosen, it is encoded in the SCION packet header. This makes inter-domain routing tables unnecessary for border routers: Both the ingress and the egress interface of each AS on the path are encoded as packet-carried forwarding state (PCFS) in the packet header. The destination can respond to the source by reversing the end-to-end path from the packet header, or it can perform its own path lookup and combination.¶
The SCION packet header contains of a sequence of hop fields (HFs), one HF for each AS that is traversed on the end-to-end path. Each hop field contains the encoded numbers of the ingress and egress links, and thus defines which interfaces may be used to enter and leave an AS. In addition to the hop fields, each path segment contains an info field (INF) with basic information about the segment. A host can create an end-to-end forwarding path by extracting info fields and hop fields from path segments, as depicted in Figure 5. The additional meta header (META) contains pointers to the currently active INF and HF.¶
up-path segment core-path segment down-path segment
+-------+ +-------+ +-------+
|+-----+| |+-----+| |+-----+|
|+ INF ||----------+ |+ INF ||---+ |+ INF ||-+
|+-----+| | |+-----+| | |+-----+| |
|+-----+| | |+-----+| | |+-----+| |
|| hf ||--------+ | || hf ||---+--+ || hf ||-+--+
|+-----+| | | |+-----+| | | |+-----+| | |
|+-----+| | | |+-----+| | | |+-----+| | |
|| hf ||-----+ | | || hf ||---+--+--+ || hf ||-+--+--+
|+-----+| | | | |+-----+| | | | |+-----+| | | |
|+-----+| | | | +-------+ | | | +-------+ | | |
|| hf ||--+ | | | | | | | | |
|+-----+| | | | | +--------+ | | | | | |
+-------+ | | | | |++-----+| | | | | | |
| | | | |++ Meta|| | | | | | |
| | | | |++-----+| | | | | | |
| | | | |+-----+ | | | | | | |
| | | +-->|+ INF | | | | | | | |
| | | |+-----+ | | | | | | |
| | | |+-----+ | | | | | | |
| | | |+ INF | |<-+ | | | | |
| | | |+-----+ | | | | | |
| | | |+-----+ | | | | | |
| | | |+ INF | |<----+--+----------------+ | |
| | | |+-----+ | | | | |
| | | |+-----+ | | | | |
| | +---->|| hf | | | | | |
| | |+-----+ | | | | |
| | |+-----+ | | | | |
| +------->|| hf | | | | | |
| |+-----+ | | | | |
| |+-----+ | | | | |
+---------->|| hf | | | | | |
|+-----+ | | | | |
|+-----+ | | | | |
|| hf | |<----+ | | |
|+-----+ | | | |
|+-----+ | | | |
|| hf | |<-------+ | |
|+-----+ | | |
|+-----+ | | |
|| hf | |<---------------------------+ |
|+-----+ | |
|+-----+ | |
|| hf | |<------------------------------+
|+-----+ |
+--------+
forwarding path
Routers can efficiently forward packets in the SCION architecture. In particular, the absence of inter-domain routing tables and of complex longest-IP-prefix matching performed by current routers enables the construction of more efficient routers.¶
During packet forwarding, a SCION border router at the ingress point of the AS verifies that:¶
If the packet has not yet reached the destination AS, the egress interface number in the HF of the non-destination AS refers to the egress SCION border router of this AS. In this case, the packet can be sent from the ingress SCION border router to the egress SCION border router via native intra-domain forwarding (e.g., IP or MPLS). In case the packet has arrived at the destination AS, the destination AS's border router inspects the destination address and sends the packet to the corresponding host.¶
SCION routers use IP to communicate within an AS, therefore they rely on existing intra-domain routing protocols, such as Multiprotocol Label Switching (MPLS) or others.¶
Adoption of a next-generation architecture is a challenging task, as it needs to be integrated with, and operate alongside existing infrastructure. SCION is designed to coexist with existing intra-domain routing infrastructure, and comprises coexistence and transition mechanisms that facilitate adoption, in accordance to principles defined in [RFC8170]. The following section discusses practical considerations for deploying SCION and briefly touches on some of the transition mechanisms, with focus on:¶
We then describe some of the early adopters deployment experiences. A more detailed adoption plan is to be outlined in dedicated documents.¶
A SCION AS needs to deploy the SCION infrastructure components (Section 1.2.3) and border routers. Within an AS, SCION is often deployed as an IP overlay on top of the existing network. This way SCION allows to reuse the existing intra-domain network and equipment (e.g., IP, MPLS). Customer-side SCION border routers directly connect to the provider-side border routers using last-mile connections. The SCION design assumes that AS’s internal entities are considered to be trustworthy, therefore the IP overlay or the first-hop routing does not compromise or degrade any security properties SCION delivers. When it comes to inter-domain communication, an overlay deployment on top of today’s Internet is not desirable, as SCION would inherit issues from its weak underlay. Thus, inter-AS SCION links are usually deployed in parallel to existing links, in order to preserve its security properties. That is, two SCION border routers from neighbour ASes are directly connected via a layer-2 cross-connection at a common point-of-presence.¶
All SCION AS components can be deployed on standard x86 commercial off-the-shelf servers or virtual machines. In fact, SCION border routers do not rely on forwarding tables, therefore they do not require specialized hardware. Practice shows that off-the-shelf hardware can handle up to 100 Gbps links, while a prototype P4 implementation [DERUITER2021] showed that it is possible to forward SCION traffic even at terabit speeds.¶
Overall, an AS can be connected to SCION without high-impact changes to its network. In addition, use of commodity hardware for both control and data-plane components reduces initial deployment costs.¶
Internet Exchange Points (IXP) play as important a role for SCION as they do in today's Internet. SCION can be deployed at existing IXPs following a "big switch" model, where the IXP provides a large L2 switch between multiple SCION ASes. SCION has been deployed following this model at the Swiss Internet Exchange (SwissIX), currently interconnecting major SCION Swiss ISPs and enterprises through bi-lateral peering over dedicated SCION ports.¶
Additionally, thanks to its path-awareness, SCION offers the option of an enhanced deployment model, i.e., to expose the internal topology of an IXP within the SCION control plane. This enables IXP customers to use SCION’s multipath and fast failover capabilities to leverage the IXP’s internal links (including backup links) and to select paths depending on the application’s needs. IXPs have therefore an incentive to expose their rich internal connectivity, as the benefits from SCION’s multipath capabilities would increase their value for customers and provide them with a competitive advantage.¶
End users can leverage SCION in two different ways: (1) using SCION-aware applications on a SCION native endpoint (Section 3.3.1), or (2) using transparent IP-to-SCION conversion (Section 3.3.2). The benefit of using SCION natively is that the full range of advantages becomes available to applications, at the cost of installing the SCION endpoint stack and making the application SCION-aware. In early deployments, the second approach is often preferred, so that no changes are needed within applications or endpoints.¶
A SCION native endpoint's stack consists of a dispatcher, which handles all incoming and outgoing SCION packets, and of a SCION daemon, which handles control-plane messages. The latter fetches paths to remote ASes and provides an API for applications and libraries to interact with the SCION control plane (i.e., for path lookup, SCION extensions). The current SCION implementation uses an UDP/IP underlay for communication between endpoints and SCION routers. This allows reuse of existing intra-domain networking infrastructure. SCION endpoints can optionally use automated bootstrapping mechanisms to retrieve configuration from the network and establish SCION connectivity. This way, clients require no pre-existing network-specific configurations.¶
A SCION-IP-Gateway (SIG) encapsulates regular IP packets into SCION packets with a corresponding SIG at the destination that performs the decapsulation. A SIG can be deployed close to the end user (i.e., at branches of an enterprise, on a CPE), or within an ISP's network. In the latter case, the SIG is called carrier-grade SIG, as it serves multiple customers within the AS where it is deployed. This approach has the advantage that it does not require any changes at the customer's premises. In order to allow incremental deployability and to ease transition from legacy IP-based Internet to SCION, SIGs can be augmented with mechanisms allowing them to coordinate and automatically exchange IP prefix information. A more detailed description of the SIG and its coordination mechanisms is to be presented in dedicated documents.¶
SCION has been deployed in production by multiple entities, growing its acceptance among industry. While early deployments started on academic and research networks, SCION has expanded to serve the financial industry, government, and it is being evaluated for the healthcare sector.¶
In 2017, SCION was evaluated for production use by a central bank, with the goal of modernising the network interconnecting banks and their branches. SCION was chosen, as it allows moving away from a dedicated private network to a reliable Internet-based solution. SCION connectivity was later extended to support system-critical applications, like the national real-time gross settlement (RTGS) system, connecting all country's banks to exchange real-time payment information. The network, called Secure Swiss Finance Network or SSFN, is implemented as a SCION ISD, where a federation of three ISPs forms the ISD core. Financial institutions are themselves SCION ASes and directly connect to one or more of the core ASes. Institutions deploy SCION–IP gateways (SIGs), transparently enabling their traditional IP-based applications to use the SCION network. The concept of the SCION ISD also provides a mechanism to implement strict governance and access control (through the issuance of AS certificates).¶
Besides the SSFN, SCION connectivity has also been adopted by government entities for their international communications. In addition, Swiss higher education institutions are connected thanks to the SCI-ED network.¶
In addition to productive deployments, SCION also comprises a global SCION research testbed called SCIONLab. It is composed of dozens of globally distributed infrastructure ASes, mostly run by academic institutions. The testbed is open to any user who can easily set up their own AS with the aid of a web-based UI, connect to the network, and run experiments. The setup has been the earliest global deployment of SCION and it has been supporting research and development of path-aware networking and SCION.¶
Currently, this document has no request for action to IANA. However, when full specification of SCION is available, requests for IANA actions are expected regarding the registration of optional packet header fields as well as the coordination of SCION ISD and AS number assignments.¶
SCION has been designed from the outset to offer security by default, and thus there are manifold security considerations. As a matter of fact, SCION's protocol design has been formally verified and the open source router implementation is undergoing formal verification (see also [KLENZE2021]). Describing all security considerations here, therefore, would go beyond the scope of this document. A separate document including all security implications and considerations will follow later.¶
Many thanks go to Cyrill Krähenbühl and Juan A. Garcia-Pardo for reviewing this document. We are also indebted to Laurent Chuat, Markus Legner, David Basin, David Hausheer, Samuel Hitz, and Peter Müller, for writing the book "The Complete Guide to SCION" (see [CHUAT22]), which provides the background information needed to write this informational draft.¶