Title Text
Adrian Perrig

Experiencing a Next-Generation Internet Architecture
Adrian Perrig, Network Security Group, ETH Zurich

Incredible Story▪ BGP was designed in 1989 by Kirk Lougheed and Yakov Rekhter onthree paper napkins over lunch, and today the Internet relies on it!

2

Journey Towards a Next-Generation Internet▪ During our journey, we haveencountered many interesting
discoveries▪ Several discoveries suggest new
approaches for inter-domain networking
The real voyage of discovery consists not inseeking new landscapes, but in having neweyes. Marcel Proust

New Internet Architecture: Goals and Desires▪ Internet to support applications?
• Cloud computing• Mobility• Video streaming• IoT▪ Internet to provide properties?
• Security• Low latency• Privacy, anonymity• High performance• High availability, rapid failoverApproach: Massive Multipath▪ Provide inter-domain multipath routing system that
establishes a large number of distinct paths• Paths can be selected based on application
requirements: security, latency, privacy, performance, etc.
▪ Provide flexible routing fabric that enables creation anddissemination of additional paths▪ Observation: massive multipath satisfies most goals▪ Caution: scalability, security, and compatibility withbusiness models need to be built-in from the beginningStrawman Approach 1▪ Approach: Full Internet topology dissemination andsource routing▪ Problems• Scalability of global topology dissemination• Not compatible with ISP business models• Privacy of AS topologies• AS routing policies need to be honored

Strawman Approach 2▪ Approach: All traffic is sent to a hyperscaler cloud provider,which provides global connectivity▪ Problems• Current Internet cannot provide good connectivity even toubiquitous cloud provider• Misalignment of incentives: hyperscaler has no incentive toprovide high-quality connectivity to competitors• Lack of innovation and competition:Internet needs healthy ecosystem of large and small connectivity
providers to fuel innovation in a competitive environment

Inspirations for a New Beginning▪ Many exciting next-generation Internet projects over the past 25 years▪ General Future Internet Architectures (FIA)• XIA: enhance flexibility to accommodate future needs• MobilityFirst: empower rapid mobility• Nebula (ICING, SERVAL): support cloud computing• NIMROD: improved scale and flexibility• NewArch (FARA, NIRA, XCP)• RINA: clean API abstractions simplify architecture▪ Content-centric FIAs: NDN, CCNx, PSIRP, SAIL / NETINF▪ Routing security: BGPSEC, S-BGP, soBGP, psBGP, SPV, PGBGP, H-NPBR▪ Path control: MIRO, Deflection, Path splicing, Pathlet, I3▪ Inter-domain routing proposals: ChoiceNet, HLP, HAIR, RBF, AIP, POMO, ANA, ...
▪ Intra-domain / datacenter protocols: SDN, HALO, ...
8

Suggested New Architecture▪ Control plane• Scalable creation of path segments• Scalable on-demand dissemination of pathsegments• Flexible architecture enables creation of additional
paths with unforeseen properties▪ Data plane• Policy-compliant path segment combination• Packet-carried path information, cryptographicallyprotected to ensure policy compliance• Per-flow stateless in router fast path to avoid
signaling overhead

Architecture Design Details▪ Scalability: two-level hierarchical routing, creating 2
kinds of path segments: global (think “highways”) andlocal (think “local roads”)▪ Massively multipath: path segments can be combined inpolicy-compliant ways to offer very large number of pathchoices▪ Data plane makes use of packet-carried forwarding
state, without needing any inter-domain forwarding
tablesTwo-level hierarchy through Isolation Domain (ISD)▪ Isolation Domain (ISD): grouping of Autonomous Systems (AS)
▪ ISD core: ASes that manage the ISD and provide global connectivity▪ Core AS: AS that is part of ISD core
▪ Two-level hierarchical routing: inter-ISD and intra-ISD

11

SCION Routing and Forwarding Overview
Path-based Network Architecture
Control Plane - Routing
Constructs and Disseminates
Path Segments

Combine Path Segments to Path
Packets contain Path
Routers forward packets based on
Path
Simple routers, stateless operation

JF→C→AA

A→I→J→M

BKM

M→P→S
PayloadData Plane - Packet forwarding

IPacket P1

LCENDPOFHS

QGR

Packet P2
F→D→B
B→K→L
L→O→S
PayloadScalability of SCION Intra-ISD Beaconing
SCION Intra-ISD

Relative cost (Normalized to BGP)

0.020

0.015

0.010

0.005

0.000

Average
AS Instance (sorted by SCION cost)13

Scalability of SCION Core Beaconing
SCION CoreSCION Core, BGPSec and BGP

0.15SCION Core

BGPSecBGP

Relative cost (Normalized to BGP)

Relative cost (Normalized to BGP)

100.100.05

0.00

Average
AS Instance (sorted by SCION cost)

86420Average
AS Instance (sorted by SCION cost)14

Scalability Study Results▪ On a per-path basis, SCION spends about 200
times less effort than BGP, and about 1000
times less effort than BGPsec▪ Time-to-connectivity in SCION is over 3 ordersof magnitude faster than BGP• The iterative convergence approach in BGP takes
minutes to converge with fully updated forwarding
tables (in case of small changes), but hours for larger
outagesImportance of Path Awareness & Multipath▪ Generally, two paths exist between Europe and Southeast Asia
• High latency, high bandwidth: Western route through US, ~450ms RTT• Low latency, low bandwidth: Eastern route through Suez canal, ~250ms RTT▪ BGP is a “money routing protocol”, traffic follows cheapest path, typicallyhighest bandwidth path
▪ Depending on application, either path is preferred▪ With SCION, both paths can be offered!

16

SCION is Massively Multipath▪ SCION not only finds many disjoint
path segments, but enables amassive number of multipath
choices through segment
combinations▪ In this example, S has 5 pathsegments to core ASes, D has 6
path segments, and 7 core pathsegments are provided▪ These path segments enable 54
different end-to-end paths!

SDFlexibility to Support Different Optimization Criteria▪ Thanks to massive number of path choices,
SCION will likely offer best path for different
optimality requirements• Low latency, jitter• High bandwidth• Privacy, anonymity• Low CO2 footprint▪ Application can make use of multiple paths
simultaneously▪ System can dynamically optimize paths for
optimal performance▪ New world, offering exciting opportunities!

SCION Multipath Demo by Tony John (OvGU)▪ https://www.youtube.com/watch?v=q8ugQtj0THk

SCION Multipath Teleconferencing▪ Jonas Gessner is implementing teleconferencing app on
iOS leveraging SCION multipath

SCION Extensions
DRKey

EPIC

COLIBRI
Mondrian
Hidden paths
RAINS

Time Sync

HORNETTARANETSBAS
F-PKI GMA

LightningFilter

Online Resources▪ https://www.scion-architecture.net▪ Book, papers, videos, tutorials▪ https://www.scionlab.org▪ SCIONLab testbed infrastructure▪ https://www.anapaya.net▪ SCION commercialization▪ https://github.com/scionproto/scion▪ Source code22

Governance• Non-technical management• Drive foundation in the startphase• Networking with stakeholders• Fundraising• User community management

Standardisation& Documentation

Open-Source
Development

Community
Building• Collaboration with Internet
standards organisations• Development of the SCION
reference open source
implementation• Manage stakeholders(users, developers,
hardware vendors, ISPs,IXPs)• Software & Hardware
SCION certification• Accelerate adoption• Green routing certificates• Presence at conferences
and industry events• Engineer certification• Standardisation committee• Engagement with devcommunity• Education and training

Certification• Deployment & ISP testingHow to Deploy SCION: ISP▪ CORE Routers are set up at
the borders of an ISP• to peer with other SCIONenabled networks• to collect customer
accesses▪ No change to the internal
network infrastructure of an
ISP needed!
24How to Deploy SCION: End Domain▪ SCION IP Gateway (SIG)
enables seamless integrationof SCION capabilities in enddomain networks▪ No upgrades of end hosts orapplications neededCustomer location
SCION ROUTERSIGSCION ROUTER

No significant changes toVPN / Firewall / SDWAN designsConnection(s) to SCION-Router(s)SCION-native, Ethernet, MPLS, DIA,Broadband, 4G…

25

SCIONLab: Global Research Testbed• Global SCION research testbed: https://www.scionlab.org• Led by David Hausheer’s team at University of Magdeburg• Open to everyone: create and connect your own AS within minutes• ISPs: Swisscom, SWITCH, KDDI, GEANT, DFN• Deployed 35+ permanent ASes worldwide, 600+ user ASes
• Contact us to become an infrastructure AS, we can provide HW• Kwon et al., “SCIONLab: A Next-Generation Internet Testbed”, ICNP 2020

26

Exciting SCIONLab Research Opportunities▪ Next-generation Internet architecture research▪ Users obtain real ASes with all cryptographic credentials to participate in the control plane▪ ASes can use their own computing resources and attach at several points in the SCIONLab network▪ Path-aware networking testbed▪ Hidden paths for secure IoT operation▪ Control-plane PKI in place, each AS has certificate▪ Network availability and performance measurement (bandwidth and latency)▪ Supported features (PKI, DDoS defense mechanisms, path selection support, end host / application support)▪ Inter-domain routing scalability research▪ Multipath research▪ Multipath QUIC socket▪ End-to-end PKI system that application developers can rely on to build highly secure TLS applications▪ Colibri inter-domain resource allocation system▪ DDoS defense research using in-network defense mechanisms▪ Next-generation routing architecture policy definitions

27

SCION Production Network▪ Led by Anapaya Systems▪ BGP-free global communication

BGP• Fault independent from BGP protocol▪ Deployment with international ISPs
• Goal: First global public secure communication network▪ Construction of SCION network backbone at select locations to bootstrap
adoption▪ Current deployment• ISPs: Swisscom, Sunrise, SWITCH, Axpo, Init7, Proximus, LG, …
• IXPs: SwissIX offers SCION peering, + others joining soon
• Bank deployment: Largest Swiss banks use SCION in production
28

Global Availability of Native SCION Connectivity▪ Native SCION (BGP-free) connectivity:
no reliance / dependency on BGPcommunication▪ SCION deploying ISP’s networks arereaching global data centers and IXPs,offering native SCION connectivity▪ Anapaya Connect: native SCION
connectivity to 100+ data centers in10+ countries

Endhost Deployment Opportunity▪ Server can announce SCION capability through DNS txtrecord▪ SCION parameters can be auto configured on endhost• SCION client bootstrapping package by François Wirz
▪ Extend Happy Eyeballs (RFC 8305) with SCION as third
option besides IPv4 and IPv6
• Asynchroneous DNS queries and connection attempts▪ Incentive for server and client: SCION offers lower latency
connection and possibly higher bandwidth through multipath

SCION and the SecureSwiss Financial Network(SSFN)“The financial sector has faced many challenges interms of distribution, flexibility and security whenusing the Internet for daily business activities. It isvulnerable to cyberattacks, including distributed
DDoS or traffic-hijacking attacks.”“This alternative would provide better control
over the exchange of sensitive financial
information among market participants while
reducing implementation complexity and effort.”
Development

Go-live

July 2020

2H 2021

Testing
December 2020

Source: https://www.six-group.com/dam/download/cyber-security/six-cyber-security-report-2020-en.pdf

SSFN - TEST RESULTS“Extensive testing under extreme conditions has proven the reliability and resilience of the infrastructure— made possible by thepath control and inherent multipathing properties of a SCION-based network architecture. This level of reliability and resilience isa vast improvement to ensure business continuity for current and future system-relevant use cases and applications not only inthe financial sector but also for other critical infrastructures.”Fritz Steinmann Director, Senior Network Security Architect• 1st PoC in 2018 connecting Bern to the Berlin
embassy with Deutsche Telekom and Swisscom

SCION and EDA• 2nd PoC connecting Bern to Seoul, Korea (viaHK) along with Departement für Verteidigung,
Bevölkerungsschutz und Sport (VBS). In
partnership with LG U+ / IoT Cube
• Test started for DDPS and FDFA in March 2021

Start of set-up

DDPS Implementation

March 2021

Target: June 2021

FDFA Implementation
Target: May 2021

• SCION for the ETH Domain (SCI-ED) is a
research network connecting the institutes ofthe ETH Domain, e.g.:

SCION and ETH••••ETH Zürich
EPF Lausanne
The Paul-Scherrer Institute
The National Centre for Super-Computing(CSCS)• The first real-world setting that provided a richenvironment for use-case evaluation and securedata transfers• The SCI-ED project was instrumental in theadvancement of the SCION infrastructure andpaved the way for SSFN

Insight: Incremental Deployment Possible▪ Incremental deployment of a new Internet architecture ispossible, operating side-by-side with BGP▪ For ISPs, new architecture can be deployed with minimal effort▪ For end domains, SCION-IP Gateway (SIG) offers immediate
benefits without updating any end hosts▪ Important: no reliance on BGP for inter-domain operation(“BGP-free”)▪ Overlay / insecure underlay should be avoided not to inherit
vulnerabilities▪ Re-use of intra-domain network architecture for local
communication
35

Insight: Secure Routing Insufficient▪ Secure routing protocol cannot prevent
outages caused by bottleneck link orcontinuing announcement of failed orcongested routes, as announcement is often
legitimate

36

Insight: Multipath is a Necessityfor High Availability and Performance▪ Inter-domain multipath is not a luxury, but a necessity to achieve highavailability▪ Rapid failover without routing system convergence▪ Routing bottlenecks can be circumvented▪ Enable higher network capacity• No more passive links for redundancy, all links can be active• Simultaneous use of several links▪ Enables higher communication efficiency• Latency- vs. bandwidth optimal paths can be chosen▪ Helps defend against DoS attacks, as adversary needs to congest all links▪ QoS needs multipath, as several alternatives need to be available toattempt resource reservations

37

Insight: Cryptographic Processing at Line RatePossible▪ Symmetric-key cryptographic operations arepossible within nanoseconds, thus enabling linerate processing▪ With hardware implementation, computing anAES block cipher can be accomplished within afew nanoseconds▪ DRKey + EPIC systems enable per-packet source
authentication in software ~ 100 ns▪ This enables new approaches for network security
38

Insight: Formal Security Verification Necessary▪ To achieve strong assurance for a large-scale
distributed system, formal security verification isnecessary▪ Performing formal verification from the beginning
avoids “difficult-to-verify” components▪ Many design aspects of SCION facilitate formalverification▪ Collaboration with David Basin’s and Peter
Müller’s teams in the VerifiedSCION project39

SCION Summary▪ SCION: Next-generation Internet you can use today!
▪ High-performance• Path-aware network enables application-specific optimizations toprovide enhanced efficiency• Multipath communication enables simultaneous use of multiple paths,
increasing available bandwidth▪ Secure, high assurance, high availability• Per-packet authentication verification possible on routers• Formal verification of protocols and code
• Immune against routing attacks, e.g., BGP prefix hijacking
40Expeditions Enable New Insights & Discoveries▪ What started with the question “How secure can a global Internet be” hasrewarded us with an exciting journey with many discoveries▪ We hope to question engrained assumptions to counter Internet ossification▪ Join the journey• https://www.scionlab.org• https://www.scion-architecture.net

SCION Team42