Scion – A Novel Internet Architecture
labs.ripe.net
labs.ripe.net
Even without ASICs the read/decode/forward part is apparently not a big deal: you can easily saturate multi-gigabit connections with cheap cpus today. But only if you don't have to make complicated routing decisions (i.e.: select the most appropriate "next hop" for each packet).
SCION pushes these decisions to the senders. When a sender sends a packet, that packet already contains the route it _has_ to follow. ISP routes are then dumb forwarders whose only job entails:
1. Ensuring the packet is valid (including a cryptography check for the route information). While this may seem expensive, note that pretty much all general-purpose cpus today include specific hardware to deal with this.
2. Forwarding it according to what the packet says
Of course, this implies that there needs to be a "control layer" that allows end hosts to construct these routes for each packet. However, that control layer is similar to a DNS system, meaning that while not trivial it can use a hierarchical, heavily-cached approach and shouldn't be too challenging to scale.
That sounds eminently abusable.
Additionally, SCION comes with COLIBRI, a reservation-based QoS system that at least on brief reading seems to have much of the power of RSVP with MPLS to provide dedicated bandwidth for media applications. It will of course face the challenges of operating between domains without complete mutual trust, which is what has generally killed resource reservation on the internet (I mean, besides software engineers always thinking resource reservation is too hard).
MPLS is, in my opinion, and under-rated protocol, and it's cool to see the label switching concept being developed into the future.
IMHO, source routing concept is not abandoned as Segment Routing seems to be used in specialized / large networks:
Now that we can calculate routes trivially on consumer grade hardware, perhaps that's a forcing function?
Come to think of it, I see this as a conceptual extension and optimization on BGP Policy Based routing. Seems like it's removing the overhead and formally separating the control protocols from the data protocols.
> A careful reader may have gotten the impression that SCION is simply source routing in disguise, however, this is not the case for a variety of reasons. First of all, end hosts do not learn any information about topology inside the Autonomous System (AS) - this is still under the control of the local network administrators who may want to implement complicated firewall rules or in any other way affect the traffic in their local networks.
> While with SCION the end-host selects the path of the packet, it cannot perform this selection completely independently. Instead, the network operator distributes the available paths and the end-host can only choose from this pre-selected set.
[1] https://www.anapaya.net/blog/the-scion-series-part-1
1) geo-fencing service for enterprise customers (think public sector, or ICS, which may have a strong need to guarantee a packet never leaves a jurisdiction)
2) geo-fencing political or legal jurisdictions. e.g. "great firewall type of scenarios" that would align all participants of an economic bloc into this walled garden. (sure it will be packaged with different language)
3) "transparency" in the data plane while isolating the control plane.
4) traffic shaping & QoS: think a faster lane for streaming content and a slower lane for other "less critical" content. What is critical might depend on the discretion of the carrier (the whole net-neutrality topic on "not all packets are created equal" again.
5) DDoS mitigation (https://news.ycombinator.com/item?id=21546214)
Imagine what the Internet looks like if ISP's could guarantee customers (such as a Swiss bank, an ICS, a chemical plant) that a packet will never leave a certain jurisdiction. But in the name of fighting copyright laws, cracking down on the "evil" sci-hub, or (outrage alert) terrorists "who download a bear over Tor". SCION breaks much of decentralized ideas, p2p, torrents, and other tech that relies on over-the-top routing much more efficiently and totally vendor agnostic (no need to ask Huawei, Nokia, Ericcsson to provide fancy features in the OAM plane). Hell even VPN's can easily be gotten rid of (in jurisdictions not sanctioned by your ISP).
Arguably the effects on how dystopian this will turn out depend on how an ISP bundles and implements such a technology. The Swiss (in the West) are usually trusted with not doing "shady stuff" (at least not until you study things like Crypto AG). The optimism for such a system might be different if you're in Russia, Poland, Hungary, Turkey, or Kazakhstan or want to protect yourself from things like the "Bundestrojaner".
Whether this is good or bad all depends on if you like the idea of walls/silos in the name of security, how much you trust your state and if you think there are people who get thrown under the bus by that state. Because ultimately it's about more power to the authority.
Personally I'm not convinced about this being better for security because it will not eliminate/mitigate more issues than it will create on its own (depending on which country you are in this threat might be more or less severe to you). Apart from the superior-security sales angle it will further lead to a "balkanization of the Internet".
This technology is extremely political and so there is little surprise it has momentum now when the focus is on isolating ourselves. See 1) Above - this value proposition isn't just great for off-shore banks, but also for countries who want less exposure to traffic from other countries (for whatever reason! think copyright laws, political sanctions, incompatible "human rights", or content-control e.g. social / free-speech / whatever values our own overlords might disagree with). SCION allows fine grained control over what to impose on who and helps with censorship since not everyone will be affected, it allows micro sanctions on anyone they disagree with and it will be harder for them to say it's happening because only they experience it. Think of it as a great-firewall-lite without all the political stigma and dressed up in the language of "security".
BGP is a hot mess and I'm all in favor of replacing it says my Tech brain. My human brain says BGP is a hot mess not only because it's old but it's incredibly political. The problems we're trying to solve are not all technical. Looking at the world in 2021 I want more dialogue on how we can solve our non technical issues of war and foreign policy failures everywhere before we build more walls. It's a tough one.
> “So, essentially SCION is an architecture to provide an alternative to BGP”, Adrian started his presentation. “There are some principles which are quite different from the current Internet.” For example, the SCION architecture follows a stateless packet forwarding approach - i.e., there's no per-flow state in routers and thus no opportunity for inconsistent state.
See an explanation of BGP here: https://www.cloudflare.com/learning/security/glossary/what-i....
So in my basic understanding of how the internet works, tl;dr SCION is a different way to transmit packets between computers, particularly over large distances.