6 ms·

Scion – A Novel Internet Architecture

115 points by dade 5y ago

armchairhacker 5y ago
Stolen from the article: > “So, essentially SCION is an architecture to provide an alternative to BGP”, Adrian started his presentation. “There are some principles which are quite different from the current Internet.” For example, the SCION architecture follows a stateless packet forwarding approach - i.e., there's no per-flow state in routers and thus no opportunity for inconsistent state. See an explanation of BGP here: https://www.cloudflare.com/learning/security/glossary/what-is-bgp/ https://www.cloudflare.com/learning/security/glossary/what-i.... So in my basic understanding of how the internet works, tl;dr SCION is a different way to transmit packets between computers, particularly over large distances.
- stingraycharles 5y ago
  In oversimplified terms, BGP is more like a routing mechanism between ISPs, rather than just computers. BGP has historically been problematic, as a misconfigured ISP could suddenly start broadcasting routes for eg YouTube which could bring that whole site down. (This isn’t a hypothetical example, this actually happened, see for example: https://news.ycombinator.com/item?id=122826 https://news.ycombinator.com/item?id=122826 )
  - runlevel1 5y ago
    To expand a little more: BGP is a protocol for exchanging information about routes between routers, not a protocol for shipping non-routing data (e.g. your HTTP request is never carried by BGP).
    - dnautics 5y ago
      As a shitty analogy, I would say it's role is analogous to DHCP, except it's decentralized and for WANs instead of LANs.
api 5y ago
Sounds like source routing. It’s an idea that was abandoned early on, but I’d be interested in learning if things are different. Sometimes old abandoned ideas can be revisited due to new approaches, algorithmic or design innovation, or Moore’s law.
- philprx 5y ago
  Yeah sounds a bit like it, at least scion would be a superset as it embeds many other concepts. IMHO, source routing concept is not abandoned as Segment Routing seems to be used in specialized / large networks: https://en.wikipedia.org/wiki/Segment_routing https://en.wikipedia.org/wiki/Segment_routing
- caust1c 5y ago
  I believe it's a bit of this and a bit of that. My understanding is that source routing wasn't widely adopted because it couldn't quickly adapt to changes and partitions. Now that we can calculate routes trivially on consumer grade hardware, perhaps that's a forcing function? Come to think of it, I see this as a conceptual extension and optimization on BGP Policy Based routing. Seems like it's removing the overhead and formally separating the control protocols from the data protocols.
- kilburn 5y ago
  This is explicitly answered in the second blog post [2] of a 3-part [1,2,3] series over at the anapaya website: > A careful reader may have gotten the impression that SCION is simply source routing in disguise, however, this is not the case for a variety of reasons. First of all, end hosts do not learn any information about topology inside the Autonomous System (AS) - this is still under the control of the local network administrators who may want to implement complicated firewall rules or in any other way affect the traffic in their local networks. > While with SCION the end-host selects the path of the packet, it cannot perform this selection completely independently. Instead, the network operator distributes the available paths and the end-host can only choose from this pre-selected set. [1] https://www.anapaya.net/blog/the-scion-series-part-1 https://www.anapaya.net/blog/the-scion-series-part-1 [2] https://www.anapaya.net/blog/the-scion-series-part-2 https://www.anapaya.net/blog/the-scion-series-part-2 [3] https://www.anapaya.net/blog/the-scion-series-part-3 https://www.anapaya.net/blog/the-scion-series-part-3
thrrck 5y ago
This is academically interesting and it's cool to see that there seems to be a business model for it as well https://www.anapaya.net/ https://www.anapaya.net/
lincpa 5y ago
The end-to-end communication efficiency is too low. The warehouse/workshop model is a fractal system. The warehouse performs unified scheduling on autonomous systems (ASes, workshop), which is the most efficient. The Grand Unified Programming Theory: The Pure Function Pipeline Data Flow with Principle-based Warehouse/Workshop Model https://github.com/linpengcheng/PurefunctionPipelineDataflow https://github.com/linpengcheng/PurefunctionPipelineDataflow
_hl_ 5y ago
One of the interesting points about SCION is that it achieves today's required forwarding performance on commodity hardware. No more expensive and inefficient TCAMs, no more limits to scalability. This, among other features of SCION, provides an economic incentive for ISPs and organizations to switch to SCION eventually.
- wmf 5y ago
  How does that work? I'm not aware of any ASICs that understand SCION packet headers.
  - kilburn 5y ago
    You are thinking about decoding, validating and forwarding a packet. I'm not a networking guy, so take the following with a grain of salt. Even without ASICs the read/decode/forward part is apparently not a big deal: you can easily saturate multi-gigabit connections with cheap cpus today. But only if you don't have to make complicated routing decisions (i.e.: select the most appropriate "next hop" for each packet). SCION pushes these decisions to the senders. When a sender sends a packet, that packet already contains the route it _has_ to follow. ISP routes are then dumb forwarders whose only job entails: 1. Ensuring the packet is valid (including a cryptography check for the route information). While this may seem expensive, note that pretty much all general-purpose cpus today include specific hardware to deal with this. 2. Forwarding it according to what the packet says Of course, this implies that there needs to be a "control layer" that allows end hosts to construct these routes for each packet. However, that control layer is similar to a DNS system, meaning that while not trivial it can use a hierarchical, heavily-cached approach and shouldn't be too challenging to scale.
    - wmf 5y ago
      An ASIC router does something like 10 Tbps for $10K while a software router is closer to 1 Tbps for $50K; the limit is I/O and memory bandwidth, so simplifying forwarding won't increase performance. And ISPs need multi-Tbps throughput for backbones (which is where SCION would be used).
    - 5y ago
DyslexicAtheist 5y ago
The tech is exciting which can be summarized to support the following (business|security|gatekeeping) -scenarios: 1) geo-fencing service for enterprise customers (think public sector, or ICS, which may have a strong need to guarantee a packet never leaves a jurisdiction) 2) geo-fencing political or legal jurisdictions. e.g. "great firewall type of scenarios" that would align all participants of an economic bloc into this walled garden. (sure it will be packaged with different language) 3) "transparency" in the data plane while isolating the control plane. 4) traffic shaping & QoS: think a faster lane for streaming content and a slower lane for other "less critical" content. What is critical might depend on the discretion of the carrier (the whole net-neutrality topic on "not all packets are created equal" again. 5) DDoS mitigation (https://news.ycombinator.com/item?id=21546214 https://news.ycombinator.com/item?id=21546214) Imagine what the Internet looks like if ISP's could guarantee customers (such as a Swiss bank, an ICS, a chemical plant) that a packet will never leave a certain jurisdiction. But in the name of fighting copyright laws, cracking down on the "evil" sci-hub, or (outrage alert) terrorists "who download a bear over Tor". SCION breaks much of decentralized ideas, p2p, torrents, and other tech that relies on over-the-top routing much more efficiently and totally vendor agnostic (no need to ask Huawei, Nokia, Ericcsson to provide fancy features in the OAM plane). Hell even VPN's can easily be gotten rid of (in jurisdictions not sanctioned by your ISP). Arguably the effects on how dystopian this will turn out depend on how an ISP bundles and implements such a technology. The Swiss (in the West) are usually trusted with not doing "shady stuff" (at least not until you study things like Crypto AG). The optimism for such a system might be different if you're in Russia, Poland, Hungary, Turkey, or Kazakhstan or want to protect yourself from things like the "Bundestrojaner". Whether this is good or bad all depends on if you like the idea of walls/silos in the name of security, how much you trust your state and if you think there are people who get thrown under the bus by that state. Because ultimately it's about more power to the authority. Personally I'm not convinced about this being better for security because it will not eliminate/mitigate more issues than it will create on its own (depending on which country you are in this threat might be more or less severe to you). Apart from the superior-security sales angle it will further lead to a "balkanization of the Internet". This technology is extremely political and so there is little surprise it has momentum now when the focus is on isolating ourselves. See 1) Above - this value proposition isn't just great for off-shore banks, but also for countries who want less exposure to traffic from other countries (for whatever reason! think copyright laws, political sanctions, incompatible "human rights", or content-control e.g. social / free-speech / whatever values our own overlords might disagree with). SCION allows fine grained control over what to impose on who and helps with censorship since not everyone will be affected, it allows micro sanctions on anyone they disagree with and it will be harder for them to say it's happening because only they experience it. Think of it as a great-firewall-lite without all the political stigma and dressed up in the language of "security". BGP is a hot mess and I'm all in favor of replacing it says my Tech brain. My human brain says BGP is a hot mess not only because it's old but it's incredibly political. The problems we're trying to solve are not all technical. Looking at the world in 2021 I want more dialogue on how we can solve our non technical issues of war and foreign policy failures everywhere before we build more walls. It's a tough one.
jcrawfordor 5y ago
SCION feels like---and from the FAQ its developers agree---MPLS applied to the inter-system problem. Many of the advantages it has, such as very high performance routing at intermediary nodes, are more or less inherited from the MPLS design. What it adds on top of MPLS is a route discovery/setup mechanism that is far more suited to border gateway use, with security and integrity precautions. Additionally, SCION comes with COLIBRI, a reservation-based QoS system that at least on brief reading seems to have much of the power of RSVP with MPLS to provide dedicated bandwidth for media applications. It will of course face the challenges of operating between domains without complete mutual trust, which is what has generally killed resource reservation on the internet (I mean, besides software engineers always thinking resource reservation is too hard). MPLS is, in my opinion, and under-rated protocol, and it's cool to see the label switching concept being developed into the future.

115 points by dade 5y ago

Stolen from the article: > “So, essentially SCION is an architecture to provide an alternative to BGP”, Adrian started his presentation. “There are some principles which are quite different from the current Internet.” For example, the SCION architecture follows a stateless packet forwarding approach - i.e., there's no per-flow state in routers and thus no opportunity for inconsistent state. See an explanation of BGP here: https://www.cloudflare.com/learning/security/glossary/what-is-bgp/ https://www.cloudflare.com/learning/security/glossary/what-i.... So in my basic understanding of how the internet works, tl;dr SCION is a different way to transmit packets between computers, particularly over large distances.

stingraycharles 5y ago
In oversimplified terms, BGP is more like a routing mechanism between ISPs, rather than just computers. BGP has historically been problematic, as a misconfigured ISP could suddenly start broadcasting routes for eg YouTube which could bring that whole site down. (This isn’t a hypothetical example, this actually happened, see for example: https://news.ycombinator.com/item?id=122826 https://news.ycombinator.com/item?id=122826 )
- runlevel1 5y ago
  To expand a little more: BGP is a protocol for exchanging information about routes between routers, not a protocol for shipping non-routing data (e.g. your HTTP request is never carried by BGP).
  - dnautics 5y ago
    As a shitty analogy, I would say it's role is analogous to DHCP, except it's decentralized and for WANs instead of LANs.

api 5y ago

Sounds like source routing. It’s an idea that was abandoned early on, but I’d be interested in learning if things are different. Sometimes old abandoned ideas can be revisited due to new approaches, algorithmic or design innovation, or Moore’s law.

philprx 5y ago
Yeah sounds a bit like it, at least scion would be a superset as it embeds many other concepts. IMHO, source routing concept is not abandoned as Segment Routing seems to be used in specialized / large networks: https://en.wikipedia.org/wiki/Segment_routing https://en.wikipedia.org/wiki/Segment_routing
caust1c 5y ago
I believe it's a bit of this and a bit of that. My understanding is that source routing wasn't widely adopted because it couldn't quickly adapt to changes and partitions. Now that we can calculate routes trivially on consumer grade hardware, perhaps that's a forcing function? Come to think of it, I see this as a conceptual extension and optimization on BGP Policy Based routing. Seems like it's removing the overhead and formally separating the control protocols from the data protocols.
kilburn 5y ago
This is explicitly answered in the second blog post [2] of a 3-part [1,2,3] series over at the anapaya website: > A careful reader may have gotten the impression that SCION is simply source routing in disguise, however, this is not the case for a variety of reasons. First of all, end hosts do not learn any information about topology inside the Autonomous System (AS) - this is still under the control of the local network administrators who may want to implement complicated firewall rules or in any other way affect the traffic in their local networks. > While with SCION the end-host selects the path of the packet, it cannot perform this selection completely independently. Instead, the network operator distributes the available paths and the end-host can only choose from this pre-selected set. [1] https://www.anapaya.net/blog/the-scion-series-part-1 https://www.anapaya.net/blog/the-scion-series-part-1 [2] https://www.anapaya.net/blog/the-scion-series-part-2 https://www.anapaya.net/blog/the-scion-series-part-2 [3] https://www.anapaya.net/blog/the-scion-series-part-3 https://www.anapaya.net/blog/the-scion-series-part-3

thrrck 5y ago

This is academically interesting and it's cool to see that there seems to be a business model for it as well https://www.anapaya.net/ https://www.anapaya.net/

lincpa 5y ago

The end-to-end communication efficiency is too low. The warehouse/workshop model is a fractal system. The warehouse performs unified scheduling on autonomous systems (ASes, workshop), which is the most efficient. The Grand Unified Programming Theory: The Pure Function Pipeline Data Flow with Principle-based Warehouse/Workshop Model https://github.com/linpengcheng/PurefunctionPipelineDataflow https://github.com/linpengcheng/PurefunctionPipelineDataflow

_hl_ 5y ago

One of the interesting points about SCION is that it achieves today's required forwarding performance on commodity hardware. No more expensive and inefficient TCAMs, no more limits to scalability. This, among other features of SCION, provides an economic incentive for ISPs and organizations to switch to SCION eventually.

wmf 5y ago
How does that work? I'm not aware of any ASICs that understand SCION packet headers.
- kilburn 5y ago
  You are thinking about decoding, validating and forwarding a packet. I'm not a networking guy, so take the following with a grain of salt. Even without ASICs the read/decode/forward part is apparently not a big deal: you can easily saturate multi-gigabit connections with cheap cpus today. But only if you don't have to make complicated routing decisions (i.e.: select the most appropriate "next hop" for each packet). SCION pushes these decisions to the senders. When a sender sends a packet, that packet already contains the route it _has_ to follow. ISP routes are then dumb forwarders whose only job entails: 1. Ensuring the packet is valid (including a cryptography check for the route information). While this may seem expensive, note that pretty much all general-purpose cpus today include specific hardware to deal with this. 2. Forwarding it according to what the packet says Of course, this implies that there needs to be a "control layer" that allows end hosts to construct these routes for each packet. However, that control layer is similar to a DNS system, meaning that while not trivial it can use a hierarchical, heavily-cached approach and shouldn't be too challenging to scale.
  - wmf 5y ago
    An ASIC router does something like 10 Tbps for $10K while a software router is closer to 1 Tbps for $50K; the limit is I/O and memory bandwidth, so simplifying forwarding won't increase performance. And ISPs need multi-Tbps throughput for backbones (which is where SCION would be used).
  - 5y ago

DyslexicAtheist 5y ago

The tech is exciting which can be summarized to support the following (business|security|gatekeeping) -scenarios: 1) geo-fencing service for enterprise customers (think public sector, or ICS, which may have a strong need to guarantee a packet never leaves a jurisdiction) 2) geo-fencing political or legal jurisdictions. e.g. "great firewall type of scenarios" that would align all participants of an economic bloc into this walled garden. (sure it will be packaged with different language) 3) "transparency" in the data plane while isolating the control plane. 4) traffic shaping & QoS: think a faster lane for streaming content and a slower lane for other "less critical" content. What is critical might depend on the discretion of the carrier (the whole net-neutrality topic on "not all packets are created equal" again. 5) DDoS mitigation (https://news.ycombinator.com/item?id=21546214 https://news.ycombinator.com/item?id=21546214) Imagine what the Internet looks like if ISP's could guarantee customers (such as a Swiss bank, an ICS, a chemical plant) that a packet will never leave a certain jurisdiction. But in the name of fighting copyright laws, cracking down on the "evil" sci-hub, or (outrage alert) terrorists "who download a bear over Tor". SCION breaks much of decentralized ideas, p2p, torrents, and other tech that relies on over-the-top routing much more efficiently and totally vendor agnostic (no need to ask Huawei, Nokia, Ericcsson to provide fancy features in the OAM plane). Hell even VPN's can easily be gotten rid of (in jurisdictions not sanctioned by your ISP). Arguably the effects on how dystopian this will turn out depend on how an ISP bundles and implements such a technology. The Swiss (in the West) are usually trusted with not doing "shady stuff" (at least not until you study things like Crypto AG). The optimism for such a system might be different if you're in Russia, Poland, Hungary, Turkey, or Kazakhstan or want to protect yourself from things like the "Bundestrojaner". Whether this is good or bad all depends on if you like the idea of walls/silos in the name of security, how much you trust your state and if you think there are people who get thrown under the bus by that state. Because ultimately it's about more power to the authority. Personally I'm not convinced about this being better for security because it will not eliminate/mitigate more issues than it will create on its own (depending on which country you are in this threat might be more or less severe to you). Apart from the superior-security sales angle it will further lead to a "balkanization of the Internet". This technology is extremely political and so there is little surprise it has momentum now when the focus is on isolating ourselves. See 1) Above - this value proposition isn't just great for off-shore banks, but also for countries who want less exposure to traffic from other countries (for whatever reason! think copyright laws, political sanctions, incompatible "human rights", or content-control e.g. social / free-speech / whatever values our own overlords might disagree with). SCION allows fine grained control over what to impose on who and helps with censorship since not everyone will be affected, it allows micro sanctions on anyone they disagree with and it will be harder for them to say it's happening because only they experience it. Think of it as a great-firewall-lite without all the political stigma and dressed up in the language of "security". BGP is a hot mess and I'm all in favor of replacing it says my Tech brain. My human brain says BGP is a hot mess not only because it's old but it's incredibly political. The problems we're trying to solve are not all technical. Looking at the world in 2021 I want more dialogue on how we can solve our non technical issues of war and foreign policy failures everywhere before we build more walls. It's a tough one.

jcrawfordor 5y ago

SCION feels like---and from the FAQ its developers agree---MPLS applied to the inter-system problem. Many of the advantages it has, such as very high performance routing at intermediary nodes, are more or less inherited from the MPLS design. What it adds on top of MPLS is a route discovery/setup mechanism that is far more suited to border gateway use, with security and integrity precautions. Additionally, SCION comes with COLIBRI, a reservation-based QoS system that at least on brief reading seems to have much of the power of RSVP with MPLS to provide dedicated bandwidth for media applications. It will of course face the challenges of operating between domains without complete mutual trust, which is what has generally killed resource reservation on the internet (I mean, besides software engineers always thinking resource reservation is too hard). MPLS is, in my opinion, and under-rated protocol, and it's cool to see the label switching concept being developed into the future.