[HN Gopher] Scion - A Novel Internet Architecture
___________________________________________________________________
Scion - A Novel Internet Architecture
Author : dade
Score : 105 points
Date : 2021-05-23 12:41 UTC (10 hours ago)
(HTM) web link (labs.ripe.net)
(TXT) w3m dump (labs.ripe.net)
| jcrawfordor wrote:
| SCION feels like---and from the FAQ its developers agree---MPLS
| applied to the inter-system problem. Many of the advantages it
| has, such as very high performance routing at intermediary nodes,
| are more or less inherited from the MPLS design. What it adds on
| top of MPLS is a route discovery/setup mechanism that is far more
| suited to border gateway use, with security and integrity
| precautions.
|
| Additionally, SCION comes with COLIBRI, a reservation-based QoS
| system that at least on brief reading seems to have much of the
| power of RSVP with MPLS to provide dedicated bandwidth for media
| applications. It will of course face the challenges of operating
| between domains without complete mutual trust, which is what has
| generally killed resource reservation on the internet (I mean,
| besides software engineers always thinking resource reservation
| is too hard).
|
| MPLS is, in my opinion, and under-rated protocol, and it's cool
| to see the label switching concept being developed into the
| future.
| thrrck wrote:
| This is academically interesting and it's cool to see that there
| seems to be a business model for it as well
| https://www.anapaya.net/
| _hl_ wrote:
| One of the interesting points about SCION is that it achieves
| today's required forwarding performance _on commodity hardware_.
| No more expensive and inefficient TCAMs, no more limits to
| scalability. This, among other features of SCION, provides an
| economic incentive for ISPs and organizations to switch to SCION
| eventually.
| wmf wrote:
| How does that work? I'm not aware of any ASICs that understand
| SCION packet headers.
| kilburn wrote:
| You are thinking about decoding, validating and forwarding a
| packet. I'm not a networking guy, so take the following with
| a grain of salt.
|
| Even without ASICs the read/decode/forward part is apparently
| not a big deal: you can easily saturate multi-gigabit
| connections with cheap cpus today. But only if you don't have
| to make complicated routing decisions (i.e.: select the most
| appropriate "next hop" for each packet).
|
| SCION pushes these decisions to the senders. When a sender
| sends a packet, that packet already contains the route it
| _has_ to follow. ISP routes are then dumb forwarders whose
| only job entails:
|
| 1. Ensuring the packet is valid (including a cryptography
| check for the route information). While this may seem
| expensive, note that pretty much all general-purpose cpus
| today include specific hardware to deal with this.
|
| 2. Forwarding it according to what the packet says
|
| Of course, this implies that there needs to be a "control
| layer" that allows end hosts to construct these routes for
| each packet. However, that control layer is similar to a DNS
| system, meaning that while not trivial it can use a
| hierarchical, heavily-cached approach and shouldn't be too
| challenging to scale.
| wmf wrote:
| An ASIC router does something like 10 Tbps for $10K while a
| software router is closer to 1 Tbps for $50K; the limit is
| I/O and memory bandwidth, so simplifying forwarding won't
| increase performance. And ISPs need multi-Tbps throughput
| for backbones (which is where SCION would be used).
| DyslexicAtheist wrote:
| The tech is exciting which can be summarized to support the
| following (business|security|gatekeeping) -scenarios:
|
| 1) geo-fencing service for enterprise customers (think public
| sector, or ICS, which may have a strong need to guarantee a
| packet never leaves a jurisdiction)
|
| 2) geo-fencing political or legal jurisdictions. e.g. "great
| firewall type of scenarios" that would align all participants of
| an economic bloc into this walled garden. (sure it will be
| packaged with different language)
|
| 3) "transparency" in the data plane while isolating the control
| plane.
|
| 4) traffic shaping & QoS: think a faster lane for streaming
| content and a slower lane for other "less critical" content. What
| is critical might depend on the discretion of the carrier (the
| whole net-neutrality topic on "not all packets are created equal"
| again.
|
| 5) DDoS mitigation
| (https://news.ycombinator.com/item?id=21546214)
|
| Imagine what the Internet looks like if ISP's could guarantee
| customers (such as a Swiss bank, an ICS, a chemical plant) that a
| packet will never leave a certain jurisdiction. But in the name
| of fighting copyright laws, cracking down on the "evil" sci-hub,
| or (outrage alert) terrorists "who download a bear over Tor".
| SCION breaks much of decentralized ideas, p2p, torrents, and
| other tech that relies on over-the-top routing much more
| efficiently and totally vendor agnostic (no need to ask Huawei,
| Nokia, Ericcsson to provide fancy features in the OAM plane).
| Hell even VPN's can easily be gotten rid of (in jurisdictions not
| sanctioned by your ISP).
|
| Arguably the effects on how dystopian this will turn out depend
| on how an ISP bundles and implements such a technology. The Swiss
| (in the West) are usually trusted with not doing "shady stuff"
| (at least not until you study things like _Crypto AG_ ). The
| optimism for such a system might be different if you're in
| Russia, Poland, Hungary, Turkey, or Kazakhstan or want to protect
| yourself from things like the "Bundestrojaner".
|
| Whether this is good or bad all depends on if you like the idea
| of walls/silos in the name of security, how much you trust your
| state and if you think there are people who get thrown under the
| bus by that state. Because ultimately it's about more power to
| the authority.
|
| Personally I'm not convinced about this being better for security
| because it will not eliminate/mitigate more issues than it will
| create on its own (depending on which country you are in this
| threat might be more or less severe to you). Apart from the
| superior-security sales angle it will further lead to a
| "balkanization of the Internet".
|
| This technology is extremely political and so there is little
| surprise it has momentum now when the focus is on isolating
| ourselves. See 1) Above - this value proposition isn't just great
| for off-shore banks, but also for countries who want less
| exposure to traffic from other countries (for whatever reason!
| think copyright laws, political sanctions, incompatible "human
| rights", or content-control e.g. social / free-speech / whatever
| values our own overlords might disagree with). SCION allows fine
| grained control over what to impose on who and helps with
| censorship since not everyone will be affected, it allows micro
| sanctions on anyone they disagree with and it will be harder for
| them to say it's happening because only they experience it. Think
| of it as a great-firewall-lite without all the political stigma
| and dressed up in the language of "security".
|
| BGP is a hot mess and I'm all in favor of replacing it says my
| Tech brain. My human brain says BGP is a hot mess not only
| because it's old but it's incredibly political. The problems
| we're trying to solve are not all technical. Looking at the world
| in 2021 I want more dialogue on how we can solve our non
| technical issues of war and foreign policy failures everywhere
| before we build more walls. It's a tough one.
| armchairhacker wrote:
| Stolen from the article:
|
| > "So, essentially SCION is an architecture to provide an
| alternative to BGP", Adrian started his presentation. "There are
| some principles which are quite different from the current
| Internet." For example, the SCION architecture follows a
| stateless packet forwarding approach - i.e., there's no per-flow
| state in routers and thus no opportunity for inconsistent state.
|
| See an explanation of BGP here:
| https://www.cloudflare.com/learning/security/glossary/what-i....
|
| So in my basic understanding of how the internet works, tl;dr
| SCION is a different way to transmit packets between computers,
| particularly over large distances.
| stingraycharles wrote:
| In oversimplified terms, BGP is more like a routing mechanism
| between ISPs, rather than just computers. BGP has historically
| been problematic, as a misconfigured ISP could suddenly start
| broadcasting routes for eg YouTube which could bring that whole
| site down. (This isn't a hypothetical example, this actually
| happened, see for example:
| https://news.ycombinator.com/item?id=122826 )
| runlevel1 wrote:
| To expand a little more: BGP is a protocol for exchanging
| information about routes between routers, not a protocol for
| shipping non-routing data (e.g. your HTTP request is never
| carried by BGP).
| dnautics wrote:
| As a shitty analogy, I would say it's role is analogous to
| DHCP, except it's decentralized and for WANs instead of
| LANs.
| api wrote:
| Sounds like source routing. It's an idea that was abandoned early
| on, but I'd be interested in learning if things are different.
| Sometimes old abandoned ideas can be revisited due to new
| approaches, algorithmic or design innovation, or Moore's law.
| philprx wrote:
| Yeah sounds a bit like it, at least scion would be a superset
| as it embeds many other concepts.
|
| IMHO, source routing concept is not abandoned as Segment
| Routing seems to be used in specialized / large networks:
|
| https://en.wikipedia.org/wiki/Segment_routing
| kilburn wrote:
| This is explicitly answered in the second blog post [2] of a
| 3-part [1,2,3] series over at the anapaya website:
|
| > A careful reader may have gotten the impression that SCION is
| simply source routing in disguise, however, this is not the
| case for a variety of reasons. First of all, end hosts do not
| learn any information about topology inside the Autonomous
| System (AS) - this is still under the control of the local
| network administrators who may want to implement complicated
| firewall rules or in any other way affect the traffic in their
| local networks.
|
| > While with SCION the end-host selects the path of the packet,
| it cannot perform this selection completely independently.
| Instead, the network operator distributes the available paths
| and the end-host can only choose from this pre-selected set.
|
| [1] https://www.anapaya.net/blog/the-scion-series-part-1
|
| [2] https://www.anapaya.net/blog/the-scion-series-part-2
|
| [3] https://www.anapaya.net/blog/the-scion-series-part-3
| caust1c wrote:
| I believe it's a bit of this and a bit of that. My
| understanding is that source routing wasn't widely adopted
| because it couldn't quickly adapt to changes and partitions.
|
| Now that we can calculate routes trivially on consumer grade
| hardware, perhaps that's a forcing function?
|
| Come to think of it, I see this as a conceptual extension and
| optimization on BGP Policy Based routing. Seems like it's
| removing the overhead and formally separating the control
| protocols from the data protocols.
| lincpa wrote:
| The end-to-end communication efficiency is too low. The
| warehouse/workshop model is a fractal system. The warehouse
| performs unified scheduling on autonomous systems (ASes,
| workshop), which is the most efficient.
|
| The Grand Unified Programming Theory: The Pure Function Pipeline
| Data Flow with Principle-based Warehouse/Workshop Model
|
| https://github.com/linpengcheng/PurefunctionPipelineDataflow
___________________________________________________________________
(page generated 2021-05-23 23:02 UTC)