These days, digitalisation requires secure networks that are easy to control. However, the foundation of the internet was laid last century without any special security mechanisms, and it has hardly been updated since. That makes it vulnerable. Nowadays, cybercriminals exploit vulnerabilities to such a degree that IT departments spend the majority of their time trying to prevent and eliminate cyber threats. This observation concerns not only the multitude of security risks, but also aspects of the transport network. It is high time for an upgrade.

SCION (Scalability, Control, and Isolation On Next-Generation Networks) is that upgrade. SWITCHlan SCION access combines the security, reliability and control of private networks with the flexibility of the public internet. The technology was developed at the Swiss Federal Institute of Technology (ETH) in Zurich. SWITCH has supported SCION’s development at ETH Zurich since 2015.

Today’s internet is made up of a multitude of loosely interconnected networks. Communication between the different networks makes transfers vulnerable through route hijacking. For example, a data packet could be diverted across several countries on its way from Zurich to Geneva and the sender and recipient would be helpless to prevent this from happening. Such hijackings are often detected well after the event.

Cybercriminals can redirect data packets or disable internet services with DDoS attacks. This is where SCION comes in – and minimises the area of attack to network level from the outset.

A team from ETH Zurich has redesigned SCION’s internet architecture from scratch. The foundation is formed by ‘isolation domains’ (ISDs). These domains can be states, industries or autonomous companies. SCION combines several networks (geographical, for example) to form ISDs. All the Swiss networks can belong to one ISD, for instance. Communication between two networks in the same ISD never goes anywhere else. As a result, confidential data can no longer be diverted unchecked via other network sections.

With SCION, the sender determines what transport route the data packets take, making attacks at routing level essentially impossible. For example, you can specify certain providers or network paths to avoid.

At present, the SCION protocol is still in development. Officially, the specification has not yet been publicly standardised. The development team at ETH is actively seeking to obtain this standardisation.