Skip to content

Commit

Permalink
Removed Overview section
Browse files Browse the repository at this point in the history
This is now covered (and replaced by) the new Introduction section.
  • Loading branch information
knmeynell committed Jun 10, 2024
1 parent 369d8dd commit 5f4b313
Showing 1 changed file with 0 additions and 11 deletions.
11 changes: 0 additions & 11 deletions draft-dekater-scion-pki.md
Original file line number Diff line number Diff line change
Expand Up @@ -192,17 +192,6 @@ This document describes the SCION PKI component used by the Control Plane.
{::boilerplate bcp14-tagged}


## Overview

SCION is a path-aware internetworking routing architecture as described in [RFC9217]. It allows endpoints and applications to select paths across the network to use for traffic, based on trustworthy path properties. SCION is an inter-domain network architecture and is not concerned with intra-domain forwarding.

To achieve scalability and trust, SCION organizes existing Autonomous Systems (ASes) into logical groups of independent routing planes called *Isolation Domains (ISDs)*. All ASes in an ISD agree on a set of trust roots called the *Trust Root Configuration (TRC)* which is a collection of signed root certificates in X.509 v3 format [RFC5280]. The ISD is governed by a set of *core ASes* which typically manage the trust roots and provide connectivity to other ISDs. This is the basis of the public key infrastructure which the SCION control plane is reliant on for the authentication of messages used for the SCION control plane.

The SCION control plane [I-D.dekater-scion-controlplane] is responsible for discovering inter-domain paths between ASes. The core ASes use *Path-segment Construction Beacons (PCBs)* to explore intra-ISD paths, or to explore paths across different ISDs.

The SCION data plane forwards inter-domain packets between ASes [I-D.dekater-scion-dataplane]. SCION routers are normally deployed at the edge of an AS, and peer with neighbor SCION routers. A SCION border router reuses existing intra-domain infrastructure to communicate to other SCION routers or SCION endpoints within its AS.


## Trust Model

Given the diverse nature of the constituents in the current Internet, an important challenge is how to scale authentication of network elements (such as AS ownership, hop-by-hop routing information, name servers for DNS, and domains for TLS) to the global environment. The roots of trust of currently prevalent public key infrastructure (PKI) models do not scale well to a global environment, because (1) mutually distrustful parties cannot agree on a single trust root (monopoly model), and because (2) the security of a plethora of roots of trust is only as strong as its weakest link (oligopoly model) - see also {{BARRERA17}}.
Expand Down

0 comments on commit 5f4b313

Please sign in to comment.