Skip to main content

Anapaya PathGuard - Invisible services for authorized users

Anapaya PathGuard makes critical services invisible on the network. A service behind PathGuard runs in a hidden SCION AS. For an unauthorized party, no routing path to the service exists. Only authorized users can reach it.

The Internet consists only of your users
SCION
Internet
Hidden SCION AS
no public path
Mobile app
SCION SDK
Browser
PathGuard Web SDK
Laptop
PathGuard VPN Client
SNAP
provider A
SNAP
provider B
Anapaya EDGE
PathGuard
gateway
Hidden
service
hidden path
Attacker
on the public Internet
Attacker
on the SCION Internet
?
no path to the hidden AS
?
no path
Text is not SVG - cannot display

Authorized users reach the hidden service from a mobile app, a browser, or a VPN client. An attacker on the public Internet and an attacker on the SCION Internet find no path to the service.

The PathGuard value proposition: No path for attackers​

A service on the Internet is reachable by default. Anyone can find it, scan it, and attack it. The firewalls, gateways, and scrubbing services that protect the service must also be reachable, so they become targets too. These defenses are reactive: they examine the traffic after it arrives.

PathGuard removes the target. The protected service has no public path, so attack traffic cannot arrive:

  1. No attack surface for unauthorized parties: The SCION AS of the service does not publish its path segments to the public path servers. Only authorized users get the path segments, and only they can build a path to the service. What has no path cannot be attacked.

  2. Protection against critical threats: Without a path, the common attacks do not start.

    • Distributed Denial of Service (DDoS) attacks: A botnet cannot send traffic to a service that it cannot route to. The attack stops before it begins.
    • Scans and exploitation of vulnerabilities: An attacker must connect to a service before the attacker can exploit a vulnerability in it, also a zero-day vulnerability. PathGuard lets only authorized users connect.

Key features of Anapaya PathGuard​

  • Network invisibility: The protected service has no public presence. PathGuard does not filter or scrub traffic. Unauthorized traffic has no path to the service.
  • Native integration in your apps: The SCION SDK gives mobile and desktop applications direct access to the SCION Internet. The users keep their usual app and their usual login.
  • No client software for web users: The PathGuard Web SDK gives a standard browser access to the SCION Internet. The user opens the URL of the web application and logs in as usual. The user installs nothing.
  • Federated network, no single vendor cloud: Users connect through SCION Network Access Points (SNAPs) of different providers. No single provider carries all the traffic.
  • Path control: SCION paths are visible and selectable. Native applications select the paths of their traffic with path policies, for example to keep the traffic in a jurisdiction.
  • Sponsored connectivity: The enterprise pays for the SCION connectivity of its users with one sponsored subscription. The users buy nothing and configure nothing.
  • Use of the enterprise identity: Access is granted with client credentials, for example API keys or client certificates, or with the OIDC claims of an identity provider. PathGuard uses the identity management that the enterprise already operates.

Components​

PathGuard has five components that enterprises and their users interact with:

  • SCION SDK: Open-source libraries for native applications on mobile and desktop platforms. The application provider adds them to the application. See the SCION SDK documentation.
  • PathGuard Web SDK: A JavaScript library that sends the requests of a web application over SCION, through a web access point (WAP) at the SNAP. The application provider adds it to the web application.
  • PathGuard Web Gateway: A gateway in the hidden AS. It receives the SCION traffic of native applications and web browsers and forwards it to the unchanged web server.
  • PathGuard VPN Client: A WireGuard-based VPN client that reaches the hidden AS over the SCION Internet. It is available for Android, iOS, Linux, macOS, and Windows.
  • PathGuard VPN Gateway: A VPN gateway in the hidden AS. It terminates the tunnels of the VPN clients and forwards the traffic to the internal network.

Choosing components shows which client and which gateway fit which traffic.

Use cases​

PathGuard is for services that must stay reachable for a known group of users and that are too critical to expose to the whole Internet:

  • E-banking and payment backends: Customers use the mobile banking app and the e-banking web application as usual. The backend is invisible to all other parties.
  • Secure remote access: Employees reach internal services through a VPN gateway that has no public address.
  • Telemedicine: Doctors, patients, and medical devices reach a platform with health data. Other parties cannot find the platform.
  • IoT backends: Field devices reach their central server. Attackers cannot find the server.

The use cases page describes each use case in more detail.

What PathGuard is not​

  • Not a firewall or a scrubbing service: PathGuard does not examine traffic and does not separate good traffic from bad traffic. It makes sure that unauthorized traffic has no path.
  • Not application security: The service still authenticates its users and controls what they can do. PathGuard protects the network access to the service, not the application logic.
  • Not a VPN for all device traffic: The PathGuard VPN Client gives access to specific hidden services. It does not send all traffic of the device through the tunnel.
GATE or PathGuard?

Anapaya GATE limits the reach of a service to selected networks. PathGuard limits the reach of a service to authorized users. Comparing Anapaya PathGuard tells you when to use which product.

Next steps​