How Anapaya PathGuard works

A PathGuard service has no public path. This page explains how an authorized user still reaches it: which components take part, who operates them, and what happens from the login to the response.

Two layers of components

PathGuard has two layers. The PathGuard components are the parts that the enterprise and its users interact with. The SCION endhost infrastructure is shared by all SCION endhost applications and gives access to the SCION Internet and authentication.

The PathGuard components use the SCION endhost infrastructure.

Component	Role	Operated by
SCION SDK, PathGuard Web SDK	Send the traffic of the application over SCION.	The application provider adds them to the application.
PathGuard VPN Client	Builds the tunnel to the VPN Gateway.	The end user or the IT department of the enterprise.
PathGuard Web Gateway, PathGuard VPN Gateway	Receive the SCION traffic in the hidden AS and forward it to the service.	The enterprise.
Hidden SCION AS	Holds the protected service.	The enterprise. The AS runs on Anapaya EDGE appliances.
Identity provider	Authenticates the users of the enterprise.	The enterprise.
SCION ISP	Connects the hidden AS to the SCION Internet.	A SCION-enabled ISP.
SCION Network Access Point (SNAP)	Connects the applications to the SCION Internet and carries their traffic.	SNAP providers, usually ISPs.
Authentication and Authorization (AA) service	Authenticates the application and maps it to a subscription.	Anapaya.
SCION Subscription Registry (SSR)	Signs the SNAP tokens.	Anapaya.
Hidden Segment Directory (HSD)	Holds the hidden path segments and gives them only to authorized clients.	Anapaya.

Anapaya operates the AA service, the SSR, and the HSD today. The architecture lets other operators run these services too.

From login to response

The following seven steps show how a user reaches a PathGuard service. The numbers in the diagram are the numbers of the steps. The gateway in the diagram also stands for the hidden AS, which registers its segments in step 1.

1. Deploy the service. The enterprise puts its service behind a PathGuard Web Gateway or a PathGuard VPN Gateway in its hidden SCION AS. The AS registers its path segments only with the HSD, not with the public path servers. The enterprise sets an access policy for the hidden AS: it names the users, organizations, or devices that can get the hidden segments.
2. Authenticate. The user opens the mobile app, the web application, or the VPN client. The application authenticates the user with the identity provider of the enterprise through OIDC. A device or an application without a user authenticates with a client credential, for example an API key or a client certificate. The identity provider is reachable without hidden paths: it is in a public SCION AS or on the public Internet.
3. Get a SNAP token. The application shows the credential to the AA service. The AA service checks the credential and maps it to the sponsored subscription of the enterprise. The SSR signs a SNAP token for this subscription. The SNAP token is valid for a short time, and the application gets a new token before it expires. If the identity provider is in a public SCION AS, the application needs access to the SCION Internet before the login. Then the application first gets a SNAP token with an API key that ships with the application. This API key gives access only to the SCION Internet, not to the hidden segments. The HSD gives the hidden segments only after the login of the user.
4. Connect to the SNAP. The application connects to a SNAP and shows the SNAP token. The SNAP checks the signature and the expiry of the token. Then the application has access to the SCION Internet.
5. Get the hidden segments. The application asks the HSD for the hidden path segments of the destination AS and shows its credential. The HSD compares the credential with the access policy. If the policy allows the application, the HSD returns the hidden segments. If not, the HSD returns nothing. The application combines the hidden segments with public segments into a complete path. Hidden paths and access policies explains this step in detail.
6. Use the service. The application sends its traffic through the SNAP over the hidden path. The PathGuard gateway receives the traffic in the hidden AS and forwards it to the service. The response takes the reverse path.
7. Report the usage. The SNAP reports the traffic volume of each subscription. The reseller bills the sponsored subscription of the enterprise based on these reports. Subscriptions and usage explains the billing.

Browser access

A browser cannot send SCION packets. The PathGuard Web SDK solves this with a web access point (WAP) of the SNAP. The WAP is a server on the Internet with a connection to the SCION Internet.

1. Grant. The Web SDK shows the SNAP token and the hidden segments to the WAP. The WAP gives the IP address of the browser a short-term lease to reach the service. The Web SDK renews the lease before it expires.
2. Data. The Web SDK sends each request of the web application to the WAP. The WAP carries the connection over the SCION Internet to the PathGuard Web Gateway. The Web Gateway forwards the connection to the unchanged web server.

TLS runs end to end between the browser and the web server. The WAP and the Web Gateway carry the connection, but they cannot read the requests or the responses.

What a transit router sees

A packet on a hidden path looks like any other SCION packet. Each router on the path checks the cryptographic hop fields in the packet and forwards the packet. The router does not need to know that the path is hidden, and it does not need the hidden segments. An attacker who does not have the hidden segments cannot make valid hop fields. Thus, the attacker cannot build a path to the hidden AS.