Anapaya PathGuard vs. other technologies

This page compares Anapaya PathGuard with the technologies that protect services and remote access today: Internet VPNs, web application firewalls (WAFs), DDoS scrubbing services, identity-aware tunnel proxies, and SASE and ZTNA platforms. The last section compares PathGuard with Anapaya GATE.

The main difference is where an attack stops. The other technologies examine or carry the attack traffic after it arrives. With PathGuard, the attack traffic has no path to the service.

Technology	Where the attack stops
Internet VPN	At the VPN concentrator, which is the target.
Web application firewall	At the WAF, after the attack traffic arrives.
DDoS scrubbing service	At the scrubbing service, after the attack traffic arrives.
Identity-aware tunnel proxy	At the network of the provider, after the attack traffic arrives.
Anapaya PathGuard	Nowhere. The attacker has no path, so the attack traffic never starts.

With PathGuard, the attacker does not know a path to the hidden AS.

Internet VPNs

An Internet VPN gives users an encrypted tunnel from their device to the corporate network.

• Capabilities: Internet VPNs are mature, well known, and cheap. They encrypt the traffic and authenticate the users.
• Limitations: The VPN concentrator needs a public IP address. Attackers scan it all the time, and vulnerabilities in VPN software are a frequent way into corporate networks. A DDoS attack on the concentrator stops the remote access of all employees.
• Anapaya PathGuard advantage: The PathGuard VPN Gateway is in a hidden AS and has no public address. Attackers cannot scan it or attack it, because they have no path to it.

The attack reaches the VPN concentrator, which is the target.

Web application firewalls

A WAF examines the HTTP requests to a web service and blocks the requests that it identifies as malicious.

• Capabilities: WAFs give good protection on the application layer, for example against injection attacks. They have large sets of rules.
• Limitations: The WAF must be reachable for everyone, so it has the same DDoS and exploitation risks as the service behind it. It gives no protection on the network layer.
• Anapaya PathGuard advantage: PathGuard removes the attack surface on the network layer. The two technologies work together: the WAF keeps its role for the application logic, and it gets only the traffic of authorized users.

The WAF stops the attack after it arrives.

DDoS scrubbing services

A DDoS scrubbing service receives all the traffic of a service, removes the attack traffic, and forwards the remaining traffic.

• Capabilities: Scrubbing services can absorb very large volumetric attacks with their global capacity.
• Limitations: The scrubbing service classifies the traffic after it arrives, and it can block legitimate users by mistake. The provider sees all traffic and becomes a single point of failure. If the address of the origin server becomes known, attackers can go around the scrubbing service.
• Anapaya PathGuard advantage: PathGuard does not classify traffic. Unauthorized traffic cannot be routed to the service, so there is no attack traffic to remove. The traffic goes through SNAPs of different providers, and no single provider sees all of it.

The scrubbing service removes the attack traffic after it arrives.

Identity-aware tunnel proxies

An identity-aware tunnel proxy, for example Cloudflare Tunnel with Cloudflare Access, hides the origin server behind the network of one provider. A daemon at the origin opens outbound connections to the provider, and the provider checks the identity of each user.

• Capabilities: The origin needs no public IP address. The setup is simple, and access control based on identity is built in.
• Limitations: All traffic goes through the network of one provider. An outage or a breach at this provider affects all protected services. The customer cannot control or verify the path of the traffic.
• Anapaya PathGuard advantage: PathGuard hides the service in the network itself, not behind one provider. The customer uses SNAPs of different providers, and SCION paths are visible and selectable.

The provider of the tunnel proxy stops the attack after it arrives.

SASE and ZTNA platforms

Secure Access Service Edge (SASE) and Zero Trust Network Access (ZTNA) platforms send the traffic of the users through the cloud of the provider, where the provider applies the security policies.

• Capabilities: SASE and ZTNA platforms give a broad and integrated set of policies for the access of employees.
• Limitations: They usually need an agent on each device, which is difficult on private devices and on the devices of contractors. All traffic goes through the cloud of one provider, and the customer cannot see how the provider routes the traffic.
• Anapaya PathGuard advantage: The PathGuard Web SDK gives browser users access without an agent. The SCION Internet has many providers, so PathGuard adds no new single vendor cloud. SCION paths are visible and selectable.

Summary

	Anapaya PathGuard	Internet VPN	WAF & DDoS scrubbing	Tunnel proxy	SASE & ZTNA
Security model	✅ No path for unauthorized parties. The service is invisible.	⚠️ Encrypted tunnel to a concentrator that everyone can reach.	⚠️ Examines or removes the attack traffic after it arrives.	✅ Hides the origin behind the provider and checks the identity of users.	✅ Applies identity-based policies in the cloud of the provider.
Public address of the service	✅ None. The service is in a hidden AS.	❌ The VPN concentrator has a public address.	⚠️ The WAF or the scrubbing service has a public address. The origin is hidden only while its address stays unknown.	⚠️ The origin has none. The network of the provider has public addresses.	⚠️ The origin has none. The cloud of the provider has public addresses.
Provider lock-in	✅ SNAPs of different providers in a federated network.	✅ Many products to choose from.	⚠️ Many WAF products. A scrubbing service is a single provider.	❌ Single provider, difficult to change.	❌ Single provider, difficult to change.
Client software	✅ None for app and browser users. A VPN client for network access.	⚠️ A VPN client on each device.	✅ None.	✅ None for web access. An agent for network access.	❌ Usually an agent on each device.
Path control	✅ SCION paths are visible and selectable.	❌ No control over the path.	❌ No control over the path.	❌ No control over the path.	❌ No control over the path.
Primary weakness	New technology. Needs SNAP coverage where the users are.	The public concentrator is a constant target.	Reactive. Reachable by everyone. Can block legitimate users.	All traffic goes through one provider.	Agents on each device. All traffic goes through one provider.

GATE or PathGuard?

Anapaya GATE and Anapaya PathGuard both make a service invisible to the public Internet. They differ in who can reach the service:

• Anapaya GATE limits the reach of a service to selected networks. All users in the networks of the selected GATE providers can reach the service. The users need no software and no credentials for the network access.
• Anapaya PathGuard limits the reach of a service to authorized users. Each user or device must authenticate before it gets a path to the service. The users can be in any network with SNAP coverage.

Use GATE when the users of a service are in known networks, for example the customers of a bank in one country, and the users must not change anything. Use PathGuard when only authorized users or devices must reach the service, wherever they are.

Both products can protect e-banking. With GATE, the customers in the networks of the selected GATE providers reach the service with no change. With PathGuard, the bank adds the SCION SDK to its app or the PathGuard Web SDK to its web application, and PathGuard authenticates each customer, wherever the customer is.