Anapaya PathGuard use cases

PathGuard protects services that a known group of users must reach and that are too critical to expose to the whole Internet. This page describes four use cases. In each of them, the organization operates its own hidden AS on Anapaya EDGE appliances, as the deployment model describes. Choosing components explains each component.

E-banking and payment backends

The problem: An e-banking web application must be reachable for all customers of the bank. Thus, it is also reachable for all attackers. It is a permanent target of DDoS attacks and scans. The DDoS protection and the web application firewall in front of it are also reachable, and they are targets too. A payment backend has the same problem: it must process the authorized transactions while attackers try to stop it.

The components:

• The e-banking backend is behind a PathGuard Web Gateway in the hidden AS of the bank.
• The identity provider of the bank is in a separate, public SCION AS. All customers can reach the identity provider, but only the authorized customers get a path to the backend. The identity provider can also be on the public Internet.
• The mobile banking app and the payment application use the SCION SDK.
• The e-banking web application uses the PathGuard Web SDK. Customers use their usual browser and their usual login. They install nothing.
• The bank pays for the SCION connectivity of its customers with a sponsored subscription.

The Hidden Segment Directory (HSD) gives the hidden path segments to the application only after the customer logs in at the identity provider of the bank. From login to response describes the steps.

Customers log in at the identity provider in a public SCION AS. Then the mobile app and the browsers reach the e-banking backend through the Web Gateway. The attacker finds no path to the hidden AS.

Secure remote access

The problem: A traditional VPN concentrator has a public IP address. Attackers scan it all the time, and vulnerabilities in VPN software are a frequent way into corporate networks.

The components:

• A PathGuard VPN Gateway in the hidden AS replaces the public VPN concentrator.
• Employees use the PathGuard VPN Client on their laptops and phones.

The enterprise enrolls its employees with its identity provider, for example Microsoft Entra ID:

1. The employee opens the PathGuard VPN Client and logs in with the corporate account.
2. The identity provider confirms the identity of the employee and gives the claims of the employee, for example the group membership.
3. The Anapaya AA service maps the claims to the sponsored subscription of the enterprise. The client can then connect to the SCION Internet.
4. The Hidden Segment Directory (HSD) compares the claims with the access policy of the hidden AS. If the policy allows the employee, the HSD gives the hidden path segments to the client.
5. The client builds the tunnel to the VPN Gateway.

The enterprise does not distribute keys to the devices. When an employee leaves the enterprise, the administrator disables the account in the identity provider, and the employee loses the access.

The enterprise can also use client credentials instead of the identity provider, for example a client certificate on each managed laptop. Then the enterprise distributes the certificates and revokes the certificate of a lost device.

Employees reach the internal network through the VPN Gateway in the hidden AS. The VPN Gateway has no public address that an attacker can scan.

Telemedicine

The problem: A diagnostics provider operates a platform for doctors, patients, and connected medical devices. The platform holds health data under strict privacy rules. Many user groups must reach it, but no one else can reach it.

The components:

• The platform is behind a PathGuard Web Gateway. Patients use the mobile app of the platform, which uses the SCION SDK. Doctors and patients can also use the web platform with the PathGuard Web SDK in their browsers.
• Doctors and patients log in at an identity provider in a separate, public SCION AS. Another organization can operate this identity provider, for example an identity service of the health sector.
• Medical devices connect to the platform through a PathGuard VPN Gateway with the PathGuard VPN Client. The devices authenticate with client credentials, for example a client certificate or an API key.
• The access policy of the hidden AS allows only the authenticated doctors, patients, and devices.

Patients and doctors log in at the identity provider and use the mobile app or the web platform. Medical devices use VPN tunnels. All reach the platform in the hidden AS. Other parties find no path.

IoT backends

The problem: Attackers scan the Internet for IoT backends and exploit them on a large scale. One vulnerable backend can expose all field devices: sensors, meters, and industrial controllers.

The components:

• The IoT backend is behind a PathGuard VPN Gateway in the hidden AS.
• Each field device, or the router in front of it, runs the headless PathGuard VPN Client. The device authenticates with client credentials, for example a client certificate or an API key. Field devices have no user, so they do not use an identity provider.
• A device with its own software can use the SCION SDK instead. Then the backend also uses the SCION SDK, and the device connects to the backend without a gateway.

Field devices reach the IoT backend in the hidden AS. The attacker finds no path to the backend.