SCION Control Plane

SCION Control Plane SCION Association

cdk@scion.org

SCION Association

matzf@scion.org

SCION Association

nic@scion.org

Internet-Draft This document describes the control plane of the path-aware, inter-domain network architecture SCION (Scalability, Control, and Isolation On Next-generation networks). One of the basic characteristics of SCION is that it gives path control to SCION-capable endpoints. In fact, endpoints can choose between multiple path options, enabling the optimization of network paths. The SCION control plane is responsible for discovering these paths and making them available to the endpoints. The main goal of SCION's control plane is to create and manage path segments, which can then be combined into forwarding paths to transmit packets in the data plane. This document first discusses how path exploration is realized through beaconing and how path segments are created and registered. Each SCION autonomous system (AS) can register segments according to its own policy - it is free to specify which path properties and algorithm(s) to use in the selection procedure. The document then describes the path lookup process, where endpoints obtain path segments - a fundamental building block for the construction of end-to-end paths. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Source for this draft and an issue tracker can be found at .

Introduction The SCION control plane is responsible for discovering path segments and making them available to endpoints. This process includes path exploration, registration, and lookup. This section explains the basic concepts of the control plane in SCION and introduces SCION's routing concept. As SCION is an inter-domain network architecture, it only deals with inter-domain routing. One feature of SCION is the decoupling of inter-domain routing from endpoint addressing. This Introduction section provides a description of the SCION addressing system in more detail. Note: It is assumed that readers of this draft are familiar with the basic concepts of the SCION next-generation inter-domain network architecture. If not, please find more detailed information in the IETF Internet Drafts , , and , as well as in , especially Chapter 2. A short description of the SCION basic terms and elements can be found in below.

Terminology Autonomous System (AS): An autonomous system is a network under a common administrative control. For example, the network of an Internet service provider, company, or university can constitute an AS. Beaconing: The control-plane process where an AS discovers paths to other ASes. Control Plane: The SCION control plane is responsible for the propagation and discovery of network paths, i.e., for the exchange of routing information between network nodes. The control plane thus determines where traffic can be sent and deals with questions such as how paths are discovered, which paths exist, what quality individual links offer, etc. Within a SCION AS, such functionalities are carried out by the control service. Packet forwarding is instead a task pertaining to the data plane. Control Service: The control service is the main control-plane infrastructure component within a SCION AS. It is responsible for the path exploration and registration processes that take place within the control plane. Core AS: Each isolation domain (ISD) is administered by a set of distinguished autonomous systems (ASes) called core ASes, which are responsible for initiating the path-discovery and -construction process (in SCION called "beaconing"). Endpoint: An endpoint is the start- or the endpoint of a SCION path. For example, an endpoint can be a host as defined in , or a gateway bridging a SCION and an IP domain. This definition is based on the definition in . Forwarding Path: A forwarding path is a complete end-to-end path between two SCION hosts, which is used to transmit packets in the data plane and can be created with a combination of up to three path segments (an up-segment, a core-segment, and a down-segment). Hop Field (HF): As they traverse the network, path-segment construction beacons (PCBs) accumulate cryptographically protected AS-level path information in the form of hop fields. In the data plane, hop fields are used for packet forwarding: they contain the incoming and outgoing interface IDs of the ASes on the forwarding path. Info Field (INF): Each path-segment construction beacon (PCB) contains a single info field, which provides basic information about the PCB. Together with hop fields (HFs), info fields are used to create forwarding paths. Isolation Domain (ISD): In SCION, autonomous systems (ASes) are organized into logical groups called isolation domains or ISDs. Each ISD consists of ASes that span an area with a uniform trust environment (i.e., a common jurisdiction). A possible model is for ISDs to be formed along national boundaries or federations of nations. Leaf AS: An AS at the "edge" of an ISD, with no other downstream ASes. Packet-Carried Forwarding State (PCFS): Rather than relying on costly inter-domain forwarding tables, SCION data packets contain all the necessary path information. We refer to this property as packet-carried forwarding state or PCFS. Path Segment: Path segments are derived from path-segment construction beacons (PCBs) and registered at control services. A path segment can be (1) an up-segment (i.e., a path between a non-core AS and a core AS in the same ISD), (2) a down-segment (i.e., the same as an up-segment, but in the opposite direction), or (3) a core-segment (i.e., a path between core ASes). Up to three path segments can be used to create a forwarding path. Path-Segment Construction Beacon (PCB): Core ASes generate PCBs to explore paths within their isolation domain (ISD) and among different ISDs. ASes further propagate selected PCBs to their neighboring ASes. As a PCB traverses the network, it carries path segments, which can subsequently be used for traffic forwarding. Trust Root Configuration (TRC): A trust root configuration or TRC is a signed collection of certificates pertaining to an isolation domain (ISD). TRCs also contain ISD-specific policies.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Paths and Links SCION routers and endpoints connect to each other via links. A SCION path between two endpoints essentially traverses one or more links. In SCION, autonomous systems (ASes) are organized into logical groups called isolation domains or ISDs. Each ISD consists of ASes that span an area with a uniform trust environment (i.e., a common jurisdiction). An ISD is administered by a set of distinguished ASes called core ASes. Within and between ISDs, SCION supports three types of links: (1) core links, (2) parent-child links, and (3) peering links.

A core link always connects two core ASes, which are either within the same or in a different ISD. Core links can exist for various underlying business relationships, including provider-customer (where the customer pays the provider for traffic) and peering relationships.
Parent-child links create a hierarchy between the parent and the child. ASes with a parent-child link typically have a provider-customer relationship.
Peering links exist between ASes with a (settlement-free or paid) peering relationship. Peering links can only be used to reach destinations within or downstream of the peering AS. They can be established between any two core or non-core ASes, and between core and non-core ASes. Peering links can also cross ISD boundaries.

The following figure shows the three types of links for one small ISD with the two core ASes A and C, and the four non-core ASes D,E,F, and G.

The three types of SCION links in one ISD peering link .-0-. .-0-. ( D )< - - - >( E ) `-#-' `-#-' | | | | | | .-0-. .-0-. ( G ) ( F ) `---' `---' ]]> Each link connecting SCION routers is bidirectional and identified by its corresponding egress and ingress interface IDs. These interface IDs only need to be unique within each AS. Therefore, they can be chosen and encoded by each AS independently and without any need for coordination.

Routing SCION provides path-aware inter-domain routing between ASes across the Internet. The SCION control plane is responsible for discovering these inter-domain paths and making them available to the endpoints within the ASes. SCION inter-domain routing operates on two levels: Within a SCION isolation domain (ISD), which is called intra-ISD routing, and between ISDs, called inter-ISD routing. Both levels use the so-called path-segment construction beacons (PCBs) to explore network paths. A PCB is initiated by a core AS and then disseminated either within an ISD to explore intra-ISD paths, or among core ASes, to explore core paths across different ISDs. The PCBs accumulate cryptographically protected path and forwarding information on AS-level, and store this information in the form of hop fields. Endpoints use information from these hop fields to create end-to-end forwarding paths for data packets, who carry this information in their packet headers. This concept is called packet-carried forwarding state. The concept also supports multi-path communication among endpoints. The creation of an end-to-end forwarding path consists of the following processes:

Path exploration (or beaconing): This is the process where an AS discovers paths to other ASes. See also .
Path registration: This is the process where an AS selects a few PCBs, according to defined policies, turns the selected PCBs into path segments, and adds these path segments to the relevant path infrastructure, thus making them available to other ASes. See also .
Path resolution: This is the process of actually creating an end-to-end forwarding path from the source endpoint to the destination. For this, an endpoint performs (a) a path lookup step, to obtain path segments, and (b) a path combination step, to combine the forwarding path from the segments. This last step takes place in the data plane. See also .

All processes operate concurrently. below shows the SCION routing processes and their relation to each other.

SCION routing processes and their relation to each other. All processes operate concurrently | Registration | +-------------------------+ +-----------+-------------+ | +---------------+ | +------------------------v------------------------+ | Path Resolution | | | | +----------------+ +----------------+ | | | Lookup +------>| Combination | | | | | | (Data Plane)| | | +----------------+ +----------------+ | +-------------------------------------------------+ ]]> The control service is responsible for the path exploration and registration processes in the control plane. It is the main control-plane infrastructure component within each SCION AS. The control service of an AS has the following tasks:

Generating, receiving, and propagating PCBs. Periodically, the control service of a core AS generates a set of PCBs, which are forwarded to the child ASes or neighboring core ASes. In the latter case, the PCBs are sent over policy-compliant paths to discover multiple paths between any pair of core ASes.
Selecting and registering the set of path segments via which the AS wants to be reached.
Managing certificates and keys to secure inter-AS communication. Each PCB contains signatures of all on-path ASes. Every time the control service of an AS receives a PCB, it validates the PCB's authenticity. When the control service lacks an intermediate certificate, it can query the control service of the neighboring AS that sent the PCB.

Note: The control service of an AS must not be confused with a border router. The control service of a specific AS is part of the control plane and responsible for finding and registering suitable paths. It can be deployed anywhere inside the AS. A border router belongs to the data plane; its main task is to forward data packets. Border routers are deployed at the edge of an AS.

Path Segments As described previously, the main goal of SCION's control plane is to create and manage path segments, which can then be combined into forwarding paths to transmit packets in the data plane. SCION distinguishes the following types of path segments:

A path segment from a non-core AS to a core AS is an up-segment.
A path segment from a core AS to a non-core AS is a down-segment.
A path segment between core ASes is a core-segment.

So each path segment either ends at a core AS, or starts at a core AS, or both. Note: There are no SCION path segments that start and end at a non-core AS. However, when combining path segments into an end-to-end SCION path, it is possible to use peering links. For more information on SCION and peering links, see . All path segments are invertible: A core-segment can be used bidirectionally, and an up-segment can be converted into a down-segment, or vice versa, depending on the direction of the end-to-end path. This means that all path segments can be used to send data traffic in both directions.

Addressing The inter-domain SCION routing is based on the <ISD, AS> tuple. Although a complete SCION address is composed of the <ISD, AS, endpoint address> 3-tuple, the endpoint address is not used for inter-domain routing or forwarding. The endpoint address can be of variable length, does not need to be globally unique, and can thus be an IPv4, IPv6, or MAC address, for example - in fact, the endpoint address is the "normal", currently used, non-SCION-specific endpoint address. However, the ISD-AS number is a SCION-specific number. It consists of 64-bits, with the top 16 bits indicating the ISD, and the bottom 48 bits indicating the AS. The text representation uses a dash-separator between the ISD and AS numbers, for example: 4-ff00:1:f. This section provides more details about the numbering scheme for SCION ISD and AS numbers. Note: As a consequence of the fact that SCION relies on existing routing protocols (e.g., IS-IS, OSPF, SR) and communication fabric (e.g., IP, MPLS) for intra-domain forwarding, existing internal routers do not need to be changed to support SCION.

ISD Numbers An ISD number is the 16-bit global identifier for an ISD. It MUST be globally unique. The following table gives an overview of the ISD number allocation. ISD number allocations

ISD	Description
0	The wildcard ISD.
1 - 15	Reserved for documentation and sample code (analogous to ).
16 - 63	Private use (analogous to ). Can be used for testing and private deployments.
64 - 4094	Public ISDs. Should be allocated in ascending order, without gaps and "vanity" numbers.
4095 - 65535	Reserved for future use.

A suitable mechanism to globally coordinate the assignation of ISD numbers does not yet exist. However, we hope that in the future an organization such as ICANN or a regional Internet registry (e.g., RIPE NCC) will take on the responsibility of assigning ISD and AS numbers. Currently, ISD numbers are allocated by Anapaya, the Swiss-based provider of SCION-based networking software and solutions.

AS Numbers An AS number is the 48-bit identifier for an AS. SCION inherits the existing 32-bit AS numbers from RFC4893, but provides an extended 48-bit space, allowing for additional SCION-only AS numbers beyond the 32-bit space in use today.

Formatting The default formatting for AS numbers in SCION is very similar to IPv6 (see ). It uses a 16-bit colon-separated lower-case hex encoding with leading 0's omitted: 0:0:0 to ffff:ffff:ffff. In SCION, the following rules apply:

The :: zero-compression feature of IPv6 is NOT allowed. The feature has very limited use in a 48-bit address space and would only add more complexity.
In order to provide easy comparison with BGP AS numbers, any AS number in the BGP AS range should be represented as decimal. This is especially relevant for display representation. For example, if a program receives the AS number 0:1:f, it should display the number as "65551".
A range of AS numbers can be shortened with a notation similar to the one used for CIDR IP ranges (). For example, the range of the lowest 32-bit AS numbers (0-4294967295) can be represented as 0:0:0/16.

The next table gives an overview of the AS number allocation. AS number allocations

AS	Size	Description
0	1	The wildcard AS
1-4294967295	~4.3 bill.	32-bit BGP AS numbers, formatted as decimal. If a BGP AS deploys SCION, it has the same AS number for both BGP and SCION.¹
`1:0:0`	1	Reserved
`2:0:0/16`	~4.3 bill.	Public SCION-only ASes (i.e., ASes that are created for SCION, and are no existing BGP ASes). They should be allocated in ascending order, without gaps and "vanity" numbers.
`ff00:0:0/32`	65535	Reserved for documentation and test/sample code (analogous to ).
`ff00:0:0/24`	~16.8 mill.	Reserved for private use (analogous to ). These numbers can be used for testing/private deployments.
`ffff:ffff:ffff`	1	Reserved

1) Some 32-bit AS numbers are reserved for special purposes. For more details, see "IANA: Special-Purpose Autonomous System (AS) Numbers". The rest of the space is currently unallocated.

Wildcard Addressing SCION allows endpoints to use wildcard addresses in the control-plane routing, to designate any core AS, e.g., to place requests for core- or down-segments during path lookup. These wildcard addresses are of the form I-0, to designate any AS in ISD I. Here, "0" is the wildcard for the AS. For more information, see .

Avoiding Circular Dependencies and Partitioning A secure and reliable routing architecture must be designed specifically to avoid circular dependencies during network initialization. One goal of SCION is that the Internet can start up even after large outages or attacks, in addition to avoiding cascades of outages caused by fragile interdependencies. This section lists the concepts SCION uses to prevent circular dependencies.

Neighbor-based path discovery: Path discovery in SCION is performed by the beaconing mechanism. In order to participate in this process, an AS only needs to be aware of its direct neighbors. As long as no path segments are available, communicating with the neighboring ASes is possible with the one-hop path type, which does not rely on any path information. SCION uses these one-hop paths to propagate PCBs to neighboring ASes to which no forwarding path is available yet. The One-Hop Path Type will be described in more detail in the SCION Data Plane specification (this document will be available later this year).
Path segment types: SCION uses different types of path segments to compose end-to-end paths. Notably, a single path segment already enables intra-ISD communication. For example, a non-core AS can reach the core of the local ISD simply by using an up-segment fetched from the local path storage, which is populated during the beaconing process.
Path reversal: In SCION, every path is reversible—i.e., the receiver of a packet can reverse the path in the packet header to send back a reply packet without having to perform a path lookup.
Availability of certificates: In SCION, every entity is required to be in possession of all cryptographic material (including the ISD's Trust Root Configuration TRC and certificates) that is needed to verify any message it sends. This (together with the path reversal) means that the receiver of a message can always obtain all this necessary material by contacting the sender.
Note: For a detailed description of a TRC and more information on the availability of certificates and TRCs, see the SCION Control-Plane PKI Internet-Draft .

Partition and Healing Besides inter-dependencies, another threat to the Internet is network partition. Partition occurs when one network is split into two because of a link failure. However, partition of the global SCION inter-domain network is much less likely to happen: During normal operation, the full network fabric is available, offering multiple paths between all ASes. Even during failures there is no special failure mode required, as SCION-enabled ASes could always switch to otherwise unused links. Recovering (also called healing) from a partitioned network is also seamless, as only coarse time synchronization between the partitions is required to resume normal operation and move forward with updates of the cryptographic material.

Communication Protocol All communication between the control services in different ASes is expressed in terms of gRPC remote procedure calls (for details, see ). Service interfaces and messages are defined in the Protocol Buffer "proto3" interface definition language (for details, see ). Note: The details of how gRPC is mapped to the SCION data plane will be described in a separate document.

Path Exploration or Beaconing

Introduction and Overview Path exploration is the process where an AS discovers paths to other ASes. In SCION, this process is referred to as beaconing. This section gives a detailed explanation of the SCION beaconing process. In SCION, the control service of each AS is responsible for the beaconing process. The control service generates, receives, and propagates so-called path-segment construction beacons (PCBs) on a regular basis, to iteratively construct path segments. PCBs contain topology and authentication information, and can also include additional metadata that helps with path management and selection. The beaconing process itself is divided into routing processes on two levels, where inter-ISD or core beaconing is based on the (selective) sending of PCBs without a defined direction, and intra-ISD beaconing on top-to-bottom propagation.

Inter-ISD or core beaconing is the process of constructing path segments between core ASes in the same or in different ISDs. During core beaconing, the control service of a core AS either initiates PCBs or propagates PCBs received from neighboring core ASes to other neighboring core ASes. Core beaconing is periodic; PCBs are sent over policy-compliant paths to discover multiple paths between any pair of core ASes.
Intra-ISD beaconing creates path segments from core ASes to non-core ASes. For this, the control service of a core AS creates PCBs and sends them to the non-core child ASes (typically customer ASes). The control service of a non-core child AS receives these PCBs and forwards them to its child ASes, and so on. This procedure continues until the PCB reaches an AS without any customer (leaf AS). As a result, all ASes within an ISD receive path segments to reach the core ASes of their ISD.

On its way, a PCB accumulates cryptographically protected path- and forwarding information per traversed AS. At every AS, metadata as well as information about the AS's ingress and egress interfaces are added to the PCB.

Peering Links PCBs do not traverse peering links. Instead, peering links are announced along with a regular path in a PCB. If both ASes at either end of a peering link have registered path segments that include this specific peering link, then it is possible to use this peering link during segment combination to create the end-to-end path.

Extending a PCB Every propagation period (as configured by the AS), the control service

selects the best combinations of PCBs and interfaces connecting to a neighboring AS (i.e., a child AS or a core AS), and
sends each selected PCB to the selected egress interface(s) associated with it.

For every selected PCB and egress interface combination, the AS extends the PCB by adding a so-called AS entry to the selected PCB. Such an AS entry includes a hop field that specifies the incoming (ingress) and outgoing (egress) interface for the packet forwarding through this AS, in the beaconing direction. The AS entry can also contain peer entries.

For the specification of one PCB, see
For more details on selecting PCBs, see
For more details on propagating PCBs, see

PCB Propagation - Illustrated Examples The following three figures show how intra-ISD PCB propagation works, from the ISD's core AS down to child ASes. For the sake of illustration, the interfaces of each AS are numbered with integer values. In below, core AS X sends the two different PCBs "a" and "b" via two different links to child AS Y: PCB "a" leaves core AS X via egress interface "2", whereas PCB "b" is sent over egress interface "1". Core AS X adds the respective egress information to the PCBs when sending them off, as can be seen in the figure (the entries "Core - Out:2" and "Core - Out:1", respectively).

Intra-ISD PCB propagation from the ISD core to child ASes - Part 1 AS Y receives the two PCBs "a" and "b" through two different (ingress) interfaces, namely "2" and "3", respectively (see below). Additionally, AS Y forwards to AS Z four PCBs that were previously sent by core AS X. For this, AS Y uses the two different (egress) links "5" and "6". AS Y extends the four PCBs with the corresponding ingress and egress interface information. As can be seen in the figure, AS Y also has two peering links to its neighboring peers V and W, through the interfaces "1" and "4", respectively - AS Y includes this information in the PCBs, as well. Thus, each forwarded PCB cumulates path information on its way "down" from core AS X.

Intra-ISD PCB propagation from the ISD core to child ASes - Part 2 The following figure shows how the four PCBs "c", "d", "e", and "f", coming from AS Y, are received by AS Z over two different links: PCBs "c" and "e" reach AS Z over ingress interface "5", whereas PCBs "d" and "f" enter AS Z via ingress interface "1". Additionally, AS Z propagates PCBs "g", "h", "i", and "j" further down, all over the same link (egress interface "3"). AS Z extends the PCBs with the relevant information, so that each of these PCBs now includes AS hop entries from core AS X, AS Y, and AS Z.

Intra-ISD PCB propagation from the ISD core to child ASes - Part 3 Based on the figures above, one could say that a PCB represents a single path segment. However, there is a difference between a PCB and a (registered) path segment. A PCB is a so-called "travelling path segment" that accumulates AS entries when traversing the Internet. A (registered) path segment, instead, is a "snapshot" of a travelling PCB at a given time T and from the vantage point of a particular AS A. This is illustrated by . This figure shows several possible path segments to reach AS Z, based on the PCBs "g", "h", "i", and "j" from above. It is up to AS Z to use all of these path segments or just a selection of them.

Possible up- or down-segments for AS Z

Path-Segment Construction Beacons (PCBs) This section provides a detailed specification of a single PCB and its message format. Note: The SCION open-source implementation makes use of Protobuf (Protocol Buffers), a free and open-source cross-platform data format developed by Google and used to serialize structured data. The messages and remote procedure calls described below are in "proto3" language. For more information on Protobuf, see the official "Protocol Buffers Documentation".

Components of a PCB in Message Format graphically represents the PCB message format:

Top-down composition of one PCB The following sections provide detailed specifications of the PCB messages, starting with the top-level message of one PCB, and then diving deeper into each of the PCB's message components. Note: For a full example of one PCB in the Protobuf message format, please see .

PCB Top-Level Message Format Each PCB at least consists of:

An information field with an identifier and a timestamp.
Entries of all ASes on the path segment represented by this PCB.

The following code block defines the PCB on top level in Protobuf message format.

segment_info: This field is used as input for the PCB signature. It is the encoded version of the component SegmentInformation, which provides basic information about the PCB. The SegmentInformation component is specified in detail in .
as_entries: Contains the ASEntry component of all ASes on the path segment represented by this PCB.
- ASEntry: The ASEntry component contains the complete path information of a specific AS that is part of the path segment represented by the PCB. The ASEntry component is specified in detail in .

Segment Information Each PCB MUST include an information component with basic information about the PCB. In the Protobuf message format, the information component of a PCB is called the SegmentInformation message. The following code block shows the Protobuf message definition for the SegmentInformation message.

timestamp: The 32-bit timestamp indicates the creation time of this PCB. It is set by the originating core AS. The expiration time of the corresponding path segment is computed relative to this timestamp. The timestamp is encoded as the number of seconds elapsed since the POSIX Epoch (1970-01-01 00:00:00 UTC).
segment_id: The 16-bit identifier of this PCB and the corresponding path segment. The segment ID is required for the computation of the message authentication code (MAC) of an AS's hop field. The MAC is used for hop field verification in the data plane. The originating core AS MUST fill this field with a cryptographically random number.

Note: See for more information on the hop field message format. The SCION Data Plane Specification provides a detailed description of the computation of the MAC and the verification of the hop field in the data plane.

AS Entry Beside the basic information component, each PCB MUST also contain the entries of all ASes included in the corresponding path segment. This means that the originating core AS MUST add its AS entry to each PCB it creates. During the beaconing process, also each traversed AS MUST attach its AS entry to the PCB. One AS entry contains the complete hop information for this specific AS in this specific path segment. It consists of a signed and an unsigned component. The code block below defines an AS entry ASEntry in Protobuf message format. It includes the following components:

SignedMessage: The signed component of an AS entry. For the specification of this part of the AS entry, see below.
PathSegmentUnsignedExtensions: The unsigned and thus unprotected part of the AS entry. These are extensions with metadata that need no explicit protection.

AS Entry Signed Component Each AS entry of a PCB MUST include a signed component as well as a signature computed over the signed component. Each AS entry MUST be signed with a private key that corresponds to the public key certified by the AS's certificate. This section specifies the signed component of an AS entry. The signed component of an AS entry MUST include the following elements:

a header,
a body, and
a signature.

In the Protobuf message-format implementation, the signed component of an AS entry is specified by the SignedMessage. It consists of a header-and-body part (header_and_body) and a raw signature (signature). See also the code block below. The following code block shows the low-level representation of the HeaderAndBodyInternal message used for signature computation input. This message should not be used by external code.

For the specification of the signed header, see .
For the specification of the signed body, see .
For the specification of the signature field, see .

AS Entry Signed Header The header part defines metadata that is relevant to (the computation and verification of) the signature. It MUST at least include the following metadata:

The algorithm to compute the signature
The identifier of the public key used to verify the signature (i.e., the public key certified by the AS's certificate)
The ISD-AS number of the AS

The following code block defines the signed header of an AS entry in Protobuf message format (called the Header message).

signature_algorithm: Specifies the algorithm to compute the signature.
verification_key_id: Holds the serialized data defined by the VerificationKeyID message type. The VerificationKeyID message contains more information that is relevant to signing and verifying PCBs and other control-plane messages. The VerificationKeyID message type includes the following fields (see also the above code block):
- isd_as: The ISD-AS number of the current AS.
- subject_key_id: Refers to the certificate that contains the public key needed to verify this PCB's signature.
- trc_base: Defines the base number of the latest Trust Root Configuration (TRC) available to the signer at the time of the signature creation.
- trc_serial: Defines the serial number of the latest TRC available to the signer at the time of the signature creation.

Note: For more information on signing and verifying control-plane messages (such as PCBs), see the chapter Signing and Verifying Control-Plane Messages of the SCION Control-Plane PKI Specification . For more information on the TRC base and serial number, see the chapter Trust Root Configuration Specification of the SCION Control-Plane PKI Specification .

timestamp: Defines the signature creation timestamp. This field is optional.
metadata: Can be used to include arbitrary per-protocol metadata. This field is optional.
associated_data_length: Specifies the length of associated data that is covered by the signature, but is not included in the header and body. The value of this field is zero, if no associated data is covered by the signature.

AS Entry Signed Body The body of an AS entry consists of the signed component ASEntrySignedBody of all ASes in the path segment represented by the PCB, up until and including the current AS. The following code block defines the signed body of one AS entry in Protobuf message format (called the ASEntrySignedBody message).

isd_as: The ISD-AS number of the AS that created this AS entry.
next_isd_as: The ISD-AS number of the downstream AS to which the PCB should be forwarded.
hop_entry: The hop entry (HopEntry) with the information required to forward this PCB through the current AS to the next AS. This information is used in the data plane. For a specification of the hop entry, see .
peer_entries: The list of optional peer entries (PeerEntry). For a specification of one peer entry, see .
mtu: The size of the maximum transmission unit (MTU) within the current AS's network.
extensions: List of (signed) extensions (optional). PCB extensions defined here are part of the signed AS entry. This field should therefore only contain extensions that include important metadata for which cryptographic protection is required. For more information on PCB extensions, see .

AS Entry Signature Each AS entry is signed with a private key K_i that corresponds to the public key certified by the AS's certificate. The signature Sig_i of an AS entry ASE_i is computed over the AS entry's signed component. This is the input for the computation of the signature:

The signed header and body of the current AS (header_and_body).
The segment_info component of the current AS. This is the encoded version of the SegmentInformation component containing basic information about the path segment represented by the PCB. For the specification of SegmentInformation, see .
The signed header_and_body/signature combination of each previous AS on this specific path segment.

The signature Sig_i of an AS entry ASE_i is now computed as follows: Sig_i = K_i( SegInfo || ASE₀^(signed) || Sig₀ || ... || ASE_i-1^(signed) || Sig_i-1 || ASE_i^(signed) ) The signature metadata minimally contains the ISD-AS number of the signing entity and the key identifier of the public key that should be used to verify the message. For more information on signing and verifying control-plane messages, see the chapter "Signing and Verifying Control-Plane Messages" of the SCION Control-Plane PKI Specification . The following code block shows how the signature input is defined in the SCION Protobuf implementation ("ps" stands for path segment). Note that the signature has a nested, onion-like structure.

Hop Entry Each body of an AS entry MUST contain exactly one hop entry component. The hop entry component specifies forwarding information for the data plane. The data plane requires this information to create the hop through the current AS (in the direction of the beaconing). The following code block defines the hop entry component HopEntry in Protobuf message format:

hop_field: Contains the authenticated information about the ingress and egress interfaces in the direction of beaconing. The data plane needs this information to forward packets through the current AS. For further specifications, see .
ingress_mtu: Specifies the maximum transmission unit (MTU) of the ingress interface of the current AS.

Hop Field The hop field, part of both hop entries and peer entries, is used directly in the data plane for packet forwarding: It specifies the incoming and outgoing interfaces of the ASes on the forwarding path. To prevent forgery, this information is authenticated with a message authentication code (MAC). The following code block defines the hop field component HopField in Protobuf message format:

ingress: The 16-bit ingress interface identifier (in the direction of the path construction, that is, in the direction of beaconing through the current AS).

Note: For the AS that initiates the PCB, the ingress interface identifier MUST NOT be specified. This initiating AS is a core AS.

egress: The 16-bit egress interface identifier (in the direction of beaconing).
exp_time: The 8-bit encoded expiration time of the hop field, indicating how long the hop field is valid. This value is an offset relative to the PCB creation timestamp set in the PCB's segment information component (see also ). By combining these two values, the AS can compute the absolute expiration time of the hop field. Data-plane packets that use the hop field after the expiration time MUST be dropped.
mac: The message authentication code (MAC) used in the data plane to verify the hop field. The SCION Data Plane Specification provides a detailed description of the computation of the MAC and the verification of the hop field in the data plane.

Peer Entry By means of a peer entry, an AS can announce that it has a peering link to another AS. A peer entry is an optional component of a PCB - it is only included if there is a peering link to a peer AS. The following code block defines the peer entry component PeerEntry in Protobuf message format:

peer_isd_as: The ISD-AS number of the peer AS. This number is used to match peering segments during path construction.
peer_interface: The 16-bit interface identifier of the peering link on the peer AS side. This identifier is used to match peering segments during path construction.
peer_mtu: Specifies the maximum transmission unit MTU on the peering link.
hop_field: Contains the authenticated information about the ingress and egress interfaces in the current AS (coming from the peering link, in the direction of beaconing - see also ). The data plane needs this information to forward packets through the current AS. For further specifications, see .

Peer entry information, in the direction of beaconing

PCB Extensions In addition to basic routing information like hop entries and peer entries, PCBs can be used to communicate additional metadata, in its extensions. Extensions can be signed and unsigned. Signed extensions are protected by the AS signature, whereas unsigned extensions are not. On code-level and in Protobuf message format, extensions are specified as follows:

Unsigned extensions PathSegmentUnsignedExtensions are part of the AS entry component (the ASEntry message, see also ).
Signed extensions PathSegmentExtensions are part of the signed body component of an AS entry (the ASEntrySignedBody message, see also ).

Note: SCION also supports so-called "detachable extensions". The detachable extension itself is part of a PCB's unsigned extensions, but a cryptographic hash of the detachable extension data is added to the signed extensions. Thus, a PCB with a detachable extension can be signed and verified without actually including the detachable extension in the signature. This prevents a possible processing overhead caused by large cryptographically-protected extensions.

Propagation of PCBs This section describes how PCBs are selected and propagated in the path exploration process.

Selection of PCBs to Propagate As an AS receives a series of intra-ISD or core PCBs, it must select the PCBs it will use to continue beaconing. Each AS must specify a local policy on the basis of which PCBs are evaluated, selected or eliminated. The selection process can be based on path properties (e.g., length, disjointness across different paths) as well as on PCB properties (e.g., age, remaining lifetime of sent instances) - each AS is free to use those properties that suit the AS best. The control service can then compute the overall quality of each candidate PCB based on these properties. For this, the AS should use a selection algorithm or metric that reflects its needs and requirements and identifies the best PCBs or paths segments for this AS.

Storing and Selecting Candidate PCBs When receiving a PCB, an AS first stores the PCB in a temporary storage for candidate PCBs, called the beacon store. PCBs are propagated in batches to each connected downstream AS at a fixed frequency, the propagation interval. At each propagation event, each AS selects a set of the best PCBs from the candidates in the beacon store, according to the AS's selection policy. This set should have a fixed size, the best PCBs set size.

The best PCBs set size SHOULD be at most "50" (PCBs) for intra-ISD beaconing and at most "5" (PCBs) for core beaconing.

Note: Depending on the selection criteria, it may be necessary to keep more candidate PCBs than the best PCBs set size in the beacon store, to be able to determine the best set of PCBs. If this is the case, an AS should have a suitable pre-selection of candidate PCBs in place, in order to keep the beacon store capacity limited.

The propagation interval SHOULD be at least "5" (seconds) for intra-ISD beaconing and at least "60" (seconds) for core beaconing.

Note: Note that during bootstrapping and if the AS obtains a PCB containing a previously unknown path, the AS should forward the PCB immediately, to ensure quick connectivity establishment.

Selection Policy Example below illustrates the selection of path segments in three networks. Each network uses a different path property to select path segments.

The network at the upper left considers the path length, which is here defined as the number of hops from the originator core AS to the local AS. This number can give an indication of the path's latency. Based on this criterion, the network will select the PCB representing path segment A-G (in direction of beaconing) to propagate.
The network at the upper right uses peering links as the selection criterion, that is, the number of different peering ASes from all non-core ASes on the PCB or path segment: A greater number of peering ASes increases the likelihood of finding a shortcut on the path segment. Based on this criterion, the network will select the PCB representing path segment B-E-I-L (in direction of beaconing) to propagate.
The lower network selects PCBs based on disjointness. The disjointness of a PCB is calculated relative to the PCBs that have been previously sent. Paths can be either AS-disjoint or link-disjoint. AS-disjoint paths have no common upstream/core AS for the current AS, whereas link-disjoint paths do not share any AS-to-AS link. Depending on the objective of the AS, both criteria can be used: AS-disjointness allows path diversity in the event that an AS becomes unresponsive, and link-disjointness provides resilience in case of link failure. Based on the disjointness criterion, the network will select the PCBs representing the path segments A-D-G-H-J and C-E-F-I-J (in direction of beaconing) to propagate.

Example networks to illustrate path-segment selection based on different path properties.

Propagation of Selected PCBs As mentioned above, once per propagation period (determined by each AS), an AS propagates selected PCBs to its neighboring ASes. This happens on the level of both intra-ISD beaconing and core beaconing. This section describes both processes in more detail. To bootstrap the initial communication with a neighboring beacon service, ASes use so-called one-hop paths. This special kind of path handles beaconing between neighboring ASes for which no forwarding path may be available yet. In fact, it is the task of beaconing to discover such forwarding paths. The purpose of one-hop paths is thus to break this circular dependency. The One-Hop Path Type will be described in more detail in the SCION Data Plane specification.

Propagation - First Steps The following first steps of the propagation procedure are the same for both intra-ISD and core beaconing:

Upon receiving a PCB, the control service of an AS verifies the structure and all signatures on the PCB.
Note: The PCB contains the version numbers of the trust root configuration(s) (TRC) and certificate(s) that must be used to verify its signatures. This enables the control service to check whether it has the relevant TRC(s) and certificate(s); if not, they can be requested from the control service of the sending AS.
As core beaconing is based on sending PCBs without a defined direction, it is necessary to avoid loops during path creation. The control service of core ASes MUST therefore check whether the PCB includes duplicate hop entries created by the core AS itself or by other ASes. If so, the PCB MUST be discarded in order to avoid loops. Additionally, core ASes could forbid, that is, not propagate, beacons containing path segments that traverse the same ISD more than once. Note: Where loops must always be avoided, it is a policy decision to forbid ISD double-crossing. It can be legitimate to cross the same ISD multiple times: For example, if the ISD spans a large geographical area, a path transiting another ISD may constitute a shortcut. However, it is up to each core AS to decide whether it wants to allow this.
If the PCB verification is successful, the control service decides whether to store the PCB as a candidate for propagation based on selection criteria and polices specific for each AS. For more information on the selection process, see .

Propagation of PCBs in Intra-ISD Beaconing The propagation process in intra-ISD beaconing includes the following steps:

From the candidate PCBs stored in the beacon store, the control service of an AS selects the best PCBs to propagate to its downstream neighboring ASes, based on a selection algorithm specific for this AS.
The control service adds a new AS entry to every selected PCB. This AS entry MUST at least include:
- The ingress interface to this AS, in the hop field component.
- The egress interface to the neighboring AS, also in the hop field component.
- The ISD_AS number of the next AS, in the signed body component of the AS entry.
- If the AS has peering links, the control service should add corresponding peer entry components to the signed body of the AS entry; one peer entry component for each peering link that the AS wants to advertise. The hop field component of each added peer entry must have a specified egress interface.
The control service MUST now sign each selected, extended PCB and append the computed signature.
As a final step, the control service propagates each extended PCB to the correct neighboring ASes, by invoking the SegmentCreationService.Beacon remote procedure call (RPC) in the control services of the neighboring ASes (see also ).

Note:

For more information on the signed body component of an AS entry, see .
For more information on a peer entry, see .
For more information on the hop field component, see .
For more information on signing an AS entry, see .

Propagation of PCBs in Core Beaconing The propagation process in core beaconing includes the following steps:

The core control service selects the best PCBs to forward to neighboring core ASes observed so far.
The service adds a new AS entry to every selected PCB. This AS entry MUST at least include:
- The egress interface to the neighboring core AS, in the hop field component.
- The ISD_AS number of the neighboring core AS, in the signed body component of the AS entry.
The core control service MUST now sign the extended PCBs and append the computed signature.
As a final step, the service propagates the extended PCBs to the neighboring core ASes, by invoking the SegmentCreationService.Beacon remote procedure call (RPC) in the control services of the neighboring core ASes (see also ).

Propagation of PCBs in Protobuf Message Format The last step of the above described core and intra-ISD propagation procedures is implemented as follows in Protobuf message format: The propagation procedure includes the following elements:

SegmentCreationService: Specifies the service via which the extended PCB is propagated to the control service of the neighboring AS.
- Beacon: Specifies the method that calls the control service at the neighboring AS in order to propagate the extended PCB.
BeaconRequest: Specifies the request message sent by the Beacon method to the control service of the neighboring AS. It contains the following element:
- PathSegment: Specifies the path segment to propagate to the neighboring AS. For more information on the Protobuf message type PathSegment, see .
BeaconResponse: Specifies the response message from the neighboring AS.

Registration of Path Segments Path registration is the process where an AS transforms selected PCBs into path segments, and adds these segments to the relevant path databases, thus making them available to other ASes. As mentioned previously, a non-core AS typically receives several PCBs representing several path segments to the core ASes of the ISD the AS belongs to. Out of these PCBs, the non-core AS selects those down-path segments through which it wants to be reached, based on AS-specific selection criteria. The next step is to register the selected down-segments with the control service of the relevant core ASes, according to a process called intra-ISD path-segment registration. As a result, a core AS's control service contains all intra-ISD path segments registered by the non-core ASes of its ISD. In addition, each core AS control service also stores preferred core-path segments to other core ASes, in the core-segment registration process. Both processes are described below.

Intra-ISD Path-Segment Registration Every registration period (determined by each AS), the AS's control service selects two sets of PCBs to transform into two types of path segments:

Up-segments, which allow the infrastructure entities and endpoints in this AS to communicate with core ASes; and
down-segments, which allow remote entities to reach this AS.

The up- and down-segments do not have to be equal. An AS may want to communicate with core ASes via one or more up-segments that differ from the down-segment(s) through which it wants to be reached. Therefore, an AS can define different selection policies for the up- and down-segment sets. Also, the processes of transforming a PCB in an up-segment or a down-segment differ slightly. Both processes are described below.

Terminating a PCB Both the up- and down-segments end at the AS. One could therefore say that by transforming a PCB into a path segment, an AS "terminates" the PCB for this AS ingress interface and at this moment in time. The control service of a non-core AS must perform the following steps to "terminate" a PCB:

The control service adds a new AS entry to the PCB. This new AS entry MUST be defined as follows:
- The next AS MUST NOT be specified.
  - In Protobuf message format, this means that the value of the next_isd_as field in the ASEntrySignedBody component MUST be "0".
- The egress interface in the hop field component MUST NOT be specified.
  - In Protobuf message format, this means that the value of the egress field in the HopField component MUST be "0".
If the AS has peering links, the control service should add corresponding peer entry components to the signed body of the AS entry - one peer entry component for each peering link that the AS wants to advertise. The egress interface ID in the hop field component of each added peer entry MUST NOT be specified.
- In Protobuf message format, this means that the value of the egress field in the HopField component MUST be "0".
As a last step, the control service MUST sign the modified PCB and append the computed signature.

Note:

For more information on the signed body component of an AS entry, see .
For more information on a peer entry, see .
For more information on the hop field component, see .
For more information on signing an AS entry, see .

Transforming a PCB into an Up-Segment Every registration period, the control service of a non-core AS performs the following steps to transform PCBs into up-segments:

The control service selects the PCBs that it wants to transform into up-segments from the candidate PCBs in the beacon store.
The control service "terminates" the selected PCBs by performing the steps described in . From this moment on, the modified PCBs are called up-segments.
The control service now adds the newly created up-segments to its own path database.

Note: For more information on possible selection strategies of PCBs, see .

Transforming a PCB into a Down-Segment Every registration period, the control service of a non-core AS performs the following steps to transform PCBs into down-segments:

The control service selects the PCBs that it wants to transform into down-segments from the candidate PCBs in the beacon store.
The control service "terminates" the selected PCBs by performing the steps described in . From this moment on, the modified PCBs are called down-segments.
The control service now registers the newly created down-segments with the control services of the core ASes that originated the corresponding PCBs. This is done by invoking the SegmentRegistrationService.SegmentsRegistration remote procedure call (RPC) in the control services of the relevant core ASes (see also ).

Note: For more information on possible selection strategies of PCBs, see .

Core Path-Segment Registration The core beaconing process creates path segments from core AS to core AS. These core-segments are then added to the control service path database of the core AS that created the segment, so that local and remote endpoints can obtain and use these core-segments. In contrast to the intra-ISD registration procedure, there is no need to register core-segments with other core ASes (as each core AS will receive PCBs originated from every other core AS). In every registration period, the control service of a core AS performs the following operations:

The core control service selects the best PCBs towards each core AS observed so far.
The core control service "terminates" the selected PCBs by performing the steps described in . From this moment on, the modified PCBs are called core-segments.
As a final step, the control service adds the newly created core-segments to its own path database.

Note: For more information on possible selection strategies of PCBs, see .

Path-Segment Registration on Code-Level The control service of a non-core AS has to register the newly created down-segments with the control services of the core ASes that originated the corresponding PCBs. This registration step is implemented as follows in Protobuf message format: segments = 1; } message SegmentsRegistrationResponse {} ]]>

SegmentType: Specifies the type of the path segment that must be registered. Currently, only the following type is used:
- SEGMENT_TYPE_DOWN: Specifies a down-segment.
map<int32, Segments> segments: Represents a separate list of segments for each path segment type. The key is the integer representation of the corresponding SegmentType.

Path Lookup The path lookup is a fundamental building block of SCION's path management, as it enables endpoints to obtain path segments found during path exploration and registered during path registration. This allows the endpoints to construct end-to-end paths from the set of possible path segments returned by the path lookup process. The lookup of paths still happens in the control plane, whereas the construction of the actual end-to-end paths happens in the data plane.

Lookup Process An endpoint (source) that wants to start communication with another endpoint (destination), requires up to three path segments:

An up-path segment to reach the core of the source ISD (only if the source endpoint is a non-core AS),
a core-path segment to reach
- another core AS in the source ISD, in case the destination AS is in the same source ISD, or
- a core AS in a remote ISD, if the destination AS is in another ISD, and
a down-path segment to reach the destination AS.

Note: The actual number of required path segments depends on the location of the destination AS as well as on the availability of shortcuts and peering links. More information on combining and constructing paths will be provided by the SCION Data Plane Specification document. The process to look up and fetch path segments consists of the following steps:

First, the source endpoint queries the control service in its own AS (i.e., the source AS) for the required segments. The control service has up-path segments stored in its path database. Additionally, the control service checks if it has appropriate core- and down-path segments in store as well; in this case it returns them immediately.
If there are no appropriate core-segments and down-segments, the control service in the source AS queries the control services of the reachable core ASes in the source ISD, for core-path segments to core ASes in the destination ISD (which is either the own or a remote ISD). To reach the core control services, the control service of the source AS uses the locally stored up-path segments.
Next, the control service of the source AS combines up-path segments with the newly retrieved core-path segments. The control service then queries the control services of the remote core ASes in the destination ISD, to fetch down-path segments to the destination AS. To reach the remote core ASes, the control service of the source AS uses the previously obtained and combined up- and core segments.
Finally, the control service of the source AS returns all retrieved path segments to the source endpoint.
Once it has obtained all path segments, the endpoint combines them into an end-to-end path in the data plane.

below shows which control service provides the source endpoint with which type of path segment. Control services responsible for different types of path segments

Segment Type	Responsible control service(s)
Up-segment	Control service of the source AS
Core-segment	Control service of core ASes in source ISD
Down-segment	Control service of core ASes in destination ISD (either the local ISD or a remote ISD)

Sequence of Lookup Requests The overall sequence of requests to resolve a path should be as follows:

Request up-segments for the source endpoint at the control service of the source AS.
Request core-segments, which start at the core ASes that are reachable with up-segments, and end at the core ASes in the destination ISD. If the destination ISD coincides with the source ISD, this step requests core segments to core ASes that the source endpoint cannot directly reach with an up-segment.
Request down-segments starting at core ASes in the destination ISD.

Caching For the sake of efficiency, the control service of the source AS should cache each returned path segment request. Caching ensures that path lookups are fast for frequently used destinations. The use of caching is also essential to ensure that the path-lookup process is scalable and can be performed with low latency. In general, to improve overall efficiency, the control services of all ASes should do the following:

Cache the returned path segments.
Send requests in parallel when requesting path segments from other control services.

Behavior of Actors in the Lookup Process As described above, the source endpoint resolves paths with a sequence of segment requests to the control service of the source AS. The control service in the source AS answers directly, or forwards these requests to the responsible control services of core ASes. In SCION, the instances that handle these segment requests at the control services are called source AS segment-request handler and core AS segment-request handler, respectively. This section specifies the behavior of the segment-request handlers in the lookup process. First, the use of wildcards in the lookup process is briefly addressed.

Use of Wildcard Addresses in the Lookup Process Endpoints can use wildcard addresses to designate any core AS in path-segment requests. The segment-request handlers must expand these wildcard addresses and translate them into one or more actual addresses. below shows who is responsible for what. Note: For general information on the use of wildcard addresses in SCION, see . Use of wildcards in path segments requests

Segment Request	Wildcard Represents	Expanded/Translated By	Translated Into
Up-segment	"Destination" core AS (where up-segment ends)	Control service of the source AS	Actual address destination core AS in source ISD
Core-segment	Source core AS (where core-segment starts)¹	Control service of the source AS	Actual address source core AS in source ISD
Core-segment	Destination core AS (where core-segment ends)	Control service of the source core AS	Actual address destination core AS in destination ISD
Down-segment	"Source" core AS (where down-segment starts)²	Control service of the source AS	Actual address source core AS in destination ISD

1) Includes all core ASes for which an up-segment from the source AS exists.
2) Includes all core ASes in destination ISD with a down-segment to destination AS.

Segment-Request Handler of a Non-Core Source AS When the segment-request handler of the control service of a non-core source AS receives a path segment request, it MUST proceed as follows:

Determine the requested segment type.
In the case of an up-segment request, look up matching up-segments in the path database and return them.
In the case of a core-segment request from a source core AS to a destination core AS:
- Expand the source wildcard into separate requests for each reachable core AS in the source ISD.
- For each core-segment request,
  - If possible, return matching core-segments from cache;
  - otherwise, request the core-segments from the control services of each reachable core AS at the source (start) of the core-segment. Add the retrieved core-segments to the cache.
In the case of a down-segment request:
- Expand the source wildcard into separate requests for every core AS in the destination ISD (destination ISD refers to the ISD to which the destination endpoint belongs).
- For each segment request,
  - If possible, return matching down-segments from cache;
  - otherwise, request the down-segment from the control services of the core ASes at the source (start) of the down-segment. Sending the request may require looking up core-segments to the source core AS of the down-segment. Add the retrieved down-segments to the cache.

Segment-Request Handler of a Core AS When the segment-request handler of a core AS control service receives a path segment request, it MUST proceed as follows:

Validate the request:
- The source of the path segment must be this core AS.
- The request must either be
  - for a core-segment to a core AS in this ISD or another ISD, or
  - for a down-segment to an AS in this ISD.
If the destination is a core or wildcard address, then load matching core-segments from the path database and return.
Otherwise, load the matching down-segments from the path database and return.

shows by means of an illustration how the lookup of path segments in SCION works.

Security Considerations One of the fundamental objectives that guided the design of SCION is security, in particular network security. See chapter 7 of the SCION book (Security Analysis), which states the precise security goals of various network participants and how SCION achieves these goals in the presence of different types of adversaries . To be precised.

IANA Considerations TODO IANA considerations.

References Normative References Requirements for Internet Hosts - Communication Layers This RFC is an official specification for the Internet community. It incorporates by reference, amends, corrects, and supplements the primary protocol standards documents relating to hosts. [STANDARDS-TRACK] Key words for use in RFCs to Indicate Requirement Levels In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan This memo discusses the strategy for address assignment of the existing 32-bit IPv4 address space with a view toward conserving the address space and limiting the growth rate of global routing state. This document obsoletes the original Classless Inter-domain Routing (CIDR) spec in RFC 1519, with changes made both to clarify the concepts it introduced and, after more than twelve years, to update the Internet community on the results of deploying the technology described. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Autonomous System (AS) Number Reservation for Documentation Use To reduce the likelihood of conflict and confusion when relating documented examples to deployed systems, two blocks of Autonomous System numbers (ASNs) are reserved for use in examples in RFCs, books, documentation, and the like. This document describes the reservation of two blocks of ASNs as reserved numbers for use in documentation. This memo provides information for the Internet community. A Recommendation for IPv6 Address Text Representation As IPv6 deployment increases, there will be a dramatic increase in the need to use IPv6 addresses in text. While the IPv6 address architecture in Section 2.2 of RFC 4291 describes a flexible model for text representation of an IPv6 address, this flexibility has been causing problems for operators, system engineers, and users. This document defines a canonical textual representation format. It does not define a format for internal storage, such as within an application or database. It is expected that the canonical format will be followed by humans and systems when representing IPv6 addresses as text, but all implementations must accept and be able to handle any legitimate RFC 4291 format. [STANDARDS-TRACK] Autonomous System (AS) Reservation for Private Use This document describes the reservation of Autonomous System Numbers (ASNs) that are for Private Use only, known as Private Use ASNs, and provides operational guidance on their use. This document enlarges the total space available for Private Use ASNs by documenting the reservation of a second, larger range and updates RFC 1930 by replacing Section 10 of that document. Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. gRPC, an open-source universal RPC framework A Vocabulary of Path Properties Netflix ETH Zuerich Protocol Buffers Language Guide version 3 Informative References The Complete Guide to SCION ETH Zuerich ETH Zuerich ETH Zuerich Otto von Guericke University Magdeburg Anapaya Systems ETH Zuerich ETH Zuerich SCION Components Analysis SCION Association SCION Association SCION Control-Plane PKI SCION Association SCION Association SCION Overview SCION Association SCION Association ETH Zuerich

Acknowledgments Many thanks go to William Boye (Swiss National Bank), Juan A. Garcia Prado (ETH Zurich), Samuel Hitz (Anapaya), and Roger Lapuh (Extreme Networks) for reviewing this document. We are also very grateful to Adrian Perrig (ETH Zurich), for providing guidance and feedback about each aspect of SCION. Finally, we are indebted to the SCION development teams of Anapaya and ETH Zurich, for their practical knowledge and for the documentation about the SCION Control Plane, as well as to the authors of - the book is an important source of input and inspiration for this draft.

PCB Protobuf Messages - Full Example The following code block provides a full example of one PCB in the Protobuf message format.

Path-Lookup Examples To illustrate how the path lookup works, we show two path-lookup examples in sequence diagrams. The network topology of the examples is represented in below. In both examples, the source endpoint is in AS A. shows the sequence diagram for the path lookup process in case the destination is in AS D, whereas shows the path lookup sequence diagram if the destination is in AS G. ASes B and C are core ASes in the source ISD, while E and F are core ASes in a remote ISD. Core AS B is a provider of the local AS, but AS C is not, i.e., there is no up-segment from A to C. "CS" stands for controle service.

Topology used in the path lookup examples.

Sequence diagram illustrating a path lookup for a destination D in the source ISD. The request (core, x, x) is for all pairs of core ASes in the source ISD. Similarly, (down, x, D) is for down-segments between any core AS in the source ISD and destination D. +++ | | | |< -- -- -- -- -- -+++ | | | | reply (up,[A->B]) | | | | | | | | | | | | | | | | | | | |request (core,*,*) | | | | +----------------->+++ | | | | | |request (core,B,*) | | | | | +----------------->+++ | | | | |<-- -- -- -- -- --+++ | | | | | reply(core,[B->C])| | | |< -- -- -- -- -- -+++ | | | |reply (core,[B->C])| | | | | | | | | | | | | | |request (down,*,D) | | | | +----------------->+++ | | | | +-----+-+-----+ | | | | |send requests| | | | | | in parallel | | | | | +-----+-+-----+ | | | | | | | | | | | |request (down,B,D) | | | | | +----------------->+++ | | | | |<-- -- -- -- -- --+++ | | | | | reply(down,[B->D])| | | | | | | | | | | | |request (down,C,D) | | | | +-------------------+----------------->+++ | | | <-- -- -- -- -- -- -+ -- -- -- -- -- --+++ | | reply (down, | | | reply(down,[C->D])| | | [B->D, C->D]) | | | | | |< -- -- -- -- -- -+++ | | | | | | | +---+-+----------+ | | | |combine segments| | | | +---+-+----------+ | | | | | | | | +++ | | | | | | | +---+----+ +---+----+ +----+---+ +----+---+ +--------+ +--------+ +--------+ +--------+ ]]>