SCION: Secure Path-Aware Internet Routing for Critical Infrastructures#

Kevin Meynell (SCION Association)

• Why: SCION is the most mature "beyond BGP" routing architecture with real production deployment, and its trust model — cryptographic path validation with a standalone trust root rather than third-party CAs — sits right at the intersection of network security and the PM's identity/trust interests.
• What: SCION as an answer to BGP's fundamental limitation that operators have little control over where traffic transits: high resilience to routing attacks, explicit path selection, fast failover, geofencing (with a post-quantum angle), and comparison against RPKI, MPLS, SD-WAN, Segment Routing, and BGPSEC. The event page adds that it is supported by several UK-based ISPs including BT and Colt, and is in production in Swiss financial services, healthcare, and power utilities, with a vendor-neutral IETF specification in progress.
• How: A trust model built on logical groupings of networks ("trust domains"/ISDs) sharing a common jurisdiction and agreed trust policies, with a standalone trust root; traffic is exchanged only within a trust domain unless explicitly permitted, enabling sovereign networks and user/operator path selection.
• Where applicable: Initially critical infrastructure and regulated sectors (finance, healthcare, energy, defence) that need provable path control; requires SCION-capable connectivity, which in the UK is emerging via BT and Colt. Not a drop-in for commodity Internet operations, but relevant to any strategy discussion about trustworthy interconnect for critical workloads.