- Updated: March 18, 2026
- 7 min read
Switzerland adopts SCION: A Secure Alternative to BGP
SCION is a next‑generation, secure internet routing architecture that Switzerland has deployed as a BGP alternative for its finance sector, offering multi‑path routing, cryptographic path validation, and isolation domains that together deliver millisecond‑level failover and true digital sovereignty.
Why Switzerland Is Betting on SCION as the Future BGP Alternative
For more than four decades the Border Gateway Protocol (BGP) has been the glue that holds the global Internet together. Its design prioritized speed and scalability, not security. The result is a system that can be hijacked, leaked, or silently rerouted by nation‑state actors. Switzerland’s finance industry, which settles roughly 220 billion Swiss francs daily, could no longer afford those risks. The answer was digital sovereignty powered by SCION – a protocol that rewrites the routing foundation instead of patching it.
What Is SCION? A Brief Technical Overview
SCION (Scalability, Control, and Isolation on Next‑generation networks) was conceived at ETH Zürich by Professor Adrian Perrig. Unlike incremental fixes such as RPKI or BGPsec, SCION replaces the routing core with three interlocking mechanisms:
- Multi‑path routing: Hundreds of parallel paths are established between any two endpoints. If one path fails, traffic is switched in under 150 ms—faster than human perception.
- Isolation Domains (ISDs): Trust roots are scoped to regions, countries, or organizations. A compromise in one ISD cannot cascade to another, eliminating the “single point of global trust” problem.
- Cryptographic path validation: Every router signs the packets it forwards. Receivers can verify that the packet travelled exactly along the advertised path.
These features give network operators control over the path their data takes, a capability that BGP fundamentally lacks.
Real‑World Deployment: The Secure Swiss Finance Network (SSFN)
In 2017, SIX Group—operator of the Swiss Stock Exchange—and the Swiss National Bank (SNB) began a joint pilot of SCION. Their goal was to replace the aging Finance IPNet, a 20‑year‑old MPLS backbone that could not guarantee the millisecond‑level resilience required for inter‑bank settlement.
The resulting Secure Swiss Finance Network (SSFN) went live in November 2021. Its architecture mirrors SCION’s three pillars:
- Multiple carrier paths are provisioned simultaneously. During a controlled carrier shutdown test, traffic switched in under one millisecond—the network never missed a beat.
- ISDs were defined for each participating bank, the SNB, and the network operator. Short‑lived certificates (valid for three days) enable rapid revocation if a participant misbehaves.
- Every hop signs the packet, allowing end‑to‑end verification that no rogue ISP intercepted the flow.
Since its launch, the SSFN has settled 220 billion CHF per day without a single outage attributable to routing failures. The old Finance IPNet is now being decommissioned, marking the first large‑scale retirement of a legacy BGP‑based financial backbone.
Challenges and Adoption Barriers Outside Switzerland
Despite the Swiss success story, SCION has not yet achieved global traction. The primary obstacles are:
1. Standardization Gap
BGP is an IETF standard; SCION currently lives in an informational RFC outside the formal standardization track. Enterprises often wait for a mature standard before committing to a new protocol, fearing divergent implementations.
2. Chicken‑and‑Egg Network Effect
Network operators are reluctant to be early adopters because the perceived benefits—sub‑millisecond failover and cryptographic guarantees—are not yet “pain points” for many. As long as BGP “just works,” the incentive to switch remains low.
3. Vendor Concentration
Today, Anapaya is the sole commercial vendor offering a production‑grade SCION stack. Large incumbents such as Cisco have publicly stated they will only invest if the market reaches a multi‑billion‑dollar scale, creating a classic catch‑22.
4. Governance Overhead
Running an ISD requires a bespoke trust‑root configuration and a dedicated certificate authority. SIX built its own CA because no external CA would accept the liability of issuing short‑lived certificates for a sovereign finance network. Replicating that governance model demands legal, operational, and technical resources that many organizations lack.
These barriers are not technical flaws; they are ecosystem dynamics that any next‑generation internet architecture must navigate.
Implications for Global Network Security and Digital Sovereignty
SCION’s design directly addresses three trends that dominate today’s security discourse:
- State‑level routing attacks: By cryptographically binding each hop, SCION makes large‑scale hijacks—like the 2021 SolarWinds incident—practically impossible without compromising every router on the path.
- Regional trust autonomy: ISDs enable countries to define their own root of trust, reducing reliance on U.S.‑based certificate authorities and aligning with the European digital sovereignty agenda.
- Resilience for critical infrastructure: Financial services, health care, and energy grids can meet regulatory “sub‑second recovery” requirements without costly over‑provisioning of redundant links.
In practice, a multinational corporation could deploy SCION in its European data centers while retaining BGP for legacy connections, achieving a hybrid model that balances risk and compatibility.
Getting Started: Practical Steps for Decision‑Makers
For technology leaders evaluating SCION, the following roadmap can accelerate proof‑of‑concepts:
- Assess critical traffic flows: Identify applications (e.g., inter‑bank settlement, health‑record exchange) where sub‑millisecond failover is a regulatory or business requirement.
- Engage a pilot partner: Companies like Enterprise AI platform by UBOS have experience integrating SCION‑compatible APIs into existing cloud stacks.
- Leverage existing tooling: Use the Workflow automation studio to orchestrate certificate issuance and path‑validation checks.
- Run a controlled failover test: Simulate carrier loss and measure recovery time. SCION should demonstrate sub‑150 ms switchover.
- Document governance: Define ISD membership rules, certificate lifetimes, and revocation processes before scaling.
By following this structured approach, organizations can mitigate the “governance overhead” barrier while gaining concrete performance data to justify broader adoption.
How UBOS Accelerates SCION Adoption
UBOS offers a suite of tools that simplify the integration of SCION into modern SaaS environments:
- Web app editor on UBOS – Build UI front‑ends that can query SCION‑enabled routing APIs without writing low‑level code.
- UBOS templates for quick start – Deploy pre‑configured SCION gateway containers in minutes.
- AI marketing agents – Automate compliance reporting for routing policies using generative AI.
- UBOS pricing plans – Flexible consumption‑based pricing that aligns with pilot budgets.
- UBOS partner program – Co‑sell SCION‑enabled solutions with certified partners worldwide.
These capabilities reduce the time‑to‑value for enterprises that want to experiment with SCION without building a custom stack from scratch.
Looking Ahead: Will SCION Become the New Internet Backbone?
Professor Perrig predicts that within three to five years SCION will be embedded in the core networking libraries of major operating systems, making it invisible to developers but omnipresent in the data plane. Early adopters in the Benelux region already report commercial contracts that specify SCION connectivity as a “must‑have” security clause.
However, widespread adoption still hinges on two catalysts:
- Regulatory pressure: If governments mandate cryptographic path validation for critical infrastructure, SCION will become a compliance baseline.
- High‑profile routing attacks: A single, large‑scale BGP hijack that disrupts financial markets could shift the risk‑vs‑cost calculus in favor of SCION.
Until those triggers materialize, the Swiss finance network remains the most compelling proof point that a BGP alternative can operate at scale, securely and profitably.
Conclusion: Secure Routing Is No Longer a Luxury
SCION demonstrates that a fundamentally redesigned routing protocol can deliver the security, sovereignty, and resilience that modern digital economies demand. For technology decision‑makers, the lesson is clear: waiting for BGP to be “fixed” is no longer viable. Instead, explore pilot deployments, leverage platforms like UBOS homepage, and position your organization at the forefront of the next‑generation internet architecture.
Ready to start a SCION pilot? Contact our partner program today and discover how UBOS can accelerate your journey toward a truly secure network.
For the original reporting, see the article on The Register.