One network instead of many individual connections: Semax AG's path into the SSUN.
Semax AG operates a central SaaS platform, Amera HES, through which around 500,000 smart meters are managed. Sixty customers from the Swiss energy sector are connected – each currently via its own IPSec/VPN link. That's costly to operate and expands the attack surface with every new connection. Together with Cyberlink, Semax is therefore taking a different route: the Secure Swiss Utility Network (SSUN) replaces individual connections with a closed trust zone, fully isolated from the public internet. Semax has been an SSUN participant since November 2025, and the proof of concept has been successfully completed. The goal: an infrastructure where an energy provider connects once and can then reach all authorized market partners works and can be implemented with little effort.
Project Data
Solution / Services: SCION Access Service, SSUN connection, SCION EDGE (Anapaya), Managed Service
Connectivity Provider: Cyberlink AG
Technology: SCION (developed at ETH Zurich), Anapaya
Industry: Energy / Smart Metering
Customer: Semax AG, Cham (ZG) – Swiss smart metering specialist since 2011
Company size: 100+ employees, around 130 energy utilities as customers
Platform: Amera HES 2.0 (SaaS), around 500,000 smart meters, 60 connected customers via IPSec/VPN
SSUN participant since: November 6, 2025 (SSUN available since July 1, 2025)
Project status: operational
The Challenge
Amera HES manages around 500,000 smart meters. Sixty customers from the Swiss energy sector are connected to the platform – until now, each via its own IPSec/VPN connection. What works well with a handful of links becomes an operational challenge at 60: different firewall technologies, individual configurations, and effectively a separate project for every new connection. At the same time, the threat landscape is intensifying. Smart metering systems are becoming an increasingly attractive target, and DDoS attacks and zero-day vulnerabilities in VPN gateways are real risks. The public internet also offers no way to control which path data actually takes – path control and traceability are missing. On top of this comes regulation: mandatory reporting of cyberattacks, requirements for critical infrastructure, and growing data exchange with market partners – from the balance group to Swissgrid to the national data platform. Every additional interface increases both operational effort and attack surface. Semax was therefore not looking for another point solution, but for an answer that would hold up in the long term: a shared, secure infrastructure for the entire industry that reliably protects particularly sensitive components such as Amera HES and the key management system (KMS).
The Approach
The answer is SSUN – the Secure Swiss Utility Network. SSUN is an isolated, high-security network for the Swiss energy industry, built on the SCION architecture. It has been available since July 1, 2025, and Semax has been a participant since November 6, 2025. Cyberlink, as an approved provider, is responsible for the connection and operation. Instead of individual VPN links, all participants connect to SSUN once via a SCION EDGE. Within this closed isolation domain, only known, certified participants are reachable – the Amera HES platform is not visible from the public internet. Traffic runs over defined, verifiable paths, is encrypted end to end, and can be controlled geographically. This protects against DDoS attacks, BGP hijacking, and zero-day vulnerabilities in internet-facing gateways. This also changes the operating logic: a new market partner is connected once and is then reachable via defined paths for all authorized SSUN participants. What used to be a network project per connection becomes a simple authorization. The benefit grows with the number of participants: the more energy providers, platform providers, and service providers join SSUN, the more connections can be covered through a single connection.
Current Status
Semax and Cyberlink used a proof of concept to successfully test the interplay between Amera HES and SSUN, the connection process for an energy provider, and day-to-day operation. On this basis, a standardized procedure was developed that allows further customers to connect without a separate project. Energy providers who want to route their connection to Amera HES via SSUN in the future can already get in touch – the earlier they do, the more directly their requirements can be incorporated into the process.
Roles in the Project
Cyberlink AG
- Contract and contract management
- SCION EDGE including Anapaya licensing
- SSUN connection and technical implementation
- Managed Service and operations
Semax AG
- Advising energy providers
- Supporting commissioning
- Prerequisites at the energy provider
- 1U of rack space for the SCION EDGE
- IT contact person involvement during commissioning
"With Amera HES, we operate critical infrastructure. Every additional VPN connection increased our complexity – and our attack surface along with it. SSUN turns that logic around: our participants connect once and can then reach every authorised partner over defined, controlled paths. Cyberlink supported us pragmatically and reliably, from the initial consulting through to commissioning."
Daniel Limacher | Product and Sales Specialist, Semax AG
The Approach in Brief
- Closed trust zone: SSUN completely isolates communication from the public internet – the Amera HES platform is not reachable from outside.
- Encryption out of the box: Secure connections between market partners are part of the infrastructure and don't need to be explicitly set up per link, across different firewall types.
- Path control instead of flying blind: Defined, verifiable, and geographically controllable data paths – resistant to DDoS attacks and BGP hijacking.
- Reduced attack vector: A controlled infrastructure replaces 60 individual VPN/MPLS connections using different technologies.
- Connect once, use many times: New market partners and services can be integrated without a separate network project.
- Lower operating costs: Fewer individual connections mean less configuration effort, fewer sources of error, and a noticeable reduction in IT workload.
- Protection for critical components: Amera HES and the KMS gain an additional layer of protection exactly where an incident would have the greatest impact.
- Regulatorily sound: Security is a legal requirement – SSUN provides the shared infrastructure to meet these requirements on an ongoing basis.
With SSUN, Semax has created a foundation that grows with the industry: the more energy providers, platform providers, and service providers take part, the greater the benefit for everyone involved.
Further Links
Learn more about Cyberlink's SCION solutions:
Semax AG
Semax AG, headquartered in Cham, has been the Swiss smart metering specialist since 2011. Over 100 employees develop and manufacture the Ensor smart meters in Switzerland and operate Amera HES 2.0, a certified head-end system available as SaaS. Around 130 energy utilities are among its customers.
Semax AG