Interdomain Routing and Games

1. Interdomain Routing and Games Michael Schapira Joint work with Hagay Levin and Aviv Zohar האוניברסיטה העברית בירושלים The Hebrew University of Jerusalem

2. The Agenda • An introduction to interdomain routing (a networking approach). • A Distributed Algorithmic Mechanism Design (DAMD) perspective (an economic approach). • Our Results: • A formulation of interdomain routing as a game. • Realistic settings in which BGP is immune to rational manipulations. • …

3. An Introduction to Interdomain Routing (A Networking Approach)

4. UUNET AT&T Comcast Qwest Interdomain Routing Establish routes between Autonomous Systems (ASes). Currently done only by the Border Gateway Protocol (BGP).

5. UUNET AT&T Comcast Qwest Why is Interdomain Routing Hard? • Route choices are based on local policies. • Expressiveness: Policies are complex. • Autonomy: Policies are uncoordinated Always chooseshortest paths. Load-balance myoutgoing traffic. Avoid routes through AT&T ifat all possible. My link to UUNET is forbackup purposes only.

6. Interdomain Routing • Routes to every destination AS are computed independently. • There is an AS graphG=<N,L>. • N consists of n source nodes 1,…,n and a destination node d. • L represents physical links between ASes.

7. receive routes from neighbours send updatesto neighbours choose“best” neighbour Interdomain Routing • Every source-node i is defined by a valuation function vi that assigns a non-negative value to each (simple) route from i to d. • The computation performed by a single node is an infinite sequence of stages:

8. Interdomain Routing • The route assignment reached by BGP forms a confluent routing tree rooted in d. • Routes are consistent (route choices depend on neighbours’ choices). • Routes are loop-free (nodes announce full routes). • The final route assignment is stable. • Every node prefers its assigned route over any other available route.

9. Example of Stability Prefer routes through 1 2 1 1, my route is 2d Prefer routes through 2 2, I’m available 1, I’m available d

10. Assumptions on the Network • The network is asynchronous. • Nodes can be activated in different timings. • Update messages can be arbitrarily delayed along selective links. • Network malfunctions are possible. • Link and node failures.

11. BGP Pros: • Nodes need have no a-priori knowledge about the network topology or about other nodes. • The protocol is adaptive to changes in network topology (link and node failures). • …. Cons: • The lack of global coordination might result in persistent route oscillations (protocol divergence).

12. Example of Instability: Oscillation 2, my route is 1d Prefer routes through 1 BGP might oscillateforever between 1d, 2d and 12d, 21d 2 1 Prefer routes through 2 1, my route is 2d 1, 2, I’m the destination d

13. The Hardness of Stability • Theorem: Determining whether a ``stable solution’’ exists is NP-Hard. [Griffin-Wilfong] • Theorem: Determining whether a ``stable solution’’ exists requires exponential communication between the source-nodes. • Independent of the P-NP assumption. • Communication complexity is linear in the “size” of the local preferences of nodes.

14. Guaranteeing Robust Convergence • Networking researchers seek constraints that guarantee BGP stability (for any timing, even in the presence of network malfunctions). [Balakrishnan, Feamster, Gao, Griffin, Jaggard, Johari, Ramachandran, Rexford, Shepherd, Sobrinho, Wilfong, …] • A realistic and well known set of such constraints are the Gao-Rexford constraints. • The Internet is formed by economic forces. • ASes sign long-term contracts that determine who provides connectivity to whom.

15. Gao-Rexford Framework Neighboring pairs of ASes have one of: • a customer-provider relationship(One node is purchasing connectivity fromthe other node.) • a peering relationship(Nodes have offered to carry each other’stransit traffic, often to shortcut a longer route.) peer providers peer customers

16. Dispute Wheels • If BGP oscillates, the valuation functions and the topology of the network induce a structure called a Dispute Wheel. [Griffin-Shepherd-Wilfong] • The absence of a Dispute Wheel ensures robust BGP convergence. • The Gao-Rexford constraints are a special case of “No Dispute Wheel”. [Gao-Griffin-Rexford]

17. Dispute Wheels • A Dispute Wheel: • A sequence of nodes ui and routes Ri, Qi. • ui prefers RiQi+1 over Qi.

18. 1 d 2 Example of a Dispute Wheel Prefer routes through 1 2 1 Prefer routes through 2 d

19. A DAMD Perspective (An Economic Approach)

20. Do Nodes Always Adhere to the Protocol? • BGP was designed to guarantee connectivity between trusted and obedient parties. • The commercial Internet: ASes are owned by economic and often competing entities. • Might deviate from BGP if it suits their interests.

21. Two Research Agendas • Security research • Malicious nodes. • Cyptographic modifications of BGP (S-BGP) • Distributed Algorithmic Mechanism Design [Feigenbaum-Papadimitriou-Shenker] • Rational nodes. • Seeks realistic conditions for which BGP is incentive-compatible. [Feigenbaum-Papadimitriou-Sami-Shenker]

22. Our Results

23. Our Main Results • A novel game-theoretic model of interdomain routing. • A surprising connection between the two research agendas (security and DAMD). • Theorem: (bad news): BGP is not incentive-compatible even if No Dispute Wheel holds. • Theorem: (good news): Cryptographic modifications of BGP (e.g., S-BGP) are incentive-compatible if No Dispute Wheel holds (no monetary transfers).

24. Interdomain RoutingGames

25. A Static Game • The source-nodes are the strategic agents (their valuation functions define their types). • Each source-node chooses an outgoing edge. • Choices are simultaneous. • A node’s payoff is: • vi(R) if the route R from i to d is induced by the nodes’ choices. • 0 otherwise.

26. A Static Game • A pure Nash equilibrium is a set of nodes’ choices from which no node wishes to unilaterally deviate. • Pure Nash equilibria = stable routing outcomes Prefer routes through 1 2 1 Prefer routes through 2 d

27. The Convergence Game • The game consists of an infinite number of rounds. • A node that is activated in a certain round can perform the following actions: • Read update messages announcing routes. • Send update messages announcing routes. • Choose a neighbouring node to forward traffic to.

28. The Convergence Game • There exists an adversarial entity called the scheduler that is in charge of: • Deciding which nodes are activated in each round. • Delaying update messages along selective links. • Removing links and nodes from the AS graph. • Informally, a node’s strategy is its choice of a routing protocol. • Executing BGP is a strategy.

29. The Convergence Game • A route is said to be stable if from some round onwards every node on the route forwards traffic to the next-hop node on that route. • The payoff of node i from the game is: • vi(R) if there is a route R from i to d which is stable. • 0 otherwise.

30. BGP and Incentives • A node is said to deviate from BGP (or to manipulate BGP) if it does not follow BGP. • What forms of manipulation are available to nodes? • Misreporting preferences. • Reporting inconsistent information. • Announcing nonexistent routes. • Denying routes. • …

31. BGP and Incentives Two possible incentive-related requirements from BGP: • Incentive-compatibility: No unilateral deviation from BGP by an AS can strictly improve the routing outcome of that AS. • Collusion-proofness: No deviation from BGP by coalitions of ASes of any size can strictly improve the routing outcome of even a single AS in the coalition without strictly harming another [Feigenbaum-S-Shenker].

32. About the Convergence Game • The game is complex. • Multi-round. • Asynchronous. • Partial-information • No monetary transfers! • Very rare in mechanism design. • Unlike most works on incentive-compatibility and interdomain routing • More realistic.

33. Known Results Valuations are policy consistentiff, for all routes R1 and R2 R1 . . . . k i d . . . THEN vi((i,k)R1) > vi((i,k)R2) R2 IF vk(R1) > vk(R2) (analogous toisotonicity [Sob.03])

34. Known results • Policy consistency is known to hold for interesting special cases: • Shortest-path routing. • Next-hop policies. • Theorem: If No Dispute Wheel andPolicy Consistency hold, then BGP is incentive-compatible, and even collusion-proof. [Feigenbaum-Ramachandran-S, Feigenbaum-S-Shenker]

35. Known results • A Problem: Policy Consistency is unrealistic. • Too strong. • Can it be removed?

36. Realistic Settings in which BGP is Incentive-Compatible and Collusion-Proof

37. m1d m12d m1d m12d 1 1 m m 12d 1d 12d 1d d d 2 2 2md 2d 2md 2d with manipulation without manipulation Is BGP Incentive-Compatible? • Theorem: BGP is not incentive compatible even in Gao-Rexford settings.

38. Can we fix this? • We define the following property: • Route verification means that an AS can verify that a route announced by a neighbouring AS is available. • Route verification can be achieved via security tools (S-BGP etc.). • Not an assumption on the nodes!

39. Does this solve the problem? • Many forms of manipulation are still available: • Misreporting preferences over available routes. • Reporting inconsistent information. • Denying routes. • …

40. Our Main Results • Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is incentive-compatible. • Theorem: If the “No Dispute Wheel” condition holds, then BGP with strong route verification is collusion-proof.

41. Dispute Wheels – A Reminder • A Dispute Wheel: • A sequence of nodes ui and routes Ri, Qi. • ui prefers RiQi+1 over Qi. The Gao-Rexford constraints are a special case of the “No Dispute Wheel” condition.

42. BGP with Route Verification • Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is incentive-compatible. • Proof(sketch): • By contradiction. • Assume that the “No Dispute Wheel” condition holds, and that BGP is not incentive-compatible. • We present sequences of nodes and routes that form a dispute wheel.

43. s Ms Ts d Proof Sketch • Let s be the manipulator. • Let T be the routing tree reached if all nodes follow the protocol. • Let M be the the routing tree reached after s rationally manipulates BGP. • vs(Ms)>vs(Ts)

44. M1 T1 Proof Sketch • There must exist a node i on Ms such that Mi≠Ti • Let 1 be the node closest to d on Ms with this property. • For each node i that is closer to d on Ms it holds that Mi=Ti. • This implies: v1(T1)>v1(M1) s Ms 1 Ts d

45. Proof Sketch • Similarly, Let 2 be the node i closest to d on T1 such that Mi≠Ti. • This implies: v2(M2)>v2(T2) s Ms 1 Ts M1 d T1 T2 2 M2

46. Tk k Mk Proof Sketch • We choose 3,4,5,… in asimilar manner. • Eventually some nodewill appear twice (assume that this nodeis s). • We have a dispute wheel! s Ms 1 Ts M1 d T1 T4 T2 M3 4 2 T3 M2 3

47. Ls Proof Sketch • Why do we need route verification? • The manipulator can lie about its route. • For instance, k might believe that s’s route in M is Ls. • Still,vs(Ms)>vs(Ts) >vs(Ls) s Ms Mk k 1 Ts Tk M1 d T1 T4 T2 M3 4 2 T3 M2 3

48. BGP with Route Verification • Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is collusion-proof. • A Problem: Is route verification achievable even in the presence many manipulators?

49. BGP is Socially Just • Corollary: If No Dispute Wheel holds, then BGP is Pareto optimal. • Pareto optimality means that BGP’s outcome is such that there is no other outcome that is: • Strictly preferred by one node. • Weakly preferred by all other nodes.

50. What About Social-Welfare? • The total social welfare of a routing outcome is the sum of values nodes assign to their routes = ∑ivi(Pi). • No Dispute Wheel and Policy Consistency guarantee BGP convergence to a social-welfare maximizing solution. [Feigenbaum-Ramachandran-S]