Interdomain Routing and Games

1
Interdomain Routing and Games

• Michael Schapira
• Joint work with Hagay Levin
• and Aviv Zohar

??????????? ?????? ????????
The Hebrew University of Jerusalem
2
The Agenda

• An introduction to interdomain routing (a
  networking approach).
• A Distributed Algorithmic Mechanism Design (DAMD)
  perspective (an economic approach).
• Our Results
• A formulation of interdomain routing as a game.
• Realistic settings in which BGP is immune to
  rational manipulations.

3
An Introduction to Interdomain Routing (A
Networking Approach)
4
Interdomain Routing

• Establish routes between Autonomous Systems
  (ASes).
• Currently done only by the Border Gateway
  Protocol (BGP).

5
Why is Interdomain Routing Hard?

• Route choices are based on local policies.
• Expressiveness Policies are complex.
• Autonomy Policies are uncoordinated

Always chooseshortest paths.
Load-balance myoutgoing traffic.
Avoid routes through ATT ifat all possible.
My link to UUNET is forbackup purposes only.
6
Interdomain Routing

• Routes to every destination AS are computed
  independently.
• There is an AS graph GltN,Lgt.
• N consists of n source nodes 1,,n and a
  destination node d.
• L represents physical links between ASes.

7
Interdomain Routing

• Every source-node i is defined by a valuation
  function vi that assigns a non-negative value to
  each (simple) route from i to d.
• The computation performed by a single node is an
  infinite sequence of stages

8
Interdomain Routing

• The route assignment reached by BGP forms a
  confluent routing tree rooted in d.
• Routes are consistent (route choices depend on
  neighbours choices).
• Routes are loop-free (nodes announce full
  routes).
• The final route assignment is stable.
• Every node prefers its assigned route over any
  other available route.

9
Example of Stability
Prefer routes through 1
1
2
1, my route is 2d
Prefer routes through 2
2, Im available
1, Im available
d
10
Assumptions on the Network

• The network is asynchronous.
• Nodes can be activated in different timings.
• Update messages can be arbitrarily delayed along
  selective links.
• Network malfunctions are possible.
• Link and node failures.

11
BGP

• Pros
• Nodes need have no a-priori knowledge about the
  network topology or about other nodes.
• The protocol is adaptive to changes in network
  topology (link and node failures).
• .
• Cons
• The lack of global coordination might result in
  persistent route oscillations (protocol
  divergence).

12
Example of Instability Oscillation
2, my route is 1d
Prefer routes through 1
BGP might oscillateforever between 1d,
2d and 12d, 21d
1
2
Prefer routes through 2
1, my route is 2d
1, 2, Im the destination
d
13
The Hardness of Stability

• Theorem Determining whether a stable
  solution exists is NP-Hard. Griffin-Wilfong
• Theorem Determining whether a stable
  solution exists requires exponential
  communication between the source-nodes.
• Independent of the P-NP assumption.
• Communication complexity is linear in the size
  of the local preferences of nodes.

14
Guaranteeing Robust Convergence

• Networking researchers seek constraints that
  guarantee BGP stability (for any timing, even in
  the presence of network malfunctions).
  Balakrishnan, Feamster, Gao, Griffin, Jaggard,
  Johari, Ramachandran, Rexford, Shepherd,
  Sobrinho, Wilfong,
• A realistic and well known set of such
  constraints are the Gao-Rexford constraints.
• The Internet is formed by economic forces.
• ASes sign long-term contracts that determine who
  provides connectivity to whom.

15
Gao-Rexford Framework

• Neighboring pairs of ASes have one of
• a customer-provider relationship(One node is
  purchasing connectivity fromthe other node.)
• a peering relationship(Nodes have offered to
  carry each otherstransit traffic, often to
  shortcut a longer route.)

peer
providers
peer
customers
16
Dispute Wheels

• If BGP oscillates, the valuation functions and
  the topology of the network induce a structure
  called a Dispute Wheel. Griffin-Shepherd-Wilfong
  
• The absence of a Dispute Wheel ensures robust BGP
  convergence.
• The Gao-Rexford constraints are a special case of
  No Dispute Wheel. Gao-Griffin-Rexford

17
Dispute Wheels

• A Dispute Wheel
• A sequence of nodes ui and routes Ri, Qi.
• ui prefers RiQi1 over Qi.

18
Example of a Dispute Wheel
Prefer routes through 1
1
2
Prefer routes through 2
d
19
A DAMD Perspective (An Economic Approach)
20
Do Nodes Always Adhere to the Protocol?

• BGP was designed to guarantee connectivity
  between trusted and obedient parties.
• The commercial Internet ASes are owned by
  economic and often competing entities.
• Might deviate from BGP if it suits their
  interests.

21
Two Research Agendas

• Security research
• Malicious nodes.
• Cyptographic modifications of BGP (S-BGP)
• Distributed Algorithmic Mechanism Design
  Feigenbaum-Papadimitriou-Shenker
• Rational nodes.
• Seeks realistic conditions for which BGP is
  incentive-compatible. Feigenbaum-Papadimitriou-Sa
  mi-Shenker

22
Our Results
23
Our Main Results

• A novel game-theoretic model of interdomain
  routing.
• A surprising connection between the two research
  agendas (security and DAMD).
• Theorem (bad news) BGP is not
  incentive-compatible even if No Dispute Wheel
  holds.
• Theorem (good news) Cryptographic modifications
  of BGP (e.g., S-BGP) are incentive-compatible if
  No Dispute Wheel holds (no monetary transfers).

24
Interdomain RoutingGames
25
A Static Game

• The source-nodes are the strategic agents (their
  valuation functions define their types).
• Each source-node chooses an outgoing edge.
• Choices are simultaneous.
• A nodes payoff is
• vi(R) if the route R from i to d is induced by
  the nodes choices.
• 0 otherwise.

26
A Static Game

• A pure Nash equilibrium is a set of nodes
  choices from which no node wishes to unilaterally
  deviate.
• Pure Nash equilibria stable routing outcomes

Prefer routes through 1
1
2
Prefer routes through 2
d
27
The Convergence Game

• The game consists of an infinite number of
  rounds.
• A node that is activated in a certain round can
  perform the following actions
• Read update messages announcing routes.
• Send update messages announcing routes.
• Choose a neighbouring node to forward traffic to.

28
The Convergence Game

• There exists an adversarial entity called the
  scheduler that is in charge of
• Deciding which nodes are activated in each round.
• Delaying update messages along selective links.
• Removing links and nodes from the AS graph.
• Informally, a nodes strategy is its choice of a
  routing protocol.
• Executing BGP is a strategy.

29
The Convergence Game

• A route is said to be stable if from some round
  onwards every node on the route forwards traffic
  to the next-hop node on that route.
• The payoff of node i from the game is
• vi(R) if there is a route R from i to d which is
  stable.
• 0 otherwise.

30
BGP and Incentives

• A node is said to deviate from BGP (or to
  manipulate BGP) if it does not follow BGP.
• What forms of manipulation are available to
  nodes?
• Misreporting preferences.
• Reporting inconsistent information.
• Announcing nonexistent routes.
• Denying routes.

31
BGP and Incentives

• Two possible incentive-related requirements
  from BGP
• Incentive-compatibility No unilateral deviation
  from BGP by an AS can strictly improve the
  routing outcome of that AS.
• Collusion-proofness No deviation from BGP by
  coalitions of ASes of any size can strictly
  improve the routing outcome of even a single AS
  in the coalition without strictly harming another
  Feigenbaum-S-Shenker.

32
Knowledge Assumptions
no knowledge assumptions
An ex-post Nash equilibrium Im better
offfollowing the protocol as long as everyone
else does(no knowledge assumptions on network
topology, nodes true preferences, message
timings, ).Shneidman-Parkes
knowledge
omniscient agents
33
About the Convergence Game

• The game is complex.
• Multi-round.
• Asynchronous.
• Partial-information
• No monetary transfers!
• Very rare in mechanism design.
• Unlike most works on incentive-compatibility and
  interdomain routing
• More realistic.

34
Known Results
Valuations are policy consistentiff, for all
routes R1 and R2
R1
. . . .
k
i
d
. . .
THEN vi((i,k)R1) gt vi((i,k)R2)
R2
IF vk(R1) gt vk(R2)
(analogous toisotonicity Sob.03)
35
Known results

• Policy consistency is known to hold for
  interesting special cases
• Shortest-path routing.
• Next-hop policies.
• Theorem If No Dispute Wheel and Policy
  Consistency hold, then BGP is incentive-compatible
  , and even collusion-proof. Feigenbaum-Ramachandr
  an-S, Feigenbaum-S-Shenker

36
Known results

• A Problem Policy Consistency is unrealistic.
• Too strong.
• Can it be removed?

37
Realistic Settings in which BGP is
Incentive-Compatible and Collusion-Proof
38
Is BGP Incentive-Compatible?

• Theorem BGP is not incentive compatible even in
  Gao-Rexford settings.

39
Can we fix this?

• We define the following property
• Route verification means that an AS can verify
  that a route announced by a neighbouring AS is
  available.
• Route verification can be achieved via security
  tools (S-BGP etc.).
• Not an assumption on the nodes!

40
Does this solve the problem?

• Many forms of manipulation are still available
• Misreporting preferences over available routes.
• Reporting inconsistent information.
• Denying routes.

41
Our Main Results

• Theorem If the No Dispute Wheel condition
  holds, then BGP with route verification is
  incentive-compatible.
• Theorem If the No Dispute Wheel condition
  holds, then BGP with strong route verification is
  collusion-proof.

42
Dispute Wheels A Reminder

• A Dispute Wheel
• A sequence of nodes ui and routes Ri, Qi.
• ui prefers RiQi1 over Qi.

The Gao-Rexford constraints are a special case
of the No Dispute Wheel condition.
43
BGP with Route Verification

• Theorem If the No Dispute Wheel condition
  holds, then BGP with route verification is
  incentive-compatible.
• Proof (sketch)
• By contradiction.
• Assume that the No Dispute Wheel condition
  holds, and that BGP is not incentive-compatible.
• We present sequences of nodes and routes that
  form a dispute wheel.

44
Proof Sketch

• Let s be the manipulator.
• Let T be the routing tree reached if all nodes
  follow the protocol.
• Let M be the the routing tree reached after s
  rationally manipulates BGP.
• vs(Ms) gt vs(Ts)

45
Proof Sketch

• There must exist a node i on Ms such that Mi?Ti
• Let 1 be the node closest to d on Ms with this
  property.
• For each node i that is closer to d on Ms it
  holds that MiTi.
• This implies v1(T1) gt v1(M1)

s
Ms
1
Ts
d
46
Proof Sketch

• Similarly, Let 2 be the node i closest to d on T1
  such that Mi?Ti.
• This implies v2(M2) gt v2(T2)

s
Ms
1
Ts
M1
d
T1
T2
2
M2
47
Proof Sketch

• We choose 3,4,5, in asimilar manner.
• Eventually some nodewill appear twice (assume
  that this nodeis s).
• We have a dispute wheel!

s
Ms
1
Ts
M1
d
T1
T4
T2
M3
4
2
T3
M2
3
48
Proof Sketch

• Why do we need route verification?
• The manipulator can lie about its route.
• For instance, k might believe that ss route in M
  is Ls.
• Still,vs(Ms) gt vs(Ts) gt vs(Ls)

s
Ms
Mk
1
k
Ts
Tk
M1
d
T1
T4
T2
M3
4
2
T3
M2
3
49
BGP with Route Verification

• Theorem If the No Dispute Wheel condition
  holds, then BGP with route verification is
  collusion-proof.
• A Problem Is route verification achievable even
  in the presence many manipulators?

50
BGP is Socially Just

• Corollary If No Dispute Wheel holds, then BGP is
  Pareto optimal.
• Pareto optimality means that BGPs outcome is
  such that there is no other outcome that is
• Strictly preferred by one node.
• Weakly preferred by all other nodes.

51
What About Social-Welfare?

• The total social welfare of a routing outcome is
  the sum of values nodes assign to their routes
  ?i vi(Pi).
• No Dispute Wheel and Policy Consistency guarantee
  BGP convergence to a social-welfare maximizing
  solution. Feigenbaum-Ramachandran-S

52
Approximating Social Welfare

• Theorem Obtaining an
  approximation to the optimal social welfare is
  impossible unless PNP, even in Gao-Rexford
  settings.(Improvement on a bound achieved by
  Feigenbaum,Sami,Shenker)
• Theorem Exponential communication is required in
  order to achieve an approximation of
  to the social welfare.

53
Conclusions

• The main results
• Bad news BGP is not incentive-compatible even if
  No Dispute Wheel holds.
• Good news A modification of BGP (route
  verification) is incentive-compatible.
• Helps explain BGPs relative resilience to
  manipulations in practice.

54
Conclusions

• Our results should motivate research on
  guaranteeing route verification in the Internet.
• Wheres the justice?
• Bad news Social-welfare optimization might be
  hopeless.
• Good news BGP is Pareto optimal.

55
Follow Up Works

• Best-reply mechanisms (with Noam Nisan and Aviv
  Zohar)
• Extensions to more general game-theoretic
  settings.
• Work in progress (with Rahul Sami and Aviv Zohar)
• More on BGP convergence and selfishness.

56
Open Questions

• Characterizing robust BGP convergence (No
  dispute wheel is sufficient but not necessary).
• Does robust BGP convergence with route
  verification imply incentive compatibility?
• Can network formation games help explain the
  Internets commercial structure?

57
Open Questions

• Generalize the model to allow other forms of
  attacks Butler-Farley-McDaniel-Rexford

58
Thank You
59
A Negative Result for General Routing
ProtocolsorWhy Are Protocols Like BGP
Necessary?
60
A Negative Result for General Routing Protocols

• Why settle for a routing protocol that sometimes
  results in persistent route oscillations?
• Computational answer Determining whether a
  stable solution exists is NP hard.
• Economic answer (informal) No reasonable
  protocol that always deterministically chooses a
  route assignment is incentive-compatible.

61
A Negative Result for General Routing Protocols

• Theorem Fix an AS graph G. Let A be a routing
  protocol such that
• A deterministically chooses a route assignment
  for every set of valuation functions defined over
  G (for all timings).
• A has at least 3 possible routing outcomes.
• A is incentive-compatible.
• Then
• A is dictatorial (a specific node in G is always
  assigned its most preferred route by A).
• Proof By reduction from Gibbard-Satterthwaite.

62
Negative Result An Example
5
4

• This result holds even
• For centralized routing protocols.
• When the only form of rational manipulation
• available is misreporting preferences.

3
6
2
1
7
the dictator

• Node 1 always gets its most preferred route to
  d, and forces nodes on that route to route
  traffic accordingly.

d
63
BGP is Socially Just
64
BGP is Socially Just

• We require BGP to be socially just in some global
  sense.
• A natural approach Seek a setting in which BGP
  reaches a route assignment that maximizes the
  total social welfare.
• The total social welfare is the sum of values
  nodes assign their assigned routes ?i vi(Pi) .
• A Problem
• Even in the Gao-Rexford setting the stable route
  assignment reached by BGP can be arbitrarily far
  from the optimum. Feigenbaum-Ramachandran-S
• A strong additional assumption on the valuation
  functions is required. Feigenbaum-Ramachandran-Sc
  hapira

65
BGP is Socially Just

• Theorem If BGP convergence is guaranteed, then
  BGP is Pareto optimal.
• BGP is said to be Pareto optimal if
• Let Td be the route assignment reached by BGP.
• There is no route assignment Td such that
• There is a node that strictly prefers its route
  in Td over its route in Td.
• All other nodes weakly prefer their routes in Td
  over their routes in Td.

66
BGP is Socially Just

• Corollary The coalition that consists of all
  nodes has no rational motivation to deviate from
  BGP (without payments).
• Is that true for coalitions of any size?
• In particular, is it true that a unilateral
  deviation from BGP cannot benefit the deviating
  node?

NO!