1 Incentive-Compatible Inter-Domain Routing Joan Feigenbaum Yale University Colloquium at Cornell University; October 2005 Joint work with Michael Schapira and Vijay Ramachandran

2 Inter-Domain Routing Establish routes between autonomous systems (ASes). Currently done with the Border Gateway Protocol (BGP). AT&T Qwest Comcast UUNET

3 Why is Inter-Domain Routing Hard? Route choices are based on local policies. Autonomy: Policies are uncoordinated. Expressiveness: Policies are complex. AT&T Qwest Comcast UUNET My link to UUNET is for backup purposes only. Load-balance my outgoing traffic. Always choose shortest paths. Avoid routes through AT&T if at all possible.

4 BGP-Route Processing Each AS has a routing table with routes to other nodes: Entire paths are stored (to prevent loops). Dest. AS Path AS3AS5AS1 AS7AS2 AS3AS2... The computation of a single node is an infinite sequence of stages: Receive routes from neighbors Update Table Choose “Best” Route Send updates to neighbors

5 Path-Vector Protocol Design Pros: –Route choices depend on neighbors’ choices. => enforces consistency –Best-route choices are made locally. => allows autonomy, expressiveness, … –Routes are loop free and can change with topology, without any node’s knowing the whole network. Cons: –Policy-induced routing anomalies => Routes may not be stable.

6 Example of Instability: Oscillation 1 2 d 3 Nodes oscillate forever between 1d, 2d, 3d and 12d, 23d, 31d Prefer routes through 2 Prefer routes through 3 Prefer routes through 1

7 Protocol Convergence A balance of local and global constraints on policies can assure robust convergence. [Gao, Rexford, Griffin, Wilfong, Shepherd, Sobrinho, Jaggard, Ramachandran, Feamster, Johari, Balakrishnan, … ] These results are concerned only with convergence to unique solutions. Recently, private information, optimization, and incentive-compatibility have also been studied in inter-domain routing.

8 Economic Mechanism Design Approach to designing systems for self-interested agents Truthful mechanisms: Regardless of what other agents do, each agent i maximizes her utility by revealing her true private information. Agent 1 Agent n Mechanism p1p1 pnpn tntn t1t1 a1a1 anan O Private information Strategies Payments Output

9 Welfare-Maximizing Routing AS 1 AS n Mechanism p1p1 pnpn v n (. ) v 1 (. ) a1a1 anan Private information: Route valuations Strategies Maximize sum of nodes’ valuations = ∑ i v i (R i ). A confluent routing tree and payments are computed in parallel for each destination. Source nodes are paid for their contribution to the routing tree. We want a BGP-style algorithm that computes routes and payments. Routes R 1, …, R n

10 Classes of Routing Policies Lowest-Cost Paths (LCP) Nodes’ private information is its own per-packet transit cost. Transit nodes are paid to carry transit traffic and reveal true costs. General Policy Routing Nodes’ private information is an unrestricted per-route valuation. Next-Hop Routing Nodes’ private information is a per-route valuation. Route valuations depend only on a route’s next hop. Subjective-Cost Routing Nodes’ private information is its perceived cost for every other AS. Cost of a route is the sum of source’s perceived transit costs. Forbidden-Set Routing Nodes’ private information is a set of ASes through which allocated routes are not allowed.

11 Known Results: Welfare Maximization and Inter-Domain Routing Routing-Policy Class Good Centralized Algorithm? Good Distributed Algorithm? LCP General Policy  (and hard to approximate) Next Hop  Subjective Cost  (incl. some special cases)  (approx. is easy if >1 tree) Forbidden Set 

12 Question These are mostly negative results. Is there a realistic and useful class of routing policies (i.e., something broader than LCPs) for which we can get a truthful mechanism and a good BGP-style algorithm?

13 General Approach Find a class of policies for which BGP converges to an optimal tree T (i.e., one that maximizes the sum of the valuations of all source nodes). Use VCG payment formula to ensure truthfulness, i.e., payment to node k is p k = ∑ i  k v i (T) – h k () where h k is a function that does not depend on node k’s valuation.

14 Dispute Cycles Relation 1: Subpath... R1R1 R2R2 R 1 R 2 Relation 2: Preference... Q1Q1 Q2Q2 v i (Q 1 ) > v i (Q 2 ) Q 1 Q 2 d d i i Valuations do not induce a dispute cycle iff there is no cycle formed by the above relations on all permitted paths in the network. No dispute cycle => robust convergence [GSW02, GJR03]

15 Example of a Dispute Cycle 1 2 d 3 v(12d) = 10 v(1d) = 5 v(23d) = 10 v(2d) = 5 v(31d) = 10 v(3d) = 5 1d1d2d2d3d3d 31d12d23d Dispute Cycle Subpath Preference

16 Policy Consistency..... d k i IF v k (R 1 ) > v k (R 2 ) R2R2 R1R1 THEN v i ((i,k)R 1 ) > v i ((i,k)R 2 ) Valuations are policy consistent iff, for all routes R 1 and R 2 (whose extensions are not rejected), (analogous to isotonicity [Sob.03])

17 Optimality and Payment Formula Theorem: If the valuation functions are policy consistent and do not induce a dispute cycle, then BGP computes optimal routes. Payment to node k: p k (T d ) = ∑ i ≠ k [v i (T d ) – v i (T d -k )] –T d is the optimal routing tree to destination d. –T d -k is the optimal tree to d avoiding node k. –This is the VCG formula, with h k ({v i }) = ∑ i ≠ k v i (T d -k ).

18 Computing Routes and Payments The “algorithm”: Run n+1 parallel instances of BGP on G, G -1, G -2, …, G -n. Result: optimal trees T d, T d -1, …, T d -n For all i, k, node i can compute a component of the payment to k: p k i (T d ) = v i (T d ) – v i (T d -k ). The total payment to node k can be broken down into these components: p k (T d ) = ∑ i ≠ k p k i (T d ).

19 Efficiently Computing Payments? Node optimality: In a globally optimal routing tree, every node gets its most valued (locally optimal) route. Theorem A: No dispute cycle + policy consistency => node optimality. Theorem B: Node optimality => If k is not on the path from i to d, then payment component p k i (T d ) = 0.

20 Lowest-Cost Paths (LCP) AS3AS5 c(i,1) AS1 c1c1 Dest.Cost LCP and Path Prices LCP cost AS1 Initially, all payments are set to . Then, each node runs the following computation: Final state: Node i has accurate values. pkpk ij p3p3 i1 p5p5 Receive routes and payments from neighbors Update routes and payments Advertise modified routes and payments

21 Computing LCP Payments [FPSS02] = c k + Cost of min-cost k-avoiding path from i to j – Cost of LCP from i to j pkpk ij a b d i k j Key observations: Min-cost k-avoiding path passes through one of i’s neighbors Payment can be related to costs and payments at adjacent nodes, e.g., = + c b + c i pkpk ij pkpk bj pkpk ij Using this, we can show that prices can be computed with local dynamic programming, with nodes exchanging only costs and payments.

22 Gao-Rexford Framework (1) Neighboring pairs of ASes have one of: –a customer-provider relationship (One node is purchasing connectivity from the other node.) –a peering relationship (Nodes have offered to carry each other’s transit traffic, often to shortcut a longer route.) peer providers customers peer

23 Gao-Rexford Framework (2) Global constraint: no customer-provider cycles Local preference and scoping constraints, which are consistent with Internet economics: Gao-Rexford conditions => no dispute [GR01,GGR01] Preference Constraints... i d R1R1 R2R2 k2k2 k1k1 If k 1 and k 2 are both customers, peers, or providers of i, then either ik 1 R 1 or ik 2 R 2 can be more valued at i. If one is a customer, prefer the route through it. If not, prefer the peer route. Scoping Constraints d k i j Export customer routes to all neighbors and export all routes to customers. Export peer and provider routes to all customers only. m.. peer customer provider

24 Efficient Payment Computation Next-hop valuations: The valuation of a route depends only on its next hop. Observation: Next-hop valuations are policy consistent. Theorem: If Gao-Rexford conditions hold and ASes have next-hop policies, then the payment-computation algorithm has the same space-efficiency as in the LCP case.

25 Example of Gao-Rexford + Next Hop peer cust./prov. 7 d v(7245d) = 100 v(7235d) = 100 v(7236d) = 100 v(71245d) = 50 v(7135d) = 50 v(135d) = 100 v(136d) = 100 v(1245d) = 50 [123…, 17… unavail.] v(245d) = 100 v(235d) = 50 v(236d) = 50 [21… unavail.] v(45d) = 100 v(4235d) = 50 v(5d) = 100 v(536d) = 20 v(54236d) = 8 v(35d) = 100 v(36d) = 50 v(3245d) = 30 [31… unavail.] v(6d) = 100 v(635d) = 50 v(63245d) = 50

26 Next-Hop Routing Table for AS7 Store usable routes, availability of k-avoiding routes from neighbors (for all), and best k-avoiding next hops (for preferred). Payment components are derived from next hops: p k i (T d ) = v i (T d ) – v i (T d -k ) for transit k ; = 0 otherwise. Destination d AS 2 AS 4AS 5 Optimal AS path Y Y Bit vector from update AS 1 AS 2 Best k-avoiding next hops d AS 1 AS 3AS 5 Alternate AS path Y Y Bit vector from update

27 Next-Hop Payment Computation Send augmented BGP-update message whenever best route or availability of a k-avoiding route changes: When an update message is received: –Store path and bits in routing table. –Scan bits to update best k-avoiding next hop. AS k 1 AS k 2 …AS k i Y/N … AS Path k i -avoiding path known?

28 Summary of Sufficient Conditions No assumptions Hard (BGP may not converge) No dispute cycle Non-optimal (BGP will converge, but the solution may be arbitrarily far from optimal.) No dispute cycle and policy consistency Optimal convergence (but payment computation might be highly space-consuming) No dispute cycle and next-hop or lowest- cost valuations (special cases of policy consistency) Optimal convergence and good BGP-style algorithm (Requires O(1) additional space per transit node.)