Towards a Logic for Wide- Area Internet Routing Nick Feamster Hari Balakrishnan

Introduction Internet routing is a massive distributed computing task BGP4 is exceedingly complex Complexity arises due to wide variety of goals that must be met Complicated interactions and unintended side effects

Introduction (contd.) Propose routing logic – a set of rules Logic used to determine satisfaction of desired properties Demonstrate how this logic can be used to analyze and aid implementation

Motivation Complexity of BGP Fast convergence to correct loop-free paths Resilience to congestion Avoid packet loss and failures Connecting autonomous and mutually distrusting domains

Motivation (contd.) Complexity stems from dynamic behavior during operation Vast possibilities for configuration Prior work highlights many undesirable properties

Motivation (contd.) Poor Integrity DoS, integrity attacks, misconfiguration Slow Convergence Path instability, delayed convergence Congestion scenario not well-understood

Motivation (contd.) Unpredictability BGP is distributed and asynchronous Predicting effects of configuration change challenging Poor control of information flow BGP implementation may expose information not intended to be public knowledge

Motivation (contd.) Specific modifications have unintended side effects Need for something that reasons ‘correctness’ of the protocol Classify protocols in terms of desired properties

Desired Properties Validity Existence of route implies existence of path Visibility Existence of path implies existence of route Safety/Stability No participant should change its route in response to other routes

Desired Properties (contd.) Determinism Protocol should arrive at same predictable set of routes Information-flow Control Should not expose more information than necessary

Routing Logic Inputs Specification of how protocol behaves Specification of protocol configuration Policy configuration General configuration, e.g. which routers exchange routing information Current version has no notion of time

Hierarchical Routing Scopes Organize routing domains into hierarchical levels called scopes Protocol in scope ‘i’ forwards packets via scope ‘i’ next-hop in that path Scope ‘i’ routing uses scope ‘i+1’ path to reach scope ‘i’ next hop

Routing Domains are Organized Hierarchically

Validity Rules Reachability Route transports packets to intended destinations Policy conformance Conform to peering and transit agreements Progress Next-hop specified reduces total distance to the destination

The Validity Rule

Underlying IGP can result in forwarding loops

Information Flow Control Consists of objects, flow policy, partial ordering of security levels Policy defined in terms of partial ordering expressed as a lattice Flow model specifies Process causing information flow How flow should be controlled between parties

An example information flow lattice

Information Objects Policy Peering and transit agreements Router preferences Reachability Events affecting reachability Topology Internal network topology Inter-AS connectivity

Noninterference Rule Objects at higher security levels should not be visible to objects at lower levels Security level of message not higher than level of recipient

BGP implementations can result in information flow policy violations

Potential Applications Static analysis of existing network configuration Providing framework for design of high- level policy specification Aid designers of new protocols

Configuration Analysis Tool verifies properties of legacy router configuration Such tool under development Used to check whether configuration satisfies specified information flow policy

Configuration Synthesis Get rid of low-level configuration languages Remove complexity, frequent misconfiguration Synthesize low-level configuration by translating high-level specification

Protocol Design Implement set of protocol abstractions Relate to routing logic, determine satisfaction of properties Less susceptible to violating wide-area routing properties

Related Work Inspired by use of BAN logic for authentication protocol analysis Application of BAN logic to Taos Operating system Builds on BGP anomalies noted by various previous work

Conclusions Presented a routing logic Proving properties about protocol aspects Formally describe how fundamental properties of BGP lead to violations Evaluate future proposed modifications to BGP Help design new protocols

From 10,000 feet … Does not aim to fix all problems in BGP Lays importance to formalizing current approach of understanding things Is a tool to analyze effects of modifications to implementations Approach extendable to other complex protocols