1. 1 Incentive-Compatible Inter-Domain Routing Joan Feigenbaum Yale University http://www.cs.yale.edu/homes/jf/ Colloquium at Cornell University; October 2005 Joint work with Michael Schapira and Vijay Ramachandran

2. 2 Inter-Domain Routing Establish routes between autonomous systems (ASes). Currently done with the Border Gateway Protocol (BGP). AT&T Qwest Comcast UUNET

3. 3 Why is Inter-Domain Routing Hard? Route choices are based on local policies. Autonomy: Policies are uncoordinated. Expressiveness: Policies are complex. AT&T Qwest Comcast UUNET My link to UUNET is for backup purposes only. Load-balance my outgoing traffic. Always choose shortest paths. Avoid routes through AT&T if at all possible.

4. 4 BGP-Route Processing Each AS has a routing table with routes to other nodes: Entire paths are stored (to prevent loops). Dest. AS Path AS3AS5AS1 AS7AS2 AS3AS2... The computation of a single node is an infinite sequence of stages: Receive routes from neighbors Update Table Choose “Best” Route Send updates to neighbors

5. 5 Path-Vector Protocol Design Pros: –Route choices depend on neighbors’ choices. => enforces consistency –Best-route choices are made locally. => allows autonomy, expressiveness, … –Routes are loop free and can change with topology, without any node’s knowing the whole network. Cons: –Policy-induced routing anomalies => Routes may not be stable.

6. 6 Example of Instability: Oscillation 1 2 d 3 Nodes oscillate forever between 1d, 2d, 3d and 12d, 23d, 31d Prefer routes through 2 Prefer routes through 3 Prefer routes through 1

7. 7 Protocol Convergence A balance of local and global constraints on policies can assure robust convergence. [Gao, Rexford, Griffin, Wilfong, Shepherd, Sobrinho, Jaggard, Ramachandran, Feamster, Johari, Balakrishnan, … ] These results are concerned only with convergence to unique solutions. Recently, private information, optimization, and incentive-compatibility have also been studied in inter-domain routing.

8. 8 Economic Mechanism Design Approach to designing systems for self-interested agents Truthful mechanisms: Regardless of what other agents do, each agent i maximizes her utility by revealing her true private information. Agent 1 Agent n Mechanism p1p1 pnpn tntn t1t1 a1a1 anan O Private information Strategies Payments Output

9. 9 Welfare-Maximizing Routing AS 1 AS n Mechanism p1p1 pnpn v n (. ) v 1 (. ) a1a1 anan Private information: Route valuations Strategies Maximize sum of nodes’ valuations = ∑ i v i (R i ). A confluent routing tree and payments are computed in parallel for each destination. Source nodes are paid for their contribution to the routing tree. We want a BGP-style algorithm that computes routes and payments. Routes R 1, …, R n

10. 10 Classes of Routing Policies Lowest-Cost Paths (LCP) Nodes’ private information is its own per-packet transit cost. Transit nodes are paid to carry transit traffic and reveal true costs. General Policy Routing Nodes’ private information is an unrestricted per-route valuation. Next-Hop Routing Nodes’ private information is a per-route valuation. Route valuations depend only on a route’s next hop. Subjective-Cost Routing Nodes’ private information is its perceived cost for every other AS. Cost of a route is the sum of source’s perceived transit costs. Forbidden-Set Routing Nodes’ private information is a set of ASes through which allocated routes are not allowed.

11. 11 Known Results: Welfare Maximization and Inter-Domain Routing Routing-Policy Class Good Centralized Algorithm? Good Distributed Algorithm? LCP General Policy  (and hard to approximate) Next Hop  Subjective Cost  (incl. some special cases)  (approx. is easy if >1 tree) Forbidden Set 

12. 12 Question These are mostly negative results. Is there a realistic and useful class of routing policies (i.e., something broader than LCPs) for which we can get a truthful mechanism and a good BGP-style algorithm?

13. 13 General Approach Find a class of policies for which BGP converges to an optimal tree T (i.e., one that maximizes the sum of the valuations of all source nodes). Use VCG payment formula to ensure truthfulness, i.e., payment to node k is p k = ∑ i  k v i (T) – h k () where h k is a function that does not depend on node k’s valuation.

14. 14 Dispute Cycles Relation 1: Subpath... R1R1 R2R2 R 1 R 2 Relation 2: Preference... Q1Q1 Q2Q2 v i (Q 1 ) > v i (Q 2 ) Q 1 Q 2 d d i i Valuations do not induce a dispute cycle iff there is no cycle formed by the above relations on all permitted paths in the network. No dispute cycle => robust convergence [GSW02, GJR03]

15. 15 Example of a Dispute Cycle 1 2 d 3 v(12d) = 10 v(1d) = 5 v(23d) = 10 v(2d) = 5 v(31d) = 10 v(3d) = 5 1d1d2d2d3d3d 31d12d23d Dispute Cycle Subpath Preference

16. 16 Policy Consistency..... d k i IF v k (R 1 ) > v k (R 2 ) R2R2 R1R1 THEN v i ((i,k)R 1 ) > v i ((i,k)R 2 ) Valuations are policy consistent iff, for all routes R 1 and R 2 (whose extensions are not rejected), (analogous to isotonicity [Sob.03])

17. 17 Optimality and Payment Formula Theorem: If the valuation functions are policy consistent and do not induce a dispute cycle, then BGP computes optimal routes. Payment to node k: p k (T d ) = ∑ i ≠ k [v i (T d ) – v i (T d -k )] –T d is the optimal routing tree to destination d. –T d -k is the optimal tree to d avoiding node k. –This is the VCG formula, with h k ({v i }) = ∑ i ≠ k v i (T d -k ).

18. 18 Computing Routes and Payments The “algorithm”: Run n+1 parallel instances of BGP on G, G -1, G -2, …, G -n. Result: optimal trees T d, T d -1, …, T d -n For all i, k, node i can compute a component of the payment to k: p k i (T d ) = v i (T d ) – v i (T d -k ). The total payment to node k can be broken down into these components: p k (T d ) = ∑ i ≠ k p k i (T d ).

19. 19 Efficiently Computing Payments? Node optimality: In a globally optimal routing tree, every node gets its most valued (locally optimal) route. Theorem A: No dispute cycle + policy consistency => node optimality. Theorem B: Node optimality => If k is not on the path from i to d, then payment component p k i (T d ) = 0.

20. 20 Lowest-Cost Paths (LCP) AS3AS5 c(i,1) AS1 c1c1 Dest.Cost LCP and Path Prices LCP cost AS1 Initially, all payments are set to . Then, each node runs the following computation: Final state: Node i has accurate values. pkpk ij p3p3 i1 p5p5 Receive routes and payments from neighbors Update routes and payments Advertise modified routes and payments

21. 21 Computing LCP Payments [FPSS02] = c k + Cost of min-cost k-avoiding path from i to j – Cost of LCP from i to j pkpk ij a b d i k j Key observations: Min-cost k-avoiding path passes through one of i’s neighbors Payment can be related to costs and payments at adjacent nodes, e.g., = + c b + c i pkpk ij pkpk bj pkpk ij Using this, we can show that prices can be computed with local dynamic programming, with nodes exchanging only costs and payments.

22. 22 Gao-Rexford Framework (1) Neighboring pairs of ASes have one of: –a customer-provider relationship (One node is purchasing connectivity from the other node.) –a peering relationship (Nodes have offered to carry each other’s transit traffic, often to shortcut a longer route.) peer providers customers peer

23. 23 Gao-Rexford Framework (2) Global constraint: no customer-provider cycles Local preference and scoping constraints, which are consistent with Internet economics: Gao-Rexford conditions => no dispute [GR01,GGR01] Preference Constraints... i d R1R1 R2R2 k2k2 k1k1 If k 1 and k 2 are both customers, peers, or providers of i, then either ik 1 R 1 or ik 2 R 2 can be more valued at i. If one is a customer, prefer the route through it. If not, prefer the peer route. Scoping Constraints d k i j Export customer routes to all neighbors and export all routes to customers. Export peer and provider routes to all customers only. m.. peer customer provider

24. 24 Efficient Payment Computation Next-hop valuations: The valuation of a route depends only on its next hop. Observation: Next-hop valuations are policy consistent. Theorem: If Gao-Rexford conditions hold and ASes have next-hop policies, then the payment-computation algorithm has the same space-efficiency as in the LCP case.

25. 25 Example of Gao-Rexford + Next Hop peer cust./prov. 7 d 1 2 3 4 5 6 v(7245d) = 100 v(7235d) = 100 v(7236d) = 100 v(71245d) = 50 v(7135d) = 50 v(135d) = 100 v(136d) = 100 v(1245d) = 50 [123…, 17… unavail.] v(245d) = 100 v(235d) = 50 v(236d) = 50 [21… unavail.] v(45d) = 100 v(4235d) = 50 v(5d) = 100 v(536d) = 20 v(54236d) = 8 v(35d) = 100 v(36d) = 50 v(3245d) = 30 [31… unavail.] v(6d) = 100 v(635d) = 50 v(63245d) = 50

26. 26 Next-Hop Routing Table for AS7 Store usable routes, availability of k-avoiding routes from neighbors (for all), and best k-avoiding next hops (for preferred). Payment components are derived from next hops: p k i (T d ) = v i (T d ) – v i (T d -k ) for transit k ; = 0 otherwise. Destination d AS 2 AS 4AS 5 Optimal AS path Y Y Bit vector from update AS 1 AS 2 Best k-avoiding next hops d AS 1 AS 3AS 5 Alternate AS path Y Y Bit vector from update

27. 27 Next-Hop Payment Computation Send augmented BGP-update message whenever best route or availability of a k-avoiding route changes: When an update message is received: –Store path and bits in routing table. –Scan bits to update best k-avoiding next hop. AS k 1 AS k 2 …AS k i Y/N … AS Path k i -avoiding path known?

28. 28 Summary of Sufficient Conditions No assumptions Hard (BGP may not converge) No dispute cycle Non-optimal (BGP will converge, but the solution may be arbitrarily far from optimal.) No dispute cycle and policy consistency Optimal convergence (but payment computation might be highly space-consuming) No dispute cycle and next-hop or lowest- cost valuations (special cases of policy consistency) Optimal convergence and good BGP-style algorithm (Requires O(1) additional space per transit node.)