1. Interdomain Routing and Games Michael Schapira Joint work with Hagay Levin and Aviv Zohar האוניברסיטה העברית בירושלים The Hebrew University of Jerusalem

2. The Agenda An introduction to interdomain routing (a networking approach). A Distributed Algorithmic Mechanism Design (DAMD) perspective (an economic approach). Our Results: –A formulation of interdomain routing as a game. –Realistic settings in which BGP is immune to rational manipulations. –…–…

3. An Introduction to Interdomain Routing (A Networking Approach)

4. Interdomain Routing Establish routes between Autonomous Systems (ASes). Currently done only by the Border Gateway Protocol (BGP). AT&T Qwest Comcast UUNET

5. Why is Interdomain Routing Hard? Route choices are based on local policies. Expressiveness: Policies are complex. Autonomy: Policies are uncoordinated AT&T Qwest Comcast UUNET My link to UUNET is for backup purposes only. Load-balance my outgoing traffic. Always choose shortest paths. Avoid routes through AT&T if at all possible.

6. Interdomain Routing Routes to every destination AS are computed independently. There is an AS graph G=. –N consists of n source nodes 1,…,n and a destination node d. –L represents physical links between ASes.

7. Interdomain Routing receive routes from neighbours choose “best” neighbour send updates to neighbours Every source-node i is defined by a valuation function v i that assigns a non-negative value to each (simple) route from i to d. The computation performed by a single node is an infinite sequence of stages:

8. Interdomain Routing The route assignment reached by BGP forms a confluent routing tree rooted in d. –Routes are consistent (route choices depend on neighbours’ choices). –Routes are loop-free (nodes announce full routes). The final route assignment is stable. –Every node prefers its assigned route over any other available route.

9. Example of Stability 1 2 d Prefer routes through 2 Prefer routes through 1 2, I’m available 1, my route is 2d 1, I’m available

10. Assumptions on the Network The network is asynchronous. –Nodes can be activated in different timings. –Update messages can be arbitrarily delayed along selective links. Network malfunctions are possible. –Link and node failures.

11. BGP Pros: Nodes need have no a-priori knowledge about the network topology or about other nodes. The protocol is adaptive to changes in network topology (link and node failures). …. Cons: The lack of global coordination might result in persistent route oscillations (protocol divergence).

12. Example of Instability: Oscillation 1 2 d BGP might oscillate forever between 1d, 2d and 12d, 21d Prefer routes through 2 Prefer routes through 1 1, 2, I’m the destination 1, my route is 2d 2, my route is 1d

13. The Hardness of Stability Theorem: Determining whether a ``stable solution’’ exists is NP-Hard. [Griffin-Wilfong] Theorem: Determining whether a ``stable solution’’ exists requires exponential communication between the source-nodes. –Independent of the P-NP assumption. –Communication complexity is linear in the “size” of the local preferences of nodes.

14. Networking researchers seek constraints that guarantee BGP stability (for any timing, even in the presence of network malfunctions). [Balakrishnan, Feamster, Gao, Griffin, Jaggard, Johari, Ramachandran, Rexford, Shepherd, Sobrinho, Wilfong, …] A realistic and well known set of such constraints are the Gao-Rexford constraints. –The Internet is formed by economic forces. –ASes sign long-term contracts that determine who provides connectivity to whom. Guaranteeing Robust Convergence

15. Gao-Rexford Framework Neighboring pairs of ASes have one of: –a customer-provider relationship (One node is purchasing connectivity from the other node.) –a peering relationship (Nodes have offered to carry each other’s transit traffic, often to shortcut a longer route.) peer providers customers peer

16. Dispute Wheels If BGP oscillates, the valuation functions and the topology of the network induce a structure called a Dispute Wheel. [Griffin- Shepherd-Wilfong] The absence of a Dispute Wheel ensures robust BGP convergence. The Gao-Rexford constraints are a special case of “No Dispute Wheel”. [Gao- Griffin-Rexford]

17. Dispute Wheels A Dispute Wheel: –A sequence of nodes u i and routes R i, Q i. –u i prefers R i Q i+1 over Q i.

18. Example of a Dispute Wheel 1 2 d Prefer routes through 2 Prefer routes through 1 2 1 d

19. A DAMD Perspective (An Economic Approach)

20. Do Nodes Always Adhere to the Protocol? BGP was designed to guarantee connectivity between trusted and obedient parties. The commercial Internet: ASes are owned by economic and often competing entities. –Might deviate from BGP if it suits their interests.

21. Two Research Agendas Security research –Malicious nodes. –Cyptographic modifications of BGP (S-BGP) Distributed Algorithmic Mechanism Design [Feigenbaum-Papadimitriou-Shenker] –Rational nodes. –Seeks realistic conditions for which BGP is incentive-compatible. [Feigenbaum-Papadimitriou-Sami-Shenker]

22. Our Results

23. Our Main Results A novel game-theoretic model of interdomain routing. A surprising connection between the two research agendas (security and DAMD). Theorem: (bad news): BGP is not incentive- compatible even if No Dispute Wheel holds. Theorem: (good news): Cryptographic modifications of BGP (e.g., S-BGP) are incentive- compatible if No Dispute Wheel holds (no monetary transfers).

24. Interdomain Routing Games

25. A Static Game The source-nodes are the strategic agents (their valuation functions define their types). Each source-node chooses an outgoing edge. –Choices are simultaneous. A node’s payoff is: –v i (R) if the route R from i to d is induced by the nodes’ choices. –0 otherwise.

26. A Static Game A pure Nash equilibrium is a set of nodes’ choices from which no node wishes to unilaterally deviate. Pure Nash equilibria = stable routing outcomes 1 2 d Prefer routes through 2 Prefer routes through 1

27. The Convergence Game The game consists of an infinite number of rounds. A node that is activated in a certain round can perform the following actions: –Read update messages announcing routes. –Send update messages announcing routes. –Choose a neighbouring node to forward traffic to.

28. The Convergence Game There exists an adversarial entity called the scheduler that is in charge of: –Deciding which nodes are activated in each round. –Delaying update messages along selective links. –Removing links and nodes from the AS graph. Informally, a node’s strategy is its choice of a routing protocol. –Executing BGP is a strategy.

29. The Convergence Game A route is said to be stable if from some round onwards every node on the route forwards traffic to the next-hop node on that route. The payoff of node i from the game is: –v i (R) if there is a route R from i to d which is stable. –0 otherwise.

30. BGP and Incentives A node is said to deviate from BGP (or to manipulate BGP) if it does not follow BGP. What forms of manipulation are available to nodes? –Misreporting preferences. –Reporting inconsistent information. –Announcing nonexistent routes. –Denying routes. –…–…

31. BGP and Incentives Two possible incentive-related requirements from BGP: Incentive-compatibility: No unilateral deviation from BGP by an AS can strictly improve the routing outcome of that AS. Collusion-proofness: No deviation from BGP by coalitions of ASes of any size can strictly improve the routing outcome of even a single AS in the coalition without strictly harming another [Feigenbaum-S- Shenker].

32. Knowledge Assumptions knowledge omniscient agents no knowledge assumptions A dominant strategy equilibrium – I’m better off following the protocol no matter what everyone else is doing (no knowledge assumptions whatsoever). A Nash equilibrium – I’m better off following the protocol only if I know everything (network topology, nodes’ true preferences, message timings, …). An ex-post Nash equilibrium – I’m better off following the protocol as long as everyone else does (no knowledge assumptions on network topology, nodes’ true preferences, message timings, …). [Shneidman-Parkes]

33. About the Convergence Game The game is complex. –Multi-round. –Asynchronous. –Partial-information No monetary transfers! –Very rare in mechanism design. –Unlike most works on incentive-compatibility and interdomain routing –More realistic.

34. Known Results..... d k i IF v k (R 1 ) > v k (R 2 ) R2R2 R1R1 THEN v i ((i,k)R 1 ) > v i ((i,k)R 2 ) Valuations are policy consistent iff, for all routes R 1 and R 2 (analogous to isotonicity [Sob.03])

35. Known results Policy consistency is known to hold for interesting special cases: –Shortest-path routing. –Next-hop policies. Theorem: If No Dispute Wheel and Policy Consistency hold, then BGP is incentive-compatible, and even collusion- proof. [Feigenbaum-Ramachandran-S, Feigenbaum-S-Shenker]

36. Known results A Problem: Policy Consistency is unrealistic. –Too strong. Can it be removed?

37. Realistic Settings in which BGP is Incentive-Compatible and Collusion-Proof

38. Is BGP Incentive-Compatible? Theorem: BGP is not incentive compatible even in Gao-Rexford settings. m 1 2 d m1d m12d 2md 2d 12d 1d with manipulation m 1 2 d m1d m12d 2md 2d 12d 1d without manipulation

39. We define the following property: –Route verification means that an AS can verify that a route announced by a neighbouring AS is available. Route verification can be achieved via security tools (S-BGP etc.). –Not an assumption on the nodes! Can we fix this?

40. Many forms of manipulation are still available: –Misreporting preferences over available routes. –Reporting inconsistent information. –Denying routes. –… Does this solve the problem?

41. Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is incentive-compatible. Theorem: If the “No Dispute Wheel” condition holds, then BGP with strong route verification is collusion- proof. Our Main Results

42. Dispute Wheels – A Reminder A Dispute Wheel: –A sequence of nodes u i and routes R i, Q i. –u i prefers R i Q i+1 over Q i. The Gao-Rexford constraints are a special case of the “No Dispute Wheel” condition.

43. Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is incentive-compatible. Proof (sketch): –By contradiction. –Assume that the “No Dispute Wheel” condition holds, and that BGP is not incentive-compatible. –We present sequences of nodes and routes that form a dispute wheel. BGP with Route Verification

44. Proof Sketch d s TsTs MsMs Let s be the manipulator. Let T be the routing tree reached if all nodes follow the protocol. Let M be the the routing tree reached after s rationally manipulates BGP. v s (M s ) > v s (T s )

45. Proof Sketch d s 1 TsTs MsMs M1M1 T1T1 There must exist a node i on M s such that M i ≠T i Let 1 be the node closest to d on M s with this property. For each node i that is closer to d on M s it holds that M i =T i. This implies: v 1 (T 1 ) > v 1 (M 1 )

46. Proof Sketch d s 1 2 TsTs MsMs M1M1 T1T1 T2T2 M2M2 Similarly, Let 2 be the node i closest to d on T 1 such that M i ≠T i. This implies: v 2 (M 2 ) > v 2 (T 2 )

47. Proof Sketch d s 1 2 3 4 TsTs MsMs M1M1 T1T1 T2T2 M2M2 M3M3 T3T3 T4T4 k MkMk TkTk We choose 3,4,5,… in a similar manner. Eventually some node will appear twice (assume that this node is s). We have a dispute wheel!

48. Why do we need route verification? The manipulator can lie about its route. For instance, k might believe that s’s route in M is L s. Still, v s (M s ) > v s (T s ) > v s (L s ) d s 1 2 3 4 k TsTs MsMs M1M1 T1T1 T2T2 M2M2 M3M3 T3T3 T4T4 TkTk MkMk LsLs Proof Sketch

49. Theorem: If the “No Dispute Wheel” condition holds, then BGP with route verification is collusion-proof. A Problem: Is route verification achievable even in the presence many manipulators? BGP with Route Verification

50. Corollary: If No Dispute Wheel holds, then BGP is Pareto optimal. Pareto optimality means that BGP’s outcome is such that there is no other outcome that is: –Strictly preferred by one node. –Weakly preferred by all other nodes. BGP is Socially Just

51. The total social welfare of a routing outcome is the sum of values nodes assign to their routes = ∑ i v i (P i ). No Dispute Wheel and Policy Consistency guarantee BGP convergence to a social-welfare maximizing solution. [Feigenbaum-Ramachandran-S] What About Social-Welfare?

52. Approximating Social Welfare Theorem: Obtaining an approximation to the optimal social welfare is impossible unless P=NP, even in Gao-Rexford settings. (Improvement on a bound achieved by [Feigenbaum,Sami,Shenker]) Theorem: Exponential communication is required in order to achieve an approximation of to the social welfare.

53. Conclusions The main results: –Bad news: BGP is not incentive-compatible even if No Dispute Wheel holds. –Good news: A modification of BGP (route verification) is incentive-compatible. Helps explain BGP’s relative resilience to manipulations in practice.

54. Conclusions Our results should motivate research on guaranteeing route verification in the Internet. Where’s the justice? –Bad news: Social-welfare optimization might be hopeless. –Good news: BGP is Pareto optimal.

55. Follow Up Works “Best-reply mechanisms” (with Noam Nisan and Aviv Zohar) –Extensions to more general game-theoretic settings. Work in progress (with Rahul Sami and Aviv Zohar) –More on BGP convergence and selfishness.

56. Characterizing robust BGP convergence (“No dispute wheel” is sufficient but not necessary). Does robust BGP convergence with route verification imply incentive compatibility? Can network formation games help explain the Internet’s commercial structure? Open Questions

57. Generalize the model to allow other forms of “attacks” [Butler-Farley-McDaniel-Rexford] Open Questions

58. Thank You

59. A Negative Result for General Routing Protocols or Why Are Protocols Like BGP Necessary?

60. Why settle for a routing protocol that sometimes results in persistent route oscillations? Computational answer: Determining whether a stable solution exists is NP hard. Economic answer (informal): No “reasonable” protocol that always deterministically chooses a route assignment is incentive-compatible. A Negative Result for General Routing Protocols

61. Theorem: Fix an AS graph G. Let A be a routing protocol such that: –A deterministically chooses a route assignment for every set of valuation functions defined over G (for all timings). –A has at least 3 possible routing outcomes. –A is incentive-compatible. Then: A is dictatorial (a specific node in G is always assigned its most preferred route by A). Proof: By reduction from Gibbard-Satterthwaite. A Negative Result for General Routing Protocols

62. 54 362 17 d Negative Result – An Example Node 1 always gets its most preferred route to d, and forces nodes on that route to route traffic accordingly. the dictator This result holds even: For centralized routing protocols. When the only form of rational manipulation available is misreporting preferences.

63. BGP is Socially Just

64. We require BGP to be socially just in some global sense. A natural approach: Seek a setting in which BGP reaches a route assignment that maximizes the total social welfare. –The total social welfare is the sum of values nodes assign their assigned routes = ∑ i v i (P i ). A Problem: –Even in the Gao-Rexford setting the stable route assignment reached by BGP can be arbitrarily far from the optimum. [Feigenbaum-Ramachandran-S] –A strong additional assumption on the valuation functions is required. [Feigenbaum-Ramachandran-Schapira] BGP is Socially Just

65. Theorem: If BGP convergence is guaranteed, then BGP is Pareto optimal. BGP is said to be Pareto optimal if: –Let T d be the route assignment reached by BGP. –There is no route assignment T’ d such that: There is a node that strictly prefers its route in T d over its route in T’ d. All other nodes weakly prefer their routes in T d over their routes in T’ d. BGP is Socially Just

66. Corollary: The coalition that consists of all nodes has no rational motivation to deviate from BGP (without payments). Is that true for coalitions of any size? In particular, is it true that a unilateral deviation from BGP cannot benefit the deviating node? BGP is Socially Just NO!