Principles of Safe Policy Routing Dynamics

Transcription

1 1 Principles of Safe Policy Roting Dynamics Samel Epstein, Karim Mattar, Ibrahim Matta Department of Compter Science Boston Uniersity {samepst, kmattar, Technical Report No. BUCS-TR This report reises Technical Report BUCS Abstract We introdce the Dynamic Policy Roting (DPR) model that captres the propagation of rote pdates nder arbitrary changes in topology or path preferences. DPR introdces the notion of casation chains where the rote flap at one node cases a flap at the next node along the chain. Using DPR, we model the Gao-Rexford (economic) gidelines that garantee the safety (i.e., conergence) of policy roting. We establish three principles of safe policy roting dynamics. The non-interference principle proides insight into which ASes can directlndce rote changes in one another. The single cycle principle and the mlti-tiered cycle principle proide insight into how cycles of roting pdates can manifest in any network. We deelop INTERFERENCEBEAT, a distribted algorithm that propagates a small token along casation chains to check adherence to these principles. To enhance the diagnosis power of IN- TERFERENCEBEAT, we model for iolations of the Gao-Rexford gidelines (e.g., transiting between peers) and characterize the reslting dynamics. I. INTRODUCTION The Border Gateway Protocol (BGP) is crrently the defacto inter-domain roting protocol employed in the Internet. BGP allows Atonomos Systems (ASes), operated by different administratie domains (e.g., Internet Serice Proiders, companies, niersities) to independently apply local policies for selecting rotes and propagating roting information. Gien the critical role and global scope of BGP, both its transient and steady-state performance hae receied significant attention, and problems related to delayed conergence [1] and potential instability [], [] (i.e., rote oscillations/flaps) hae been identified and stdied. Rote flaps in particlar can be highly disrptie gien the associated cost of commnication and processing oerheads. Rote flaps can be transient (i.e., short-term) de to temporary changes in topology or rote/path preferences. Rote flaps can also be persistent de to conflicting roting policies across ASes (i.e., policies can not be simltaneosly satisfied) [4]. Economic constraints that are typical of commercial relationships between ASes in the Internet henceforth referred to as the Gao-Rexford gidelines [5] hae been shown to make BGP free from policy conflicts (i.e., conergent). We refer to roting policnstances that adhere to the Gao-Rexford gidelines as safe and ones that do not as potentially nsafe. The Gao-Rexford gidelines are: 1) An AS classifies its neighboring ASes as either cstomer, peer or proider. ) The path preferences are restricted in a hierarchical fashion. Eery AS prefers a path throgh a cstomer AS oer a path throgh a peer/proider AS. ) All adertised paths are alley-free. They consist of zero or more cstomer-to-proider links followed by an optional peering link followed by zero or more proiderto-cstomer links. Or Contribtion: We extend the Stable Paths Problem [4] (a static model of BGP) to captre the propagation dynamics of rote pdates nder arbitrary changes in topology (e.g., link failres) or path preferences (e.g., policy configration pdates). We call this extended model the Dynamic Policy Roting (DPR) model. DPR introdces the notion of casation chains where the rote flap at one node cases a flap at the next node along the chain. We model a strict ersion of the Gao-Rexford gidelines which we call the economic DPR model. We proe the existence of seeral inariant properties of casation chains irrespectie of arbitrary changes in topology or path preferences. For example, we proe that all casation chains in the economic DPR model are alley-free, ths generalizing the reslt in [6] to dynamic networks. Violations of the economic DPR model reslt in potentially nsafe roting behaior where the casation chains are not necessarily alley-free. We deelop INTERFERENCEBEAT, a distribted algorithm that checks if the roting dynamics adhere to the ones predicted by the economic DPR model. If not, then the presence of policolations can be inferred. INTERFERENCEBEAT appends a token to each roting pdate message. Tokens are propagated along casation chains. We model for common policolations (e.g., transiting between peers). For each iolation, we proe the inariant properties of the reslting casation chains. Using these inferred properties, we extend the diagnosis power of INTER- FERENCEBEAT. The noelty of this work is that: 1) We identify key principles (i.e., inariant properties) of safe policy roting dynamics regardless of changes to the nderlying topology or path preferences. ) We identify and model for common iolations of safe policy roting and characterize the reslting dynamics. ) We introdce INTERFERENCEBEAT, a distribted algorithm to detect and diagnose policolations.

2 II. PRINCIPLES OF SAFE POLICY ROUTING DYNAMICS In this section, we distill the key reslts of or DPR model into three principles. These principles captre inariant properties of the roting dynamics nder safe policy roting (i.e., where the policies of all nodes adhere to the Gao- Rexford gidelines). We discss reasons why ASes iolate these gidelines. Sch policolations reslt in potentially nsafe roting dynamics where or principles no longer hold. We also show that roting dynamics need to be explicitly considered when detecting policolations. We postpone formal definitions to later sections and focs here on presenting the main intitions behind or reslts. A. What are the principles? Non-Interference Principle: If an AS s not at a higher tier-leel than (proider to) any two of its neighbors x and z, then x and z cannot directlndce path changes in each other throgh y. This principle holds regardless of changes in the nderlying topology or path preferences. The notion of indcing path changes is synonymos with a continos propagation of path changes across nodes, which we model in DPR as a casation chain. The basic premise of the non-interference principle comes from a reslt in DPR (Theorem 1 in Section IV) where we proed that any casation chain mst not contain seqences sch as a proiderto-cstomer-to-proider. Figre 1 otlines all the Internet configrations where AS x cannot directly affect AS z throgh AS y. More specifically, non-interference holds if: 1) AS s mlti-homed with proiders AS x and AS z. ) AS s a cstomer of AS x and a peer of AS z. ) AS s a peer of AS x and a cstomer of AS z. 4) AS s a peer of both AS x and AS z Mlti-Tiered Cycle Principle: Eery cycle of roting pdate messages between ASes mst hae at least two ASes in different tier-leels. This principle holds regardless of changes in the nderlying topology or path preferences. The mlti-tiered cycle principle comes from a reslt in DPR (Theorem in Section IV) where we proed that no casation cycle in safe policy roting can occr exclsiely between peering ASes. B. Why do the principles not always hold? Violations of safe policy roting (i.e., the Gao-Rexford gidelines) reslt in npredictable, black-box dynamics that are potentially nsafe. When policolations occr, the principles no longer hold (Table III in Section VI). The reasons for sch iolations are: 1) Intentional: representing legitimate policy configrations for backp links or complex agreements [7]. ) Unintentional: representing misconfigrations or complex real-time interactions between roters that do not reflect the intentions of the administrators. C. How do we check the principles? Network administrators can statically check whether they are conforming to the Gao-Rexford gidelines where the dynamics are garanteed to conform to the principles. This can be done bnspecting their local preferences and ensring that all adopted paths are alley-free. Static checks are inadeqate since not all nodes are necessarily compliant with the gidelines. Figre illstrates interference between nodes 1 and. The interference is de to policolations by node which cannot be statically checked by node. Instead, node will need to discoer the interference by somehow detecting the casation chain propagating throgh nodes 1, and. Fig. 1. All Internet configrations where AS x cannot directly affect AS z. Horizontal edges represent peering links and diagonal edges represent cstomer-to-proider links. Single Cycle Principle: In any cycle of roting pdate messages between ASes, eery AS x affects its neighbor y at most once. This principle holds regardless of changes in the nderlying topology or path preferences. The notion of cycle is synonymos with a continos propagation of path changes across nodes where at least one node is affected twice. We model sch a cycle of path changes in DPR as a casation cycle. The single cycle principle comes from a reslt in DPR (Theorem in Section IV) where we proed that any casation cycle in safe policy roting occrs only once. Fig.. Sample dynamics where interference occrs. The list of path preferences for nodes and are organized sch that the most preferred path is at the top. Paths not explicitly listed are forbidden. All nodes are trying to reach destination node 0. Node is abiding by the Gao-Rexford gidelines and initially ses the cstomer path 0 which is alley-free. Node, howeer, iolates the gidelines by preferring a path throgh its proider 10 oer a path throgh its cstomer 0. At time t, the link connecting node 1 to node 0 is lost, casing node 1 to hae an empty path to node 0 at time t + 1. At time t +, node switches from path 10 to 0. This action in trn cases node to switch from path 0 to 0 at

3 time t +. Een thogh node abides by the Gao-Rexford gidelines, the forbidden interference occrs. The casation chain consists of a proider (node 1), followed bts cstomer (node ), followed by another proider (node ). If node does not iolate the gidelines, the dynamics wold manifest differently. Sppose the path 0 is forbidden, forcing node to se its proider path 10. The loss of link connectiity between nodes 1 and 0 at time t cases node to lose connectiity at time t +. Node is naffected. The casation chain solely consists of a proider (node 1) followed bts cstomer (node ). Since this chain is alley-free, the dynamics conform to the principles. III. DYNAMIC POLICY ROUTING MODEL The Dynamic Policy Roting (DPR) model is sed to captre the dynamics of BGP. Each AS is represented by a node in a graph. AS path preferences are represented by a ranking relation. DPR extends the notion of SPP [4] to model time-arying topologies and path preferences. A. Basics of DPR Definition 1 (Time). Time is represented by a non-negatie, discrete index t sch that: t [0, ). Definition (Network). The network is represented by a graph G = (V, E): Each ertex V represents an AS. Each edge in E is time dependent: (, ) t E if is connected to at time t. Conersely, a lack of connectiity between and at time t (i.e., link failre) is represented by (, ) t / E. There exists a distingished destination node, represented as, where V. Definition (Paths). Paths are seqences of nodes of the form: 1... k. The empty path is denoted by. All paths end with the node. A concatenation of a node with a path Q is represented as: P = Q. A path originating from is represented by P. The set of paths originating from is represented by P. Definition 4 (Path Preferences). At each time t, each node has a niqe preference oer paths originating at. This dynamic ranking is represented by the t operator. If prefers P oer Q at time t then: P t Q. If prefers P oer Q for all t then: P Q. Strict preference is defined by: P t Q iff P t Q and Q t P For all times t, for each node V, t is a total order oer P. Ths each node has an ordered preference oer all its paths to. If two paths start with different nodes, then they hae no preference relation. Forbidden paths P are those ranked below the empty path for all times: P. All paths with repeating nodes are forbidden. Definition 5 (DPR Instance). A Dynamic Policy Roting (DPR) instance consists of a graph and a path preference D = ( t, G). Definition 6 (Best Paths). At each time index t, eery node has a path to, represented by P = π(, t). The aailable path choices of a node, ia all possible neighbors, are represented by Choices(, t) where: Choices(, t) = { π(, t) ; (, ) t E} The Best(, t) notation represents the crrent best path for : Best(, t) = max t Choices(, t) The paths assigned to nodes at each time t is their best path of the preios rond. For all nodes V : π(, 0) = π(, t) = Best(, t 1) The path sed by node at time t, π(, t), was its best path at time t 1, Best(, t 1). This best path was determined sing the ranking t 1. Definition 7 (Next-Hop Neighbor). The ρ notation is sed to represent the next-hop neighbor of a crrent path: ρ(, t) = NextHop(π(, t)) Definition 8 (Realized Paths). A path P is realized iff there exists a time t sch that π(, t) = P. Proposition 1 (Path Deconstrction). If ρ( 0, t) = 1 then π( 0, t) = 0 π( 1, t 1) Proof: By the definition of π, π( 0, t) = Best( 0, t 1) so π( 0, t) Choices( 0, t 1). So by the definition of Choices, π( 0, t) = 0 π( 1, t 1), where 1 = ρ( 0, t). B. Casation in DPR Definition 9 (Path Rank Changes). The following definitions describe the relatie change in the rankings of selected paths for a node: RankDec(, t) iff π(, t) t π(, t + 1) RankInc(, t) iff π(, t) t π(, t + 1) RankSame(, t) iff π(, t) = π(, t + 1) The relatie change in rankings are with respect to the crrent path ranking t. Definition 10 (Casation Fnction). In DPR, a node may change its crrent path at a gien time t. The casation fnction represents s neighboring node responsible for s path change. Casation fnction is the base constrct from which casation chains will be bilt. A casation fnction C maps each node at a gien time t to a neighboring node : C(, t) =. The operating conditions for the casation fnction are otlined in Table I. There are three cases for the casation fnction C(, t) = : 1) Node was the next hop of s chosen path at time t. Howeer, node changed its path at time t, casing to choose a less preferred path at time t + 1. ) Node adertised a new path at time t, casing to choose a more preferred path throgh at time t + 1.

4 4 TABLE I CAUSATION FUNCTION Condition 1: RankDec(, t) C(, t) = ρ(, t) Condition : RankInc(, t) C(, t) = ρ(, t + 1) Condition : RankSame(, t) C(, t) is empty ) is empty, becase s path did not change between times t and t + 1. Definition 11 (Casation Chain). A casation chain is a seqence of nodes where each node 1 cases to change its crrent path. It is represented by Y = y 0 y 1... y k t, where: C(, t + i) = 1 for all 0 < i k ) A node cannot be a proider to itself. There are no cstomer-proider cycles. Frthermore, a node cannot be both a (direct or indirect) proider and a (direct or indirect) peer to another node. ) For all times, each node prefers a path throgh a cstomer oer a path throgh a peer/proider and prefers a path throgh a peer oer a path throgh a proider. 4) Each node proides transit serice only to its cstomers. Ths, all paths are alley-free. These economic constraints are a stricter ersion of the Gao- Rexford gidelines which are sfficient to garantee stability in a static graph. Ths, the economic DPR model is safe. The restrictions of the economic model enable eqialence classes of peers, as seen in Figre 4. The economic relationships between nodes can be represented sing a pre-order relation. Time t is defined with respect to y 0, and it takes i time steps to bild the casation chain p to node. An example of a casation chain can be seen in Figre. Fig. 4. Eqialence classes of peers in economic DPR. Fig.. Casation chain Y = y 0 y 1 y t. A link failre between y 0 and occrred at time t, casing y 0 to hae no path to at time t+1. This cases y 1 to switch to a less preferred path at time t +, where C(y 1, t + 1) = y 0 with casation condition 1. This cases y to switch to a more preferred path ia y 1 at time t +, where C(y, t + ) = y 1 with casation condition. Definition 1 (Casation Cycle). A casation cycle is a casation chain with a repeated node: Y = y 0 y 1... y k t, where y 0 = y k. The primary node of the casation cycle is y 0 = y k. Definition 1 (Simple Casation Cycle). A casation cycle Y is simple if: C(y 1, t + k + 1) y 0 The following examples represent simple and non-simple casation cycles: Simple: Non-Simple: y 0 y 1 y y 0 y t y 0 y 1 y y 0 y 1 t IV. ECONOMIC DPR MODEL This section will show that if a DPR instance conforms to a strict ersion of the Gao-Rexford gidelines [5], then its dynamic behaior can be characterized, regardless of changes in topology or path preferences. In particlar, we show that all casation chains hae the property known as alley-free and all casation cycles are simple. The economic constraints we consider are as follows: 1) Eery node is cstomer, peer, or proider to its neighboring nodes. A. Basics of Economic DPR Definition 14 (Economic Operator). The economic relationship between nodes are described sing the operator $. This operator is essential for reasoning abot the economic relationships between nodes in both paths and casation chains. A strict economic relation is defined by: $ iff $ and $ and an eqialence relation is defined by: = $ iff $ and $ Economic relationships can be deried from the operator $ : If is a cstomer of then $. If is a proider to then $. If is a peer to then = $. The properties of the economic operator $ can be modelled sing pre-order conditions: 1) (reflexie) x $ x ) (transitie) x $ y and y $ z implies x $ z The following transitie relationships hold: x $ y and y $ z implies x $ z x $ y and y $ z implies x $ z Definition 15 (Cstomer,, and Proider Paths). We define paths by the economic relationship between a path s starting node and its next-hop. For all paths P : Cstomer(P ) iff $ NextHop(P ) (P ) iff = $ NextHop(P ) Proider(P ) iff $ NextHop(P )

5 5 Definition 16 (Valley). We define a alley to be a seqence of three nodes a b c satisfying the condition: a $ b $ c The for types of alleys can be seen in Figre 5. Eery alley-free seqence is a series of zero or more ascending cstomer-to-proider relationships, followed by an optional peer relationship, followed by a series of zero or more descending proider-to-cstomer relationships. Fig. 5. Valleys Definition 17 (Economic DPR Instances). An economic DPR instance ( $, t, G) satisfies the following conditions: 1) All paths which hae a alley are forbidden. HasValley(P ) P ) Cstomer paths are always preferred oer peer/proider paths and peer paths are always preferred oer proider paths. Ths gien paths P 1 and P : Cstomer(P 1 ) and not Cstomer(P ) P 1 P (P 1 ) and Proider(P ) P 1 P B. Casation in Economic DPR This section characterizes casation chains and cycles for economic DPR instances. y 1 y y 1 y y 1 y y 1 y y 1 y y 0 t t+1 y 0 y 0 y 0 y 0 t+ t+ t+4 Fig. 6. Casation cycle Y = y 0 y 1 y y 0 t. A link failre between y 0 and occrred at time t, casing y 0 to hae no path to at time t + 1. This cases y 1 to switch to a less preferred path at time t +, where C(y 1, t + 1) = y 0 with casation condition 1. This cases y to switch to a path throgh y 1 at time t +, where C(y, t + ) = y 1 with casation condition. The cycle is closed with y 0 switching to a path ia y at time t+4, where C(y 0, t+) = y with casation condition. Note the existence of a separate casation chain Y = y 0 y t. Theorem 1. Eery casation chain of an economic DPR instance ( $, t, G) is alley-free. For ease of exposition, the fll proof of Theorem 1 is in Appendix A. In the proof, we assme that there exists a casation chain that has a alley consisting of three consectie nodes a b c t. First we proe that at no time dring the casation chain did b hae a cstomer path. Then we proe that at some time dring the casation chain, c had a path throgh b. Since b is a cstomer/peer to c and b does not hae a cstomer path then c had a realized alley path throgh b, casing a contradiction. We introdce the following types of cycles: Definition 18 (Horizontal Cycle). A casation cycle is horizontal if all adjacent nodes in the cycle are peers. Definition 19 (Vertical Cycle). A casation cycle is ertical if there is at least one cstomer/proider relationship between adjacent nodes in the cycle. Figre 6 represents a simple ertical casation cycle, where node y 0 loses a path to and rerotes throgh y. Lemma 1. Gien a casation cycle Y = y 0... y k t of an economic DPR instance ( $, t, G), eery node in Y is a proider to the primary node y 0. Proof: Let Y, where 0 < i < k. By Theorem 1, Y is alley-free and either 1 $ or $ +1. If the first case is tre, then by the definition of alley-free paths y j 1 $ y j for all 0 < j < i, and by the transitie natre of economic relationships, y 0 $. If the second case is tre, then by the definition of alley-free paths y j $ y j+1 for all i < j < k, and by the transitie natre of economic relationships, $ y k. Ths eery node is a proider to y 0 = y k. Theorem. Eery casation cycle Y = y 0... y k t of an economic DPR instance is ertical and simple. Proof: Lemma 1 directlmplies that eery casation cycle in economic DPR instances are ertical. The second part regarding simple casation cycles is proed by contradiction. Assme there exists a non-simple casation cycle Y 1 = y 0 y 1... y k y 1 t where y 0 = y k. From Lemma 1, y 0 $ y 1. Howeer a new casation cycle Y exists where: Y = y 1 y... y k 1 y k y 1 t+1. Ths by Lemma 1, y 1 $ y k = y 0 which is a contradiction. The theoretical reslts in this section are the proofs for the three principles of safe policy roting dynamics introdced in Section II. The non-interference principle comes from Theorem 1, which states that eery casation chain in an economic DPR instance mst be alley-free. The single and mlti-tiered cycle principles come from Theorem, which states that eery casation cycle in an economic DPR instance is ertical and simple. V. INTERFERENCEBEAT In this section, we otline a distribted algorithm, INTER- FERENCEBEAT, that checks if the principles of safe policy roting dynamics are maintained or whether policolations exist. This is accomplished by detecting forbidden casation chains (inclding cycles) indced by policolations. Once a forbidden casation chain is detected, the ASes inoled need to collaborate to resole the potential problem. A. Description of INTERFERENCEBEAT INTERFERENCEBEAT piggybacks a small token alongside rote pdates. When a node y receies a rote pdate from its neighbor at time t, it also receies a token θ in. If node y selects a new path then it broadcasts a new token θ ot alongside

6 6 its own rote pdate at time t + 1. Tokens are passed along casation chains. In general, a casation chain is started when a link flaps (i.e., is lost or becomes aailable) or when a node changes its path preferences. A token consists of three parts, (i, r, n). The identifier of the casation chain is i. The economic relationship between y and its predecessor on the casation chain is r { $, $, = $, }. For example, if is a proider to y, then r is $. The conter n keeps track of the nmber of times the token was passed along a cstomerto-proider or a proider-to-cstomer link. The PROCESS fnction, otlined in Figre 7, performs basic roting tasks and handles the incoming and otgoing tokens. It is inoked in eery node y at time t after receiing all roting pdate messages. In steps and, node y chooses and adopts its best aailable path. If y s assigned path has changed in step 4 (i.e., an action occrred), then node y s casing neighbor is identified in step 5. The contents of the token receied from neighbor are recoered in step 6. In step 7, the CREATETOKEN fnction is called which retrns the contents of the new token to be sent ot by y at time t+1. The CHECKPRINCIPLES fnction is called in step 8. Node y stores information abot the otgoing token in step 9. In step 10, the otgoing token created by node s disseminated to all y s neighbors. 1: fnction PROCESS(y, t) : Best(y, t) max t Choices(y, t) : π(y, t + 1) Best(y, t) 4: if π(y, t + 1) π(y, t) then 5: = C(y, t) 6: θ in =GETTOKENFROMNEIGHBOR(y,, t) 7: θ ot = CREATETOKEN(y,, θ in ) 8: CHECKPRINCIPLES(y,, θ in, θ ot ) 9: STORETOKEN(y,, θ ot ) 10: SENDTOKEN(y, t, θ ot ) Fig. 7. PROCESS fnction. The CREATETOKEN fnction is otlined in Figre 8. Step retriees the needed parts from the incoming token. If the identifier i in is emptn step then a new one is generated in step 4. Otherwise, in step 6, the otgoing identifier i ot is set to the incoming identifier i in. In step 7, the economic relationship between and s obtained and stored in r ot. In steps 8 throgh 11, the otgoing conter n ot is onlncremented if nodes y and are not peers. The otgoing token is retrned in step 1. The CHECKPRINCIPLES fnction is otlined in Figre 9. Steps and retriee the needed parts from the tokens. Step 4 checks for the existence of a alley casation chain. If one is fond, then interference is reported, where the casing node, the chain identifier i in and the relationship r in are identified. In step 6, node y determines if it has preiosly receied a token with identifier i in. If so, then a cycle is detected. Node y recoers the old information in step 7. If the token was preiosly receied from the same neighbor then a nonsimple cycle is reported in step 9. Step 10 checks if the token preiosly receied contained the same conter ale. If so, 1: fnction CREATETOKEN(y,, θ in ) : (i in,, n in ) = θ in : if i in is then 4: (i ot, r ot, n ot ) =(NEWID(),, 0) 5: else 6: i ot = i in 7: r ot = ECONOMICRELATION(, y) 8: if r ot is eqal to = $ then 9: n ot = n in 10: else 11: n ot = n in + 1 1: retrn (i ot, r ot, n ot ) Fig. 8. CREATETOKEN fnction. then the token was only passed between peers since leaing node y and a horizontal cycle is reported in step 11. 1: fnction CHECKPRINCIPLES(y,, θ in, θ ot ) : (i in, r in, ) = θ in : (,, n ot ) = θ ot 4: if (r in is eqal to $ or = $ ) and ( $ y) then 5: REPORTINTERFERENCE(y,, θ in ) 6: if HASRECEIVEDTOKEN(y, i in ) then 7: ( old, n old ) = GETSTOREDTOKEN(y, i in ) 8: if old is eqal to then 9: REPORTNONSIMPLECYCLE(y,, θ in ) 10: if n old is eqal to n ot then 11: REPORTHORIZONTALCYCLE(y,, θ in ) Fig. 9. CHECKPRINCIPLES fnction. B. Sample Operation of INTERFERENCEBEAT Figre 10 shows the operation of INTERFERENCEBEAT on the DPR instance described in Figre, assming y 0, y 1 and y are all peers. At time t+1, node y 0 initiates a new casation chain with identifier ID1 and sends a token to y 1. Since y 0 initiated the chain, the cont is 0 and the relationship is. Node y 1 takes an action and sends a new token to y. Since y 1 and y 0 are peers, the relationship is set to = $ and the cont is still 0 as the token only traersed a peering link. Finally, since y is a peer to its casing node y 1, interference is detected by y pon receiing the token. Fig. 10. Sample operation of INTERFERENCEBEAT. C. Properties of INTERFERENCEBEAT INTERFERENCEBEAT has the following characteristics: Efficient Space. A small token of space complexity O(1) (a few bytes) is appended to each roting pdate message

7 7 irrespectie of how the roting dynamics manifest in the network. Proably Correct. INTERFERENCEBEAT is based on a comprehensie theory of policy roting dynamics and hence is proably correct with any dynamic network. In other words, any changes in network topology or path preferences do not affect the correctness of detecting policolations. Adoptable. INTERFERENCEBEAT enables reslts een in the case of gradal adoption of the protocol. To detect policolations, only the ASes along the casation chain need to adopt the protocol. Ths neighboring ASes can se INTERFERENCEBEAT to detect misconfigrations. Priacy Presering. ASes only reeal information to their immediate neighbors and local policnformation is not explicitly shared. D. Practical Considerations for INTERFERENCEBEAT INTERFERENCEBEAT cold be implemented oer BGP where the token is passed in the message options. When an AS initiates a new casation chain it mst create a new identifier sing the NEWID() fnction. This can be accomplished by hashing the AS nmber, roter identifier, time and destination prefix. A fixed nmber of bits can be allocated to the identifier, with more bits redcing the probability of a hash collision. In INTERFERENCEBEAT, if a cycle or alles detected by a node y, onlts casing neighbor node can be immediately identified. In order to identify/notify other nodes along the chain, a back-propagating alert protocol may be sed. Each node can leerage its stored tokens to find its preios casing neighbor. In appendix F we show that the synchronicity of DPR is not a hindrance and that it has sfficient expressie power to model asynchronicity. Hence, INTERFERENCEBEAT can be triially extended to a real-time setting. VI. VIOLATIONS OF THE ECONOMIC DPR MODEL We formally define for common policolations, which are relaxations of the economic DPR model. For each iolation we proe the inariant properties of the resltant casation chains and cycles. The modelled dynamics indced by each iolation can be compared against the dynamics obsered by INTERFERENCEBEAT. If a iolation cannot case the obsered behaior, then it can be rled ot. A. Description of Violations To describe paths and casation chains in better detail we categorize alleys into for sbtypes. Definition 0 (Valley Types). We extend definition 16 of alleys to for sbtypes as shown in Table II. Violation 1: Non-Strict Economic Relationships With non-strict economic relationships, a node can be both a (direct or indirect) proider and a (direct or indirect) peer to another node. Figre 11 shows a comparison between non-strict and strict economic relationships. TABLE II VALLEY TYPES GIVEN SEQUENCE a b c. Valley Type Condition Illstration peer proider A B C D proider peer a $ b $ c a $ b = $ c a = $ b $ c a = $ b = $ c z Non-Strict Strict Fig. 11. Strict and non-strict economic relationships. In the strict ariant, node cannot be an indirect proider and peer to node z. peer proider proider peer Violation : Transiting Between s Generally, an AS only carries traffic that is destined to (or originating from) one of its cstomers. Howeer, de to misconfigrations or complex agreements between peers, an AS may transit traffic between its peers. Economic DPR instances with this iolation hae an enlarged set of realizable paths. Paths containing alleys of type D can be adopted by nodes. Howeer, paths are forbidden if they contain alley types A, B, or C. Therefore, eery realizable path consists of a series of zero or more ascending cstomer-to-proider edges, followed by zero or more peer edges, followed by zero or more descending proider-to-cstomer edges, as shown in Figre 1. With Transiting Withot Transiting Fig. 1. Allowable paths in economic DPR with and withot iolation. Violation : Paths oer Cstomer Paths Whereas iolation is a relaxation on the set of realizable paths, iolation is a relaxation of the path preferences. Nodes in economic DPR instances with iolation can prefer peer paths oer cstomer paths. Nodes, howeer, cannot prefer proider paths oer peer/cstomer paths. Only alley-free paths are realizable. Violation 4: Proider Paths oer /Cstomer Paths Nodes in economic DPR instances with iolation 4 can prefer proider paths oer peer/cstomer paths. Again, only alley-free paths are realizable. z

8 8 TABLE III VIOLATIONS OF THE ECONOMIC DPR MODEL Violation Valley Types in Casation Chains: Vertical Cycles Horizontal Cycles Potentially A B C D Unsafe? 0: None simple none no 1: Non-Strict Economics simple none no : Transiting simple non-simple, simple yes : s Preferred simple non-simple, simple yes 4: Proiders Preferred non-simple, simple none yes B. Dynamics Indced by Violations The for iolations describe different ariants of the economic DPR model. Each ariant reslts in different types of casation chains and cycles. For ease of exposition, we model the reslting dynamics of each iolation in isolation. The theoretical proofs for the iolations can be fond in the appendices Table III smmarizes the effects of each iolation on the characteristics of casation chains and cycles. The first and second rows show the strict and non-strict economic DPR models. They are the only two ariants garanteed to be safe. The non-strict economic DPR model, howeer, when combined with other iolations cold lead to potentially nsafe behaior. The three other iolations indce roting behaior which is potentially nsafe. INTERFERENCEBEAT can be extended sing the reslts of Table III. Upon the detection of a allen the casation chain, its type (A, B, C, or D) can rle ot possible casing iolations. For example, if a alley of type B was detected sing INTERFERENCEBEAT, then iolations 1,, and can be immediately rled ot as the possible cases for the obsered behaior. Similar methods can be sed pon detection of casation cycles. VII. RELATED WORK Static models for BGP, sch as the Stable Paths Problem (SPP) [4], proide insight into the steady-state behaior of policy roting. There are also offline methods that leerage SPP and tilize information from BGP tables [8] to infer policy conflicts between ASes. DPR extends SPP to gie insight into the real-time transient behaior of networks. DPR allows s to reason abot isses sch as misconfigred roting policies or networks with sporadic link failres. The canonical soltion for detecting policy conflicts based on SPP is the Safe Path Vector Protocol (SPVP) introdced by Griffin et al. in [9]. SPVP exchanges rote flaps among ASes in extended history messages. INTERFERENCEBEAT extends SPVP by appending additional information in a small token to each roting pdate message to detect iolations of the Gao-Rexford gidelines [5]. There are many algorithms that attempt to detect and resole policy conflicts. Conting [10] and other token-based [11] heristic approaches benefit from haing a low commnication oerhead. INTERFERENCEBEAT extends sch approaches by leeraging the DPR model to garantee the correctness of policolation detection and diagnosis. Finally, there are roting architectres that constrain traditional policy roting to garantee conergence. Metaroting [1] defines a policy langage based on a roting algebra that gies compile-time garantees for roting conergence. In [1], real-time enforcement of conergence is achieed by passing information in tokens to affect policy rankings. INTERFERENCEBEAT does not enforce conergence. Instead it leerages the DPR model to detect non-compliance to the principles of safe roting dynamics and notifies ASes pon the detection of policolations. VIII. CONCLUSIONS We introdced a Dynamic Policy Roting (DPR) model, which extends the static model of BGP to captre the propagation dynamics of rote flaps de to arbitrary changes in topology or path preferences. The theoretical reslts of this paper can be smmarized by three key principles which distill the properties of roting dynamics in a safe (economic) policy configration. We introdce INTERFERENCEBEAT, a noel distribted algorithm to detect and diagnose policolations. INTER- FERENCEBEAT has a beneficial set of characteristics sch as efficiency, priacy, and adoptability. Diagnosis is frther enhanced by modelling common policolations sch as the preference of peer paths oer cstomer paths. IX. ACKNOWLEDGMENT This work has been partially spported by National Science Fondation awards: CISE/CCF #08018, CISE/CSR #070604, CISE/CNS #054477, CNS/ITR #00594, and CISE/EIA RI # REFERENCES [1] C. Laboitz, A. Ahja, A. Bose, and F. Jahanian, Delayed Internet Roting Conergence, IEEE/ACM Trans. Netw., ol. 9, pp. 9 06, Jne 001. [] A. Feldmann, O. Maennel, Z. Mao, A. Berger, and B. Maggs, Locating Internet Roting Instabilities, in ACM SIGCOMM, September 004. [] K. Varadhan, R. Goindan, and D. Estrin, Persistent Rote Oscillations in Inter-domain Roting, Compter Networks, Tech. Rep., [4] T. Griffin, F. Shepherd, and G. Wilfong, The Stable Paths Problem and Interdomain Roting, IEEE/ACM Transactions on Networking, ol. 10, no., pp. 4, Apr 00. [5] L. Gao and J. Rexford, Stable Internet Roting Withot Global Coordination, IEEE/ACM Trans. Netw., ol. 9, no. 6, pp , 001. [6] D. Obradoic, Real-time Model and Conergence Time of BGP, in INFOCOM, 00. [7] N. Feamster, H. Balakrishnan, and J. Rexford, Some Fondational Problems in Interdomain Roting, in rd ACM SIGCOMM Workshop on Hot Topics in Networks (HotNets), San Diego, CA, Noember 004.

9 9 [8] F. Wang and L. Gao, Inferring and Characterizing Internet Roting Policies, in ACM IMC, 00, pp [9] T. Griffin and G. T. Wilfong, A Safe Path Vector Protocol, in INFOCOM, 000, pp [10] J. Cobb and R. Msnri, Enforcing Conergence in Inter-domain Roting, Global Telecommnications Conference, 004. GLOBECOM 04. IEEE, ol., pp Vol., No.- Dec [11] S. Yilmaz and I. Matta, An Adaptie Management Approach to Resoling Policy Conflicts, in IFIP Networking 007, Atlanta, Georgia, May 007. [1] T. G. Griffin and J. L. Sobrinho, Metaroting, in SIGCOMM 05: Proceedings of the 005 conference on Applications, technologies, architectres, and protocols for compter commnications. New York, NY, USA: ACM, 005, pp [1] C. T. Ee and V. Ramachandran and B.G. Chn and K. Lakshminarayanan and S. Shenker, Resoling Inter-Domain Policy Disptes, in SIG- COMM, 007, pp APPENDIX A PROOF OF THEOREM 1 For conenience of notation, we drop the time index of certain terms with respect to a gien chain Y = y 0 y 1... y k t, namely: π( ) = π(, t + i) π next ( ) = π(, t + i + 1) ρ( ) = ρ(, t + i) ρ next ( ) = ρ(, t + i + 1) RankDec( ) iff RankDec(, t + i) RankSame( ) iff RankSame(, t + i) RankInc( ) iff RankInc(, t + i) Theorem 1. Eery casation chain of an economic DPR instance ( $, t, G) is alley-free. Proof: Assme not. Then there exists a casation chain Y = y 0 y 1... y k t and an index i sch that 0 < i < k and 1 $ $ +1. Ths 1 and +1 are peers or proiders to. The first part of this proof shows that if this is the case, then at no time dring the casation chain did hae a cstomer path. The second part of this proof shows that sometime dring the casation chain +1 had a path throgh. Therefore +1 had a realized alley path since did not hae a cstomer path and is a cstomer of or peer to +1. Since alleypaths are forbidden in economic DPR instances, this reslts in a contradiction. Since C( ) = 1, either the first or second condition of casation from Table I holds for at time t + i t+i -1 Fig. 1. Casation condition 1: RankDec( ) t+i Fig. 14. Contradiction: RankInc( ) t+i+1 +1 t+i+1 Case: Casation Condition If the second condition of Table I holds for then: ρ next ( ) = 1 and RankInc( ), as shown in Figre 15. Therefore π( ) t+i π next ( ). Let = ρ( ). It cannot be that $. Otherwise, since π( ) is a cstomer path and π next ( ) is not (since ρ next ( ) = 1 $ ), by the conditions of economic DPR instances π( ) t+i π next ( ), casing a contradiction, as shown in Figre 16. Ths ρ next ( ) $ and $. So for both cases, at no time in the casation chain did hae a cstomer path: -1 ρ( ) $ and ρ next ( ) $ +1 t+i -1 Fig. 15. Casation condition : RankInc( ) +1 t+i+1 Case: Casation Condition 1 If the first condition of Table I holds for then: ρ( ) = 1 and RankDec( ), as shown in Figre 1. Therefore π( ) t+i π next ( ). Let = ρ next ( ). It cannot be that $. Otherwise, since π next ( ) is a cstomer path and π( ) is not a cstomer path (since ρ( ) = 1 $ ), by the conditions of economic DPR instances: π( ) t+i π next ( ), casing a contradiction as shown in Figre 14. Ths $ and ρ next ( ) $ t+i Fig. 16. Contradiction: RankDec( ) t+i+1 Case: +1 Casation Condition 1 If the first casation condition of Table I holds for +1,

10 10 then ρ(+1 ) =. By Proposition 1: π(+1 ) = +1 π( ). π(+1 ) is a alley path since +1 $ $ ρ( ). Since all alley paths are forbidden, π(+1 ) can neer be realized, casing a contradiction. Case: +1 Casation Condition Similar argments can be sed if the second casation condition of Table I holds for +1 : ρ next (+1 ) =. Ths by Proposition 1: π next (+1 ) = +1 π next ( ). π next (+1 ) is a alley path since +1 $ $ ρ next ( ), and can neer be realized. Ths in all cases a contradiction occrs, proing the theorem. APPENDIX B THEOREMS AND PROOFS FOR VIOLATION 1 Violation 1 inoles the most complicated constrctions. The following sbsection formally defines non-strict economic relationships. If an economic DPR has non-strict economic relationships D = (,, G), then it contains the economic operator. From, a tight economic relation is defined by: iff and and no relation is defined by: iff and The cstomer, peer, and proider economic relationships can be deried from the operator : If is a cstomer of, then. If is a proider to, then. If is a peer to, then. The transitie properties of the economic operator can be modeled sing post-order conditions: 1) (reflexie) x x ) (anti-symmetric) x y and y x implies x = y ) (transitie) x y and y z implies x z The key difference between a strict and non-strict economic operator is that peering relationships are not transitie in the non-strict ariant. Whereas peering is represented by the eqialence relation = $ in the strict ariant, peering is represented by no relation in the non-strict ariant. Ths as shown in figre 17, strict economic relationships form eqialence classes with the peering relation = $, which are not present in standard economic relationships. This enables a node to be both an indirect peer and proider to another node in the standard ariant. Howeer it shold be noted that proider-tocstomer relationships are transitie in both ariants. For ease of notation, the following notation is sed to describe that node x is a peer or proider to node y: x ff x y We define paths by the economic relationship between a path s starting node and its next-hop. For all paths P : Cstomer(P ) NextHop(P ) (P ) NextHop(P ) Proider(P ) NextHop(P ) Strict Non-Strict Fig. 17. Strict and Non-Strict economic relationships. The circles oer the nodes in the strict ariant represent eqialent classes of peers. Gien a seqence of nodes a b c, alley types are represented as follows: Valley Type Condition Illstration A B C D a b c a b c a b c a b c Theorem. All casation chains of non-strict economic DPR instances are alley-free. Proof: The proof follows exactly as the proof for theorem 1, only by replacing the $ with and $ with. Theorem 4. All casation cycles of non-strict economic DPR instances are ertical and simple. Proof: Let Y = y 0 y 1... y k t be a casation cycle, where y 0 = y k. The cases for this proof can be partitioned by y 1 s economic relationship with y 0 : Case (a): y 0 y 1 : If y 0 y 1, since Y is alley-free, +1 for 0 i < k. Howeer y 0 y k = y 0, casing a contradiction and eliminating this case. Case (b): y 0 y 1 : If y 0 y 1, since Y is alley-free, +1 for 1 i < k. Ths Y is ertical. Y has to be simple, otherwise y k 1 y 0 y 1 wold be a realized casation chain. Since y k 1 y 0 and y 0 y 1, the casation chain is a alley, casing a contradiction. Therefore Y is simple and ertical. Case (c): y 0 y 1 : Assme y 0 y 1. Ths Y is ertical. The cases can be frther partitioned by y k 1 s economic relationship with y k. If y k 1 y k, then by the definition of alley-free seqences, 1 for all 0 < i k. Ths y 0 y k = y 0, which is a contradiction. Therefore y k 1 y k. If Y is non-simple, then y k 1 y 0 y 1 wold be a realized casation chain of. Since y k 1 y 0 = y k and y 0 y 1, the casation chain is a alley, casing a contradiction. Therefore Y is simple and ertical. Remark 1. Non-strict economic follows instances are safe. This follows from the reslts of [5].

11 11 APPENDIX C THEOREMS AND PROOFS FOR VIOLATION Theorem 5. Eery casation chain in an economic DPR instance with iolation does not admit alley types A, B or C. Proof: Assme not. Then there exists a casation chain Y = y 0 y 1... y k t and an index i sch that 0 < i < k and at least one of the two conditions hold: (a) 1 $ $ +1 (b) 1 $ $ +1 Case (a): 1 $ $ +1 If case (a) holds, then it can be shown that both ρ( ) $ and ρ next ( ) $. This can be seen by looking at the casation conditions of. If casation condition 1 holds for, then 1 = ρ( ) and RankDec( ). It cannot be the case that ρ next ( ) $, since this wold imply that switched from a proider path throgh 1 to a non-proider path, since $ ρ( ) = 1 and $ ρ next ( ). This wold imply RankInc( ), casing a contradiction. Ths ρ( ) $ and ρ next ( ) $. If casation condition holds for, then 1 = ρ next ( ) and RankInc( ). It cannot be the case that ρ( ) $, since this wold imply that switched from a non-proider path to a proider path throgh 1, since $ ρ( ) and $ ρ next ( ) = 1. This wold imply RankDec( ), casing a contradiction. Ths for both cases, ρ( ) $ and ρ next ( ) $. Ths gien the reslts aboe, we can proe that +1 had a realized path with alley type A or C. If casation condition 1 holds for +1, then π(+1 ) = +1 π( ). Since +1 $ and $ ρ( ), then π(+1 ) is a realized path with alley type A or C, casing a contradiction. If casation condition holds for +1, then π next (+1 ) = +1 π next ( ). Since +1 $ and $ ρ next ( ), then π next (+1 ) is a realized path with alley type A or C, casing a contradiction. Case (b): 1 $ $ +1 If case (b) holds, then sing an argment similar to case (a) it can be shown that both ρ( ) $ and ρ next ( ) $. We can then proe that +1 had a realized path with alley type A or B, casing a contradiction. Theorem 6. Eery ertical casation cycle Y = y 0... y k t in an economic DPR instance with iolation is simple. Proof: This proof proceeds by determining y 1 s economic relationship with y 0 and y k 1 s economic relationship with y k = y 0. Since Y is a ertical casation cycle, there exists a minimal index i, 0 < i < k sch that $ 1. Note that i k, otherwise y 0 = $ y 1 = $... = $ y k 1 $ y k, implying y 0 $ y k, which is a contradiction. Either $ 1 or $ 1. It cannot be that 1 $, since by Theorem 5 y 0 = $ 1 $ $ $ y k, implying y 0 $ y k which is a contradiction. Therefore 1 $. If i > 1, then = $ 1 $, representing a alley of type C, which is a contradiction. So i = 1 and y 0 $ y 1. Let j be the first index 1 < j < k where y j 1 $ y j. Note that j has to exist otherwise y 0 $ y 1 $... $ y k, implying y 0 $ y k which is a contradiction. From Theorem 5, y h 1 $ y h for all j < h k. So y k 1 $ y k = y 0. Therefore Y mst be simple, otherwise y k 1 y 0 y 1 mst be a casation chain. Howeer since y k 1 $ y 0 and y 0 $ y 1, Y contains a alley of type A, contradicting Theorem 5, and ths proing the theorem. Theorem 7. An economic DPR instance with iolation admits simple and non-simple horizontal casation cycles. Proof: From the example shown in Figre 18 which is identical to the Bad Gadget described in [4]. Theorem 8. An economic DPR instance with iolation is potentially nsafe. Proof: From the example shown in Figre 18, no stable assignment exists. Path preferences: Node a: a b a Node b: b c b Node c: c a c a Fig. 18. Non-simple horizontal cycle for an economic DPR instance with iolation. Paths not listed in the path preferences are forbidden. c APPENDIX D THEOREMS AND PROOFS FOR VIOLATION Theorem 9. Eery casation chain in an economic DPR instance with iolation does not admit alley types A or B. Proof: Assme not. Then there exists a casation chain Y = y 0 y 1... y k t and an index i sch that 0 < i < k and 1 $ $ +1. The same reasoning as case (a) from the proof of Theorem 5 can be sed. By considering the casation conditions of, it can be shown that both ρ( ) $ and ρ next ( ) $. We can then proe that +1 had a realized path with alley type A or B, casing a contradiction.. Path preferences: Node a: a b a Node b: b c b Node c: c a c a Proider c Proider Proider Fig. 19. Non-simple horizontal cycle for an economic DPR instance with iolation. Paths not listed in the path preferences are forbidden. Theorem 10. Eery ertical casation cycle in an economic DPR instance with iolation is simple. Proof: Assme not. Let ertical casation cycle Y = y 0 y 1... y k t be non-simple. Since Y is a ertical casation b b

12 1 cycle, there exists a minimal index i, 0 < i < k sch that $ 1. Following a similar argment as the one sed to proe Theorem 6 we can proe that Y contains a alley of type A or B, which is a contradiction. Theorem 11. An economic DPR instance with iolation admits simple and non-simple horizontal casation cycles. Proof: From the example shown in Figre 19. This example is identical to the Bad Gadget described in [4]. Theorem 1. An economic DPR instance with iolation is potentially nsafe. Proof: From the example shown in Figre 19, no stable assignment exists. APPENDIX E THEOREMS AND PROOFS FOR VIOLATION 4 Theorem 1. Eery casation chain in an economic DPR instance with iolation 4 does not admit alley types C or D. Proof: Assme not. Then there exists a casation chain Y = y 0 y 1... y k t and an index i sch that 0 < i < k and: 1 = $ $ +1 The rest of the proof follows similarly to that of theorem 5. First it is shown that both ρ( ) $ and ρ next ( ) $. Then it is shown that either ρ(+1 ) or ρ next (+1 ) is a alley path, casing a contradiction. Theorem 14. There are no horizontal cycles in economic DPR instances with iolation 4. Proof: This follows directly from theorem 1, which states that casation chains of type D do not exist. Theorem 15. An economic DPR instance with iolation 4 admits simple and non-simple ertical casation cycles. Proof: From the example shown in Figre 0. This example is identical to the Bad Gadget described in [4]. Path preferences: Node a: a b a Node b: b c b Node c: c a c Fig. 0. Non-simple horizontal cycle for an economic DPR instance with iolation 4. All edges are cstomer/proider links. Paths not listed in the path preferences are forbidden. Theorem 16. An economic DPR instance with iolation 4 is potentially nsafe. Proof: From the example shown in Figre 0, no stable assignment exists. Fig. 1. M M Transit Nodes M-1 M APPENDIX F ASYNCHRONICITY WITH DPR (, ) t E (, ) t E This section describes how the DPR model can simlate asynchronicity. We assme that we hae a reglar DPR instance D = (, G) which we wish to agment with asynchronicity. There are seeral ways to represent asynchronicity. We will se link delays. This choice enables s to se the existing DPR model withot adding new constrcts. At any time t, each link (, ) t E admits a ariable time delay between 1 and a finite pper limit M. This delas specified by the fnction L(,, t) which otpts an integer in [1, M]. The time delays are considered ordered, sch that L(,, t) L(,, t + k) < k. Ths the ales L(,, 4) = 100 and L(,, 5) = are not allowed since wold get s path at time 5 before receiing s path at time 4. From DPR instance D and delay fnction L, a new DPR instance D = (, G ) can be constrcted to simlate D with the time delays. For eery pair of nodes in the original instance D, a set of M 1 transit nodes will be added to D. These transit nodes represent the commnication wire between eery two nodes. The dynamic natre of the links in DPR instances will be sed to control the length of the commnication wire. If L(,, t) = 5, then a path of length 5 between and throgh the transit nodes will appear at time t. A. Graph of Asynchronos DPR Instances For eery node in the original DPR instance D, there is a corresponding node in the asynchronos DPR instance D : V V For eery two nodes, in D, there are M 1 transit nodes:, V i V for i M Each transit node is connected to its neighbors. This connection forms the longest possible commnication between nodes and. It toggles on/off with the connectiity of (, ) t E for each time t, as shown in figre 1. (, M )t E ( i+1, x i (, ) t E ) E for all 1 < i < M iff (, )t E The time delays L(,, t) describe the shortct aailable throgh the transit nodes at each time t: (, i ) t E iff (, ) t E and L(,, t) = i (, ) t E iff (, ) t E and L(,, t) = 1 An example of a delay of one and three between nodes and can be seen in figres and.